Scaling Gemini to planet scale taught us firsthand that securely running autonomous agents is fundamentally an infrastructure challenge. The shift from single-turn prompting to interactive agents requires a new paradigm of execution and control. To support massive concurrent agent sessions, we engineered new compute and governance solutions for Gemini to help solve these challenges.
Today at AGNTCon + MCPCon, we are delivering these capabilities to customers by launching Agent Compute Engine, a purpose-built compute service that already powers Gemini as an agent for work tasks. It will be available in preview in the coming months, providing hardware-isolated runtime sandbox security. Additionally, we are extending Gemini for business’ agent governance capabilities to support agents wherever they operate. Together, these capabilities deliver the control you need to run, govern, and scale your agents.
Under the hood of Agent Compute Engine
Agent Compute Engine arose from the need to handle Google’s massive agentic workloads that write and execute code, run tools, drive browsers, orchestrate enterprise workflows, and iterate rapidly and at scale. While traditional compute primitives are excellent for standard workloads, they weren’t optimized for the unique, highly iterative nature of AI agents.
Purpose-built for agents, Agent Compute Engine gives every Gemini agent its own high-performance, secure computer to act upon, powering Gemini’s dynamic, high-churn sessions. Agent Compute Engine is optimized specifically for the unique lifecycle patterns of AI agents, and you will soon be able to use this service to power your own custom agents. Highlights include:
- Speed with efficiency: Agents start, pause, and resume constantly and require an architecture that delivers speed, at scale, all with extreme efficiency. Agent Compute Engine delivers microVMs that boot rapidly, so an agent loop or an eval sweep doesn’t wait on infrastructure. Further, supporting Google users with multiple agents requires a cost-effective solution that can get the most out of a physical machine. Agent Compute Engine achieves this by using copy-on-write memory sharing to run multiple agents on a single operating system template, and pausing idle microVMs via fast checkpoint and restore. When an agent finishes executing a tool call and enters the “thinking” phase of the agentic loop, the microVM signals that it’s idle, and the host moves it from an active to an idle state. In other words, it can pause a running microVM while an agent waits on a human or an external system, and quickly resume it from snapshots.
- Enhanced security, isolation and governance: As agents take on more complex tasks, the risk of untrusted or adversarial code executing inside a sandbox is an ever-present reality. By running Agent Compute Engine with Titanium, Google’s offload infrastructure processing unit (IPU), we deliver silicon-rooted defense-in-depth built for untrusted AI agents. Agent Compute Engine delivers strong isolation via a hardware-isolated Cloud Hypervisor boundary with its own guest kernel and root access. (For a closer look at Agent Compute Engine’s microVM architecture and security, read the technical deep dive.) Each microVM runs its agent’s own identity, using short-lived credentials. Every microVM also gets its own cryptographically verified ID, and service credentials are injected in egress outside the microVM. Integrated with Agent Gateway, Agent Compute Engine delivers comprehensive observability, policy and security evaluation.
- Persistence and enterprise integration: Agents require the ability to persist agent data across multiple, long-running sessions. To solve this, each Agent Compute Engine microVM has its own Hyperdisk, enabling persistence of execution workspaces and agent context. In addition, in order to do meaningful work, they need the ability to use enterprise data without moving it. By weaving Agent Compute Engine directly into Google’s cloud and identity fabric, enterprise connectivity is governed by the exact same security and identity model that protects the microVM itself, enabling a unified identity model as well as auditability.
