Google opens Gemini’s agent sandboxes to Cloud customers

Google on October 22 announced Agent Compute Engine, the system that runs Gemini’s agents, as a Google Cloud service. It gives each agent a persistent computer with root access, and it is built on the assumption that whatever runs inside will be hostile. So the machine holds no keys, tokens or passwords at all.

The service was announced at the Linux Foundation’s AGNTCon+MCPCon in San Jose and opens to Google Cloud users in preview later this year, The New Stack reports. It started as internal infrastructure for Gemini, Antigravity and Google’s own model training pipelines. In its launch post Google says that “scaling Gemini to planet scale taught us firsthand that securely running autonomous agents is fundamentally an infrastructure challenge.”

Why VMs and containers didn’t fit

Google says agentic workloads have quickly become one of the fastest-growing consumers of compute and storage across its fleet. Rohit Jnagal and Ramanathan Venkatapathy, both distinguished engineers at Google, explain the problem in a technical deep dive. Traditional VMs give developers control and flexibility, but booting, suspending and resuming them is slow, and agents start and stop all the time. Containers solve part of that, “but there are multiple examples like coding agents and developer assistants that need complete isolation as well as kernel- and root-level control of the agentic environment.”

Their answer is a microVM per agent: a stripped-down virtual machine with its own kernel that starts at close to container speed. The microVMs run on Cloud Hypervisor, an open source virtual machine monitor, and each one gets its own guest kernel and root access. The engineers call the result “a unified, agent compute platform for Google.”

A computer that sleeps between tool calls

An agent gets a sandboxed machine that stays around. It can run shell scripts, drive a headless browser and write code as root, in agent loops that can run for weeks. Google also built the service for large-scale work: the eval loops frontier labs use to test models, AI benchmarking, reinforcement learning, and the sandboxed backends of Google’s own services.

The efficiency comes from the observation that agents spend most of their time waiting on the model or the user. When an agent finishes a tool call and goes back to “thinking,” the microVM signals that it is idle. The host then checkpoints it, and it uses no active resources until the next call comes in. The same mechanism pauses a machine while the agent waits on a human or an external system, and restores it from the snapshot. To fit more agents on one physical host, the service also runs multiple agents on a single operating system template, sharing memory copy-on-write.

Nothing to steal inside

Each agent session runs in a single-tenant, memory-safe microVM that holds no secrets in memory or on disk. Its only identity is short-lived and scoped to the session, delivered through a single local listener per VM. The microVM has no standard network interface. All traffic goes through a proxy outside the sandbox, and when the agent needs a service like Google Drive, Google’s Agent Gateway checks the user’s delegation and the sandbox’s identity, then adds the real credential outside the machine. Traffic is encrypted end to end in transit, and snapshots and disks are encrypted at rest.

The host is a stateless appliance with a read-only filesystem, and its hardware and firmware are cryptographically verified at every boot. Underneath is Google’s Titan and Titanium IPU security platform.

Jnagal and Venkatapathy use the case of an enterprise agent managing someone’s inbox. It reads an email with hidden instructions to find any API keys on the machine and send them to an outside address. The model will ignore that most of the time, they say, but not always. “We started from one rule: Assume an attacker controls everything inside the sandbox, and make sure they find nothing there to use,” the team writes. This summer, OpenAI’s agents used credentials they found in public code repositories to reach Census Bureau data. A sandbox with no credentials in it gives an agent nothing like that to find.

Who already sells this

Agent sandboxes aren’t new. E2B runs each sandbox in a Firecracker microVM, the open source technology AWS built for Lambda, and can pause one with its memory and filesystem intact and resume it in about a second. Daytona started with containers and added microVM sandboxes in July. Those can pause a full machine or fork a running one into identical copies. Both work on any cloud.

AWS’s Bedrock AgentCore also gives every agent session its own microVM. It doesn’t charge for CPU while the agent waits on a model or a tool, but memory keeps billing until the runtime reclaims it. Sessions top out at eight hours. In August AWS added EC2-based runtime instances that keep shared sessions alive for up to 14 days. Google’s version, which checkpoints the whole microVM after each tool call, goes a step further than that on idle resources, at least as Google describes it.

Google already had pieces of this as well. GKE offers a managed version of Agent Sandbox, the open source Kubernetes project Google launched last November, and the Gemini Enterprise Agent Platform sells code-execution and computer-use sandboxes.

Agent Substrate, for teams that stay on Kubernetes

Teams that don’t want a managed service get Agent Substrate, an open source runtime for GKE that Google first announced in May. It builds on Agent Sandbox and adds a lightweight control plane, which Google says can handle millions of short-lived tool calls that would swamp Kubernetes. Like Agent Compute Engine, it snapshots an idle agent’s memory and returns the machine to the pool until the agent has more work.

Google says that gives up to 10 times the density of traditional compute. In a 200,000-agent benchmark, the company says, Substrate handled 500 activations per second, and agents suspended and resumed in under half a second. Each sandbox can be isolated with a microVM or with gVisor, Google’s user-space kernel that intercepts a container’s system calls. Every agent gets its own cryptographic identity, and egress proxies attach credentials outside the sandbox. Substrate runs on any Kubernetes cluster, and Google says it works with any harness, including Claude Code, OpenClaw and Nous Research’s Hermes.

“We built Hermes Enterprise to enable customers to deploy into their existing infrastructure, while handling per-agent isolation and extensible access control,” said Hervé Bizira, Nous Research’s chief business officer. “Agent Substrate addresses both at the platform layer in a way that also preserves valuable compute resources.”