Google Cloud Launches Agent Compute Engine, Giving Each AI Agent Its Own Isolated MicroVM
Announced at AGNTCON and MCPCON, ACE pairs hardware-isolated sandboxes with a zero-secrets identity model and an open-source Kubernetes companion.
Google Cloud announced Agent Compute Engine (ACE), which gives every AI agent session a hardware-isolated microVM with its own guest kernel and root access, built on Cloud Hypervisor. The architecture follows a zero-secrets principle: no credentials live inside the sandbox, and short-lived SPIFFE-based work identity only marks package origin, with an Agent Gateway performing token swaps at egress after policy validation. Idle microVMs are checkpointed and restored, so a reasoning agent consumes no resources while thinking.
Google also open-sourced Agent Substrate, a Kubernetes companion claimed to reach 500 agent activations per second with sub-500ms resume in tests of 200,000 agents, and up to 10x the density of traditional compute. It is compatible with agent harnesses including Claude Code and Hermes. The announcement, made at AGNTCON and MCPCON on 22 October, lands alongside Anthropic's donation of Agent Skills to the Linux Foundation's Agentic AI Foundation and Alibaba's OpenSandbox, signalling rapid standardisation of the agent runtime layer. Performance figures are Google's own.