What happened
On Oct 22 (AGNTCon + MCPCon) Google Cloud announced Agent Compute Engine, a compute service that gives every AI agent its own hardware-isolated microVM behind a Cloud Hypervisor boundary, holding zero persistent credentials. The sandbox has no standard NIC/default gateway/direct VPC access; traffic crosses a virtio-vsock boundary to Agent Gateway, which swaps in the real backend credential after policy checks, and each session carries a session-scoped SPIFFE workload identity. Google also expanded agent governance (Agent Gateway, Agent Registry, Agent Identity, OpenTelemetry observability) and open-sourced its Kubernetes-native sibling Agent Substrate on GKE. Customer preview is targeted for the coming months.
Why it matters
This is the first hyperscaler-grade reference architecture for 'assume the attacker controls the whole sandbox' agent isolation — a prompt-injected agent finds no secrets to steal inside its own microVM. It sets the default security posture for the huge wave of enterprise agents, and gives security teams a concrete containment model (credential token swap, workload identity, checkpointed idle sessions) to compare against other sandbox products.
Applicability
Cloud platform and security architects evaluating agent sandboxing/containment should benchmark this against AWS AgentCore Runtime and Azure dynamic sessions when the preview opens; monitor GA and pricing before committing.