What happened
Google announced Agent Engine at AGNTCon + MCPCon on October 22, 2026. The service assigns each a dedicated, single-tenant microVM with its own kernel, isolated by hardware boundaries and devoid of stored credentials. It is currently used internally to run Gemini and will open for preview in the coming months. The announcement also included Agent Substrate, an open-source Kubernetes runtime, and expanded governance features for Gemini Enterprise.
Google Cloud unveiled Agent Engine, a specialized compute service designed to run AI agents in isolated microVMs. Unlike standard containers that share a kernel, each agent operates in a single-tenant microVM with its own kernel and root access, fenced off by a hardware boundary. The service is currently used internally to run Gemini and Antigravity, and Google plans to open a preview to external customers in the coming months.
A key architectural feature is the removal of long-lived credentials from the agent's environment. The microVM contains no API keys, OAuth tokens, or service account keys. Instead, agents receive an ephemeral SPIFFE certificate and a short-lived identity token. When an agent needs to access a service, the request passes through a local virtio-vsock channel to a proxy and then to Agent Gateway, which verifies identity and swaps the token for the real credential on the fly. This design ensures that even if an agent is compromised via prompt injection, there are no valuable secrets to steal.
The service leverages Google's proprietary hardware, including the Titan security chip for firmware verification and the Titanium infrastructure processor for networking and storage. To optimize costs, the system uses fast checkpointing to move agents to an idle state when they are not active, utilizing DAX and copy-on-write techniques to minimize memory usage. Google claims this approach allows for density up to 10 times higher than traditional compute, with suspend and resume times under 500 milliseconds.
Alongside the proprietary service, Google released Agent Substrate, an open-source runtime for Kubernetes that supports zero-trust modes and can run on GKE or other clusters. It supports various agent frameworks, including Claude Code, OpenClaw, and Hermes. The announcement also included expanded governance tools for Gemini Enterprise, such as Agent Gateway for traffic control and Agent Registry for cataloging approved agents and tools.
Source details: pasqualepillitteri.it ↗
Why it matters
This launch addresses a critical security gap in agentic AI: the risk of prompt injection and credential theft. By removing API keys and OAuth tokens from the agent's execution environment and using ephemeral SPIFFE identities, Google reduces the attack surface significantly. The microVM design balances the isolation of traditional VMs with the speed of containers, enabling fast suspend/resume cycles for agents that spend most of their time idle. This infrastructure shift is essential for enterprises looking to deploy autonomous agents at scale without compromising security or incurring excessive costs for idle states.
The primary significance of Agent Engine is its approach to AI security. As agents become more autonomous and capable of executing code or interacting with external data, the risk of malicious exploitation increases. By architecting the environment so that the agent holds no persistent secrets, Google mitigates the impact of prompt injection attacks. This 'nothing to lose' design philosophy is a practical response to the inherent unpredictability of LLM-driven agents.
From an operational standpoint, the microVM model solves the latency problem associated with traditional virtual machines. Agents often spend significant time waiting for user input or external API responses. The ability to quickly suspend and resume state without incurring full costs makes large-scale agent deployment economically viable. The reported 500ms suspend/resume time and 10x density improvement are critical metrics for enterprise adoption.
The release of Agent Substrate as open source is also notable. It allows developers to implement similar isolation and governance patterns on their own Kubernetes clusters, potentially standardizing best practices for agent infrastructure across the industry. This move positions Google not just as a cloud provider but as a definer of the architectural standards for agentic AI.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
Monitor the preview availability and pricing model for Agent Engine, as well as the specific regions supported for data localization. Watch for adoption of the open-source Agent Substrate by third-party frameworks and the integration of Agent Gateway's new governance features into existing enterprise stacks. The November 9 'Future of AI Infrastructure' event may provide further details on the broader ecosystem.
The most immediate next step is the opening of the Agent Engine preview. Users should watch for the release of pricing documentation, as the cost of maintaining idle microVMs will be a key factor in adoption. The source notes that the preview is not yet open and that a form for registering interest is available.
Data localization and regional availability are currently unspecified. The technical post mentions compliance with geographic boundaries but does not list specific regions. Enterprises with strict data residency requirements will need to wait for the preview documentation to confirm support for their jurisdictions.
Adoption of Agent Substrate by non-Google frameworks will indicate the broader industry acceptance of this architectural pattern. The source mentions support for Claude Code, OpenClaw, and Hermes, but the extent of third-party integration will be a key indicator of the platform's utility beyond Google's own ecosystem.