The report
Google announced Agent Compute Engine, a service designed around rapidly starting and resuming agent microVMs, with a preview planned for coming months rather than general availability on October 22. Google describes per-agent identity, short-lived credentials and network egress controls that inject service secrets outside the microVM. Its related Agent Substrate project reportedly supported validation at 200,000 agents, 500 activations per second and under 500 ms suspend or resume latency in a vendor benchmark.
The architecture is notable because it separates an agent's runtime privileges from network and credential policy, with policy gateways and telemetry intended to work across cloud providers and local agents. None of the announced isolation statements demonstrates that co-resident cache channels are impossible; OpenAI's directed microVM research studies a different shared-resource property. Nor should vendor scale tests be rewritten as independently replicated field measurements. Google technical and governance announcement.
Credential delivery is not an isolation proof
The reported architecture puts a privileged guest inside a microVM while routing selected external access through a host-controlled policy gateway. The guest is not intended to hold reusable service API keys or ordinary OAuth tokens; a scoped workload identity and delegation decision can be evaluated outside it. This can narrow credential theft after compromise, provided every effect route is mediated and policy cannot be rewritten by the guest. It does not rule out side channels through shared hardware or prove that future partner previews had identical controls on launch. The 200,000-agent test and 500 activations per second remain Google-reported capacity results, not third-party security test outcomes. Google deployment description.
Moving the credential boundary out of the guest
Google's architecture distinguishes an agent's powerful in-guest execution from its permission to act through outside services. Short-lived workload identity and a gateway that injects credentials can reduce the amount of reusable authority held inside a guest microVM. That protection depends on which external paths are actually mediated, the validity of delegated user purpose, and revocation at the gateway; a microVM is an isolation primitive, not an authorization decision. Published scale and restore performance are vendor claims, and announced preview features should not be described as deployed customer controls. Google's platform description.