Agents need a computer of their own, but VMs boot slowly and containers isolate weakly. How did Google resolve that trade-off? The options were two. VMs give root access and strong isolation, but starting or resuming one takes seconds to minutes. Containers are fast and light, but they share the host kernel, so they can't give a coding agent enough isolation. Tearing everything down each turn loses working state, and keeping a dedicated VM running for every waiting agent wastes resources. 📌 The turning point was two observations: agents mostly wait, and the sandbox should hold no secrets. Google measured that agents spend most of their time waiting on the model or the user. So Agent Compute Engine (ACE) checkpoints a session with its state intact once a tool call finishes, using near-zero active resources while idle. Meanwhile, the base OS and browser are shared in physical memory through DAX and CoW. The security stance is to assume everything inside the sandbox is controlled by an attacker. The guest has no secrets and no standard network card, and outbound traffic is checked by Agent Gateway, which swaps in credentials on the wire. Even with root compromised, there is nothing to steal. Preview is targeted for "the coming months," and the post gives no startup times or pricing. Details are in Inside Agent Compute Engine: Building the compute foundation for the agentic era. #AIAgents# #GoogleCloud#