Google’s Agent Sandbox Holds One Certificate and Nothing Else

Google’s new agent runtime gives every agent its own microVM and almost nothing else.

• No network card, no default gateway, no route to the instance metadata server, and no stored token inside the sandbox.
• Each sandbox holds one short lived session certificate. Agent Gateway swaps in the real user credential only after it validates that certificate and the egress policy.
• Idle agents get checkpointed and resumed from a snapshot, which Google measures at under 500 milliseconds and puts at ten times the density of a standard container runtime.
• The published benchmark ran 200,000 agents at 500 suspend and resume activations per second. Nobody outside the company has reproduced that figure.

The service opens as a preview on Google Cloud. The open source runtime on GKE is the portable option, and the harness that calls the model still sits outside the sandbox, so its audit trail stays yours to get right.

Read the full analysis, Google Built an Agent Sandbox With Nothing Inside Worth Stealing.