The software industry faces periodic architectural shifts, with warehouse-scale computing and containers emerging after the web scale boom, and TPUs developed due to deep learning demands. Google also introduced Titanium for hardware-rooted security guarantees. A new fundamental shift is the rise of agentic AI, where AI agents take action beyond just answering questions. These agents are increasingly writing code, running tools, and orchestrating workflows, rapidly consuming compute and storage resources. Traditional compute primitives are insufficient for running millions of these agents cost-effectively and with low latency. This necessitates a new form factor, leading to the development of Agent Compute Engine, a Google Cloud service providing hardware-isolated microVMs for AI agents.Agent Compute Engine aims to bridge the gap between the isolation of virtual machines and the speed and density of containers. Existing VMs are too slow to start and stop for frequently pausing and resuming agents. Containers, while fast, lack the required isolation and kernel-level control for certain agent tasks. The system needs to efficiently manage agents, understanding when they are active or idle to avoid resource waste and preserve working state. Agent Compute Engine is designed as a unified platform offering a microVM abstraction for persistent, hardware-isolated computing.This new architecture supports diverse workloads, including interactive agent interfaces, autonomous software engineering, large-scale evaluations, and lightweight sandboxes for Google services. Security is paramount, with a defense-in-depth approach anchored in hardware-rooted trust via Titan silicon and Titanium IPUs. Host integrity is maintained through stateless, immutable appliances, and agentic sessions are isolated within single-tenant microVMs. A zero-secrets architecture prevents sensitive credentials from residing within the sandbox, ensuring security even if the guest OS is compromised.Networking is restricted, with all traffic flowing through a mediated proxy that enforces policy-driven outbound brokering. End-to-end encryption is implemented for both data in transit and at rest. Automated patching, runtime detection, and continuous security measures are in place, alongside strict separation between the agent harness and sandbox. The system operates under the assumption that the sandbox is controlled by an attacker, thus holding no credentials and having no direct network access. Governance is handled through first-class agent identities, managed via a registry and an authentication manager that acts as a vault and broker for agents.