Google Cloud Blog - TheNote.app

Google Cloud Blog
Follow

cloud.google.com/blog is the official blog of Google Cloud. It provides news, updates, and insights on Google Cloud's products and services, as well as trends and innovations in the cloud computing industry. The blog features articles written by Google Cloud experts, engineers, and thought leaders, covering a wide range of topics such as artificial intelligence, machine learning, data analytics, security, and more. The articles often include technical tutorials, case studies, and best practices, making the blog a valuable resource for developers, IT professionals, and business leaders who use or are interested in Google Cloud. The blog is well-organized, with articles categorized by topic, product, and industry. Visitors can browse the latest articles, search for specific topics, or subscribe to the blog's RSS feed to stay up-to-date with the latest news and updates. Some of the key features of the blog include: - In-depth articles on Google Cloud products and services, such as Google Cloud Platform, Google Cloud Storage, and Google Cloud AI Platform - Technical tutorials and guides on how to use Google Cloud services - Case studies and success stories from Google Cloud customers - Insights and analysis on industry trends and innovations - News and updates on Google Cloud's partnerships and collaborations - Interviews with Google Cloud experts and thought leaders Overall, the Google Cloud blog is a valuable resource for anyone interested in cloud computing, artificial intelligence, and related technologies.

Cloud Blog cloud.google.com

RSS cloudblog.withgoogle.com

RSS Hunter • Aug 19, 2024

Thread Of Notes

Cloud Pathways, a distributed ML runtime for massive accelerator fleets, now GA

Cloud Pathways is now generally available on GKE as a core component of the Google Cloud AI Hypercomputer. It was initially developed by Google DeepMind to train frontier models like Gemini. Pathways is a distributed machine-learning runtime designed for large, diverse accelerator fleets. Over 130 million Cloud TPU chip-hours have been processed using Pathways on GKE in the last 90 days. Every Google Cloud customer can now leverage its single-controller runtime, colocated Python sidecars, and elastic fault tolerance. A preview integration with Cluster Director extends Cloud Pathways to Slurm clusters for unified JAX execution and interactive notebooks. Cloud Pathways solves the complexity of traditional multi-controller setups for scaling AI workloads across thousands of accelerators. It replaces multi-controller management with a unified single-controller architecture built on the open-source Interim Framework Runtime. This allows a single JAX client process to orchestrate multiple large TPU slices as if locally connected. Key features include single-controller orchestration, colocated Python sidecars for compute-intensive logic, and resilient and elastic training. It also offers an interactive mode and Shared Pathways Service for flexible multi-user access. Leading AI labs and enterprises, such as a major consumer technology company and ZenteiQ, are already using Cloud Pathways for mission-critical production workloads. Cloud Pathways is available today in all Google Cloud regions supporting Cloud TPU v5e, v5p, Trillium, and Ironwood on GKE.

https://cloud.google.com/blog/topics/ai-infrastructure/cloud-pathways-a-distributed-ml-runtime-is-ga/ cloud.google.com

RSS Hunter • Nov 9

Introducing Z4M: storage-optimized compute for AI/ML and parallel file systems

Google Compute Engine has launched its next-generation Storage-optimized Z4M machine series. These instances are available as both virtual machines and bare-metal options. Z4M is designed for demanding AI/ML training and inference workloads that process massive datasets. It offers significant Local SSD storage, up to 168,000 GiB, and high-speed 400 Gbps Cloud RDMA networking. This configuration minimizes data access latency, crucial for keeping GPUs and TPUs fully utilized. Z4M VMs provide scalable LSSD capacity per vCPU, while bare-metal instances offer direct hardware access for specialized needs. Powered by Intel Xeon Scalable processors and enhanced Titanium SSDs, Z4M delivers impressive IOPS and throughput improvements over previous generations. The platform supports NVIDIA GPUDirect Storage and TPUDirect Storage for efficient data transfer. Cluster Director facilitates easy deployment and management of Z4M clusters. Z4M instances also integrate with Google Cloud's Hyperdisk for flexible network-attached storage options. These new instances are available now in select regions worldwide.

https://cloud.google.com/blog/products/compute/storage-optimized-z4m-machine-series-are-ga/ cloud.google.com

RSS Hunter • Nov 6

The Blueprint: Orchestrating 5,000+ AI assets for a World Cup TV spot

Mito aims to democratize AI-powered video creation, making advanced technologies accessible to everyone. Their journey revealed significant infrastructure and workflow challenges in producing long-form narrative content with generative AI. These challenges included managing massive local media libraries, the absence of real-time collaboration, and lengthy rendering latency. Inconsistency across generative models and capacity constraints with public APIs further complicated their efforts. To overcome these issues, Mito designed a serverless, asynchronous architecture on Google Cloud. They utilized Cloud Run for their API and background workers, enabling scalable processing. Google Cloud Pub/Sub served as their central event bus for decoupling job execution. Media assets are stored in Google Cloud Storage and delivered via Cloud CDN to minimize latency. An isolated database architecture with Cloud SQL and PostgreSQL supports analytics without impacting production. They leverage foundational models through Vertex AI, alongside custom system prompts. Their frontend enforces a "Rule of 6" to optimize prompt variables and prioritizes still-frame generation for cost efficiency. This solution successfully enabled a landmark national broadcast campaign for Movistar Plus+, described as 95% AI-generated. The campaign aired on every major Spanish television channel, showcasing AI Director's conversational capabilities and real-time collaboration. Mito's architecture is future-proof, poised for increasingly rapid rendering times and advanced AI capabilities. They built an automated evaluation harness powered by Gemini to validate creative outputs. Their AI Director dynamically routes tasks across multiple specialized models for intelligent coordination. Mito also embraced an "imperfect aesthetic" to enhance authentic storytelling, incorporating surreal visual elements.

AI and ML News on Bluesky @ai-news.at.thenote.app bsky.app

RSS Hunter • Nov 6

Zero-shot predictions in Pandas using the new BigQuery Accessor

BigQuery DataFrames (BigFrames) introduces a new .bigquery accessor, allowing users to run advanced machine learning directly within familiar pandas DataFrames. This integration enables seamless invocation of BigQuery's enterprise-grade AI functions on cloud infrastructure. For tasks like linear regression, users can now leverage ai.predict() directly on BigQuery data, bypassing local training. The .bigquery accessor translates pandas operations into Google Standard SQL, executing models natively on BigQuery. Environment setup requires specific Google Cloud roles and installation of pandas and bigframes. AI functions are available for both pandas Series and DataFrames. For Series, ai.embed() computes text embeddings and ai.similarity() calculates cosine similarity scores. DataFrame functions handle multi-column operations, such as ai.forecast() for time-series forecasting and ai.if_() for natural-language row filtering. These functions abstract away the complexity of cloud infrastructure and model execution. The goal is to empower data scientists to perform sophisticated AI tasks without leaving the Python ecosystem. Supported functions include embedding generation, classification, forecasting, and predictive modeling. BigQuery AI functions within pandas simplify scaling machine learning workflows.

https://cloud.google.com/blog/products/data-analytics/bigquery-ai-functions-in-pandas/ cloud.google.com

RSS Hunter • Nov 6

Bringing conversational analytics to Gemini with Agentic Data Cloud connectors

Gemini for business now offers Data Cloud connectors in preview, empowering users to query live enterprise data using natural language. These connectors address the challenge of data request backlogs by providing direct access to governed data. They integrate with Knowledge Catalog to locate relevant data, interpret natural language queries, and execute permission-scoped queries under the user's identity. Users can query data from BigQuery, operational databases like Spanner, AlloyDB, and Cloud SQL, and Looker. Findings can be directly moved into tools like Google Docs, Gmail, and Google Slides. Gemini leverages semantic discovery and context mapping, using technical metadata and business glossaries to translate everyday terms into database structures. Permission-aware execution ensures that row- and column-level access controls are respected. Data Cloud connectors can query data across BigQuery and AWS S3, unifying environments into a single conversational interface. These connectors offer a federated query mode, accessing data in place without copying it. Compared to custom solutions, Data Cloud connectors provide built-in skills for higher response quality and guided setup with managed authentication. This feature aims to democratize data access and accelerate insights for business users and analysts.

https://cloud.google.com/blog/products/data-analytics/query-enterprise-data-in-gemini-with-data-cloud-connectors/ cloud.google.com

RSS Hunter • Nov 5

Building an agent skill optimizer with AlphaEvolve, Harbor and Gemini 4 Argon

Coding agents are increasingly used for software engineering tasks but require effective instructions. Manually written agent skills are difficult to refine as their effectiveness is hard to assess. Initial tests with OpenCode and Gemini 3.8 Flash on Terminal-Bench 2.0 showed inconclusive results with a baseline skill. To improve performance, AlphaEvolve was employed to optimize skills by iteratively proposing new versions, scoring them with an evaluator, and retaining the best. Harbor was used as the evaluator, running agents on real tasks in isolated containers. This process treats agent skills like programs that AlphaEvolve can rewrite. The evaluator in Harbor compares candidate skills against a baseline skill simultaneously on the same tasks to ensure trustworthy scoring. A portion of tasks is reserved to test the final optimized skill on unseen data. AlphaEvolve focused on addressing the most common failure: running out of time. The system achieved a 5% improvement in a few iterations and a significant 33-point increase on specific development tasks. Challenges encountered included planning for slow model responses and log storage during long searches. Future work involves testing AlphaEvolve on enterprise agent harnesses to incorporate business rules.

https://cloud.google.com/blog/topics/developers-practitioners/how-to-build-an-agent-skill-optimizer-with-alphaevolve-and-harbor/ cloud.google.com

RSS Hunter • Nov 5

Semantic aggregation over millions of rows in BigQuery with AI.AGG

BigQuery's new AI.AGG feature, currently in preview, revolutionizes unstructured data analysis by enabling multi-level semantic aggregation directly within GoogleSQL. This addresses the critical gap where traditional relational SQL engines struggled with synthesizing insights from massive text and multimodal datasets due to large language model (LLM) context window limitations. AI.AGG conceptualizes semantic aggregation as a distributed map-reduce problem, allowing data teams to run natural-language instructions over millions of rows with a single SQL query. The underlying multi-level batching architecture automatically handles row validation, context-safe batching, parallel inference via Vertex AI, and recursive synthesis using full-weight LLMs until a single, aggregated string is produced. It natively supports both text and multimodal inputs, leveraging BigQuery Object Tables for image analysis without data movement. AI.AGG is designed for transformative enterprise use cases, such as diagnostic analysis of high-volume system logs and building "agentic data clouds" for autonomous data labeling pipelines. Prompt engineering for AI.AGG requires explicit output contracts, contextual delimiters, failure state design, and few-shot anchoring to ensure programmatic SQL outputs. Cost management involves pre-filtering with WHERE and LIMIT clauses and utilizing Gemini Context Caching, with AI.COUNT_TOKENS for estimation. The feature operates within BigQuery's governance framework, supporting VPC Service Controls and gracefully degrading on transient errors. Preview guardrails include a 10,000-token output cap per group, 10 MiB row limit, and recommendations for processing up to 20 million rows and 1,000 distinct SQL groups. AI.AGG transforms the enterprise data warehouse into an active, semantic runtime, democratizing access to petabyte-scale semantic analysis.

https://cloud.google.com/blog/products/data-analytics/semantic-data-aggregation-with-bigquery-and-ai-agg/ cloud.google.com

RSS Hunter • Nov 5

Gemini Omni 1.2 Flash: Fast, cost-effective, and reliable video generation and editing now generally available

Gemini Omni 1.2 Flash is now generally available on Google Cloud, designed for efficiently creating business videos like product videos and ads. This model is fast, cost-effective, and maintains stronger adherence to image, video, and audio references. Key updates include a 30% lower price for 720p video, longer clips up to 15 seconds, and more consistent results across shots. It also offers faster drafts in higher resolutions, more natural speech with improved lip-sync, and the ability to edit clips conversationally without starting over. Gemini Omni 1.2 Flash is production-ready, backed by Google Cloud's infrastructure, and includes SynthID watermarking for outputs. Various creative and design platforms like Artlist, FLORA, and Picsart are integrating the model to enhance their users' video creation capabilities. Retailers and marketplaces are leveraging it for product spins, lifestyle clips, and video ads at scale. The model will soon be available in Gemini for business and Google Vids, and developers can access it via API.

https://cloud.google.com/blog/products/ai-machine-learning/gemini-omni-1-2-flash-generally-available/ cloud.google.com

RSS Hunter • Nov 5

Powering open infrastructure for autonomous agents

AI is evolving from human-scale systems to agent-scale operations, transforming into active systems rather than mere records. This shift demands a new foundation for handling complex agentic workflows. To address this, three open-source projects, Agent Substrate, gVisor, and OpenRL, have been donated to the Cloud Native Computing Foundation (CNCF). Agent Substrate, now at version 1.0 and available on GKE, scales isolated agent environments efficiently. It decouples stateful agent sessions from active compute, snapshotting idle agents to storage for rapid restoration. This significantly increases container density by reducing idle compute overhead. GVisor provides essential isolation for untrusted agent code by running a lightweight userspace kernel. This prevents direct interaction with the host Linux kernel, enhancing security. OpenRL simplifies the distribution of post-training and serving for reinforcement learning agents. It enables self-hosted RL post-training loops directly on Kubernetes using plain Python. These projects collectively offer an open stack compatible with any Kubernetes cluster across various clouds and hardware accelerators. Agent Substrate allows millions of sandboxes to run with 10x standard container density. GVisor ensures that untrusted code never compromises the host system's kernel. OpenRL orchestrates efficient reinforcement learning workflows, leveraging Kubernetes for distributed training. The donation to CNCF aims to foster collaborative development and accelerate the adoption of these crucial AI infrastructure components.

https://cloud.google.com/blog/products/containers-kubernetes/open-infrastructure-for-autonomous-agents-comes-to-cncf/ cloud.google.com

RSS Hunter • Nov 5

Highlights and reflections from Google Public Sector Summit: Where mission meets moonshot

The Google Public Sector Summit brought together over 2,700 leaders to discuss leveraging agentic technology for public sector missions. The event's theme, "Where mission meets moonshot," highlighted the transformation of services and boosting productivity. Keynote speakers emphasized bold leadership and scaling for impact in the agentic era. Google announced innovations like Gemini for government services and Wiz Red, Green, and Blue agents.Live demonstrations showcased how government entities are applying Google's technology to achieve their goals. Dedicated programming focused on infrastructure, safe implementation of agentic capabilities, and proactive defense. Breakout sessions and lightning talks explored various topics, demonstrating how agents are impacting scientific research, healthcare, and national security. The summit also included specialized programming for national security and defense leaders, emphasizing partner collaboration.The Mission Exchange offered interactive experiences, including an emergency response simulation and demos of full-stack innovations. Attendees participated in hands-on labs to build mission-ready agents using Google Cloud. A closing session encouraged visionary leaders to consider their own "moonshots" and embrace courageous problem-solving. The event concluded by stressing the importance of bold leadership, ambition, and partnership to navigate the agentic era. Resources were provided to help attendees continue their journey, emphasizing that the future depends on how we choose to build with technology.

https://cloud.google.com/blog/topics/public-sector/highlights-and-reflections-from-google-public-sector-summit-where-mission-meets-moonshot/ cloud.google.com

RSS Hunter • Nov 4

Helping you build and defend at machine-speed in the agentic era

Google recognizes the evolving cybersecurity landscape with the rise of autonomous systems. They are actively developing solutions to secure Large Language Models (LLMs) and defend against sophisticated cyber threats. This involves building security directly into the development lifecycle with real-time guardrails and unifed asset graphs. Google has introduced CodeMender, an autonomous code-security agent that finds and fixes vulnerabilities at machine speed. CodeMender utilizes advanced models like Gemini 4 Argon to identify unknown vulnerabilities and generate tested patches. This tool offers secure isolation and flexible scanning modes to enhance efficiency and reduce risks. Google Cloud is also implementing foundational security and governance controls for autonomous workloads across various platforms. New features like Auth Manager, identity-based VPC Service Controls, and Model Armor enhance agent identity, network perimeters, and topic adherence. To combat threats operating at machine speed, Google is empowering defenders with agentic, intelligence-driven operations. This includes continuous monitoring, automated threat hunts, and autonomous alert analysis. Google is collaborating with Wiz to provide end-to-end defense, integrating their platforms for comprehensive security. Joint initiatives like Scan for Good offer advanced autonomous technology to under-resourced organizations. Google is committed to disrupting adversaries at the source and enhancing defensive architectures. By embracing secure-by-design pipelines and machine-speed operations, enterprises can better defend themselves in the agentic era.

https://cloud.google.com/blog/products/identity-security/helping-you-build-and-defend-at-machine-speed-in-the-agentic-era/ cloud.google.com

RSS Hunter • Nov 4

Introducing Compute Engine API multi-versioning: Predictable evolution without breaking production

Compute Engine now offers API multi-versioning for modernizing infrastructure without risking production stability. This feature introduces date-based API versions alongside the existing stable /v1 API. The long-standing /v1 API guarantees backward compatibility for millions of virtual machines and other cloud resources. However, evolving cloud needs demand newer API semantics, better resilience, and improved developer experiences. This new versioning model allows adoption of these improvements on a customer's schedule without impacting existing automation. Immutable, date-based snapshots include stable versions released quarterly and preview versions for early access. The original /v1 API remains fully supported and operational. Benefits include customer-controlled upgrades, pinning to known contracts, and on-demand upgrades. New versions also offer safer defaults like resilient global queries, actionable machine-readable errors, and cleaner API designs. This multi-versioning seamlessly integrates with client libraries, gcloud, and Terraform.

https://cloud.google.com/blog/topics/developers-practitioners/introducing-compute-engine-api-multi-versioning-predictable-evolution-without-breaking-production/ cloud.google.com

RSS Hunter • Nov 4

New capabilities to power agents at scale with Google's Agentic Data Cloud

Organizations are increasingly leveraging agent-driven automation to enhance revenue, efficiency, and risk management. Google’s Agentic Data Cloud is a System of Action designed to unify enterprise data, ensure accuracy, and operate proactively at low cost. The borderless Lakehouse activates distributed data across multi-cloud, on-premises, and SaaS platforms using open Apache Iceberg format. New enhancements allow Gemini to query the Lakehouse with natural language, and cross-cloud interconnect provides secure, zero-egress fee data access. AlloyDB integration enables agents to query Iceberg tables directly, joining historical and real-time data efficiently. Spanner Omni extends Google-grade consistency and scale for hybrid agentic applications. Knowledge Catalog, Google Cloud’s universal context engine, grounds agents in enterprise context, improving accuracy, reducing latency, and lowering token costs. Self-learning enrichment and reusable OKF context sets automate context curation from unstructured sources like Google Workspace and SharePoint. A new studio experience in Knowledge Catalog offers a conversational UI for exploring and governing context. Knowledge Catalog is now default in Gemini, grounding data questions in governed business context and supporting trusted semantic models from various platforms. Google is transforming practitioner experiences, enabling data and ML engineers to orchestrate agents for intent-driven outcomes with Gemini’s machine learning skills. Business users can generate real-time operational reports by simply asking. The Data Agent Kit integrates Google Data Cloud tools into developers' preferred IDEs and CLIs. Google is also engineering data infrastructure for agent scale, introducing AlloyDB Express for rapid prototyping and PostgreSQL for agents in AlloyDB for production. Managed Service for Apache Spark extends price-performance, and BigQuery is enhanced with faster queries, BigQuery Graph for petabyte-scale graph analytics, and new Google Research models like TimesFM 3.0 and TabFM.

https://cloud.google.com/blog/products/databases/whats-new-across-googles-agentic-data-cloud/ cloud.google.com

RSS Hunter • Nov 4

AlloyDB Express: Instant, scale-to-zero PostgreSQL for developers and coding agents

Databases currently struggle to keep pace with rapid, AI-driven software development, causing bottlenecks in provisioning, testing, and production transitions. AlloyDB Express, a new offering of AlloyDB for PostgreSQL, aims to resolve these challenges. It is designed for developers and AI coding agents, offering rapid database creation in under two seconds. The service automatically pauses when idle, reducing costs by implementing a scale-to-zero feature after 15 minutes of inactivity. This new offering bridges the gap between fast AI-driven development and robust enterprise infrastructure.AlloyDB Express provides an agent-ready database experience with built-in enterprise security and AI capabilities. It allows for one-click upgrades to production scale, preserving data and configurations. Security is paramount, with features like public DNS endpoints for masked IP addresses and private VPC networking for secure internal integrations. Granular access controls, including Google Cloud IAM and native PostgreSQL roles, enforce least privilege for users and agents.Crucially, AlloyDB Express integrates AI tools directly into the database, eliminating the need for external vector stores. Developers can utilize fast vector search through pgvector HNSW and Google’s ScaNN index for semantic search and recommendation engines. The service also offers direct access to Gemini models within SQL queries for tasks like text and image embedding generation, filtering, and summarization. Natural language-to-SQL generation further simplifies query creation for developers and AI agents.AlloyDB Express features simple, intuitive pricing that scales to zero when inactive, with data remaining safe. Active compute is billed at $0.115 per Compute Unit hour, with no charge for paused compute. Used storage costs $0.30 per GB-month, and a free tier provides 50 free CUs monthly. This cost-effective solution accelerates application building and seamlessly scales to production. AlloyDB Express is currently available in preview, inviting users to explore its capabilities for enhanced development efficiency.

https://cloud.google.com/blog/products/databases/introducing-alloydb-express-for-rapid-testing-and-prototyping/ cloud.google.com

RSS Hunter • Nov 4

Unify operational and Lakehouse data with direct Iceberg access in AlloyDB for PostgreSQL

Businesses need both real-time operational data and historical analytical data for effective decision-making. Traditionally separate, these data systems are now converging, exemplified by new features in AlloyDB for PostgreSQL. Google Cloud is introducing direct Iceberg access, allowing developers to query Apache Iceberg tables in cloud storage directly from AlloyDB, joining them with live data in a single SQL query. This integration, now in preview, is significantly faster for aggregation queries compared to other services.Additionally, AlloyDB sync and Lakehouse federation are now generally available, providing three primary ways to interact with a "borderless Lakehouse." Direct Iceberg access reads Iceberg tables in place, leveraging AlloyDB's columnar engine for acceleration. AlloyDB sync copies lakehouse data from BigQuery into AlloyDB for low-latency, frequently accessed workloads, refreshed on a user-defined schedule. Lakehouse federation enables AlloyDB to query native BigQuery tables directly, with BigQuery handling the processing. These integrations eliminate the need for custom pipelines, allowing applications and AI agents to act on combined operational and lakehouse data seamlessly.Real-world examples include fraud detection, personalization, and dynamic pricing, where historical context from the lakehouse informs real-time decisions in the database. Data teams can also publish curated tables once to Iceberg, allowing multiple applications to read them in place. Direct Iceberg access allows registration and querying of Iceberg tables like any other PostgreSQL table, benefiting from built-in support and the columnar engine. AlloyDB sync addresses the need for extremely low-latency reads of data that doesn't change constantly, by creating a local, refreshable copy in AlloyDB. Lakehouse federation caters to organizations with extensive historical data in BigQuery, pushing down processing to BigQuery and returning only the results. The choice of integration depends on data location, application read patterns, and latency requirements.

https://cloud.google.com/blog/products/databases/direct-iceberg-access-in-alloydb/ cloud.google.com

RSS Hunter • Nov 4

Chrome Enterprise Premium drives 50%+ projected cost reduction for Mercari

Mercari, a consumer-to-consumer marketplace with millions of users, needed to secure its customer service environment, which handles sensitive PII. Their previous VDI setup was inefficient, costly, and complex, requiring overlapping DLP controls. Mercari transitioned to Chrome Enterprise Premium and Chromebooks to focus on browser-layer data control. This new architecture allowed for strict DLP rules, preventing data leakage to unauthorized destinations and AI tools. The transition was smooth due to existing Chrome browser familiarity among employees. This move not only enhanced security but also streamlined IT operations and significantly reduced costs. Mercari projects over 50% cost reduction in three years by minimizing VDI dependency and consolidating security agents. The browser-centric model freed up IT resources for higher-priority initiatives, reinforcing a zero-trust, device-based security approach. Mercari is now positioned as an AI-forward organization, enabling safe, controlled AI adoption. They are initially using browser policies to allow read-only access to Gemini in Chrome, improving productivity while reducing data modification risks. Mercari plans to continuously balance AI productivity and security by utilizing Chrome Enterprise Premium’s evolving features.

https://cloud.google.com/blog/products/chrome-enterprise/chrome-enterprise-premium-drives-50-projected-cost-reduction-for-mercari/ cloud.google.com

RSS Hunter • Nov 4

How Nammu21 automates syndicated loans on Google Cloud Universal Ledger

The syndicated loan and private credit markets face challenges like slow settlements and valuation opacity due to manual processes. Fintech innovator Nammu21 partnered with Google Cloud to address these issues through a new proof-of-concept. This solution uses Nammu21's AI platform to structure legal agreements into smart contracts on the Google Cloud Universal Ledger (GCUL), automating the entire loan lifecycle. Current loan markets suffer from fragmented, manual interpretation of legal text, leading to long settlement times, which in turn ties up capital and increases risk. Nammu21 digitizes bespoke credit documents into Digital Credit Instruments (DCIs), mapping all terms to their originating legal provisions and expressing them as executable behaviors. GCUL provides a secure, high-performance distributed ledger environment for instantiating these instruments, offering near-instant transaction finality and predictable costs. Programmable contracts on GCUL are written in gculpy, a safe, readable, and auditable domain-optimized programming language. The platform streamlines development for financial institutions by simplifying complex memory management. Nammu21 plays a dual role: it programmatically renders DCIs from legal agreements and derives gculpy contracts to govern loans on GCUL. This architecture creates a single, immutable source of truth, as demonstrated by a modeled Term Loan B transaction. The system ensures compliance through gated execution, maintains role-based privacy for sensitive data, and provides settlement finality. This structural shift fundamentally changes lending markets, reducing settlement times, back-office overhead, and counterparty risk.

https://cloud.google.com/blog/topics/financial-services/how-nammu21-automates-syndicated-loans-on-google-cloud-universal-ledger/ cloud.google.com

RSS Hunter • Nov 3

Leading in the agentic era: How to put people first as you adopt AI agents

Google Cloud Consulting assists companies in integrating AI into daily operations, observing a shift from generative AI to agentic systems that autonomously complete tasks. While technical resources are important, successful enterprise adoption of AI agents requires intentional cultural change. Employees must feel empowered to experiment, and leaders should clarify AI's impact on roles. The team offers five practical lessons for guiding this agentic shift. First, redesign workflows to be agent-executed and human-directed, moving from human-in-the-loop validation to a human-in-the-lead model. This involves agents handling parallel dependencies and routing only ambiguous scenarios to humans. Second, address employee hesitation by fostering ownership, treating agents like junior team members requiring active delegation and clear responsibilities. Third, effectively manage hybrid teams of people and agents by focusing on results, reinforcing desired behaviors, and coaching teams to leverage agents for creative work. Fourth, build agentic literacy through experimentation, providing safe learning zones and celebrating "intelligent failures" to deepen understanding. Finally, govern agents with a hub-and-spoke model, establishing central guidelines while allowing individual teams to adapt tools and experiment. This people-first approach aims to create an organization where human ingenuity and agents mutually amplify each other.

https://cloud.google.com/blog/topics/consulting/lessons-for-adopting-ai-agents/ cloud.google.com

RSS Hunter • Nov 3

Introducing Physical-Engineering’s Last Exam for agents

The Google AI & Infrastructure team, in collaboration with Mercor, has launched Physical-Engineering's Last Exam (PLE), a new benchmark and open competition. PLE assesses a frontier model's ability to complete mechanical, electrical, civil, and structural engineering tasks. This initiative addresses a gap in existing benchmarks, which primarily focus on textbook questions or isolated design problems. Unlike previous exams like Humanity's Last Exam or Agents' Last Exam, PLE specifically measures AI's capability for physical world-building tasks.PLE comprises 85 long-horizon tasks, mirroring real-world engineering projects with an average of 61 files per task. These files include various engineering documents, requiring agents to reason through codes, limits, and calculations to produce production-ready deliverables. The tasks were developed through collaboration with practicing engineers, either authored by experts or co-authored with agent pipelines.Initial testing on 14 frontier models using seven agent harnesses revealed that all models scored below 50% on the private test set. The highest-performing model achieved a mean score of 48.3%. A significant finding was that only 41.3% of top-scoring agent deliverables passed all hard safety and feasibility checks, despite satisfying 91% of individual constraints on co-authored tasks.The choice of model significantly impacts performance, with up to a 50-point spread, while harnesses have a smaller effect (median 3-point spread) but affect run cost. This benchmark offers a practical step toward developing AI tools that can support physical engineers. Researchers can access 29 public tasks, grading tools, and join the open competition at ple-bench.com. Google is sponsoring 13 models for free evaluation on its servers, with prize details to be announced soon.

https://cloud.google.com/blog/products/ai-machine-learning/introducing-physical-engineerings-last-exam-for-agents/ cloud.google.com

RSS Hunter • Nov 3

Five rules for evaluating agent skills before they bloat your context window

Testing SKILL.md files effectively requires more than a simple pass/fail on a laptop. Over-triggering or sibling hijacking can prevent agents from loading skills, especially in complex workspaces. Tools like skill-reach and SkillSpector help identify frontmatter collisions and security risks early. It's crucial to avoid running skill benchmarks on developer laptops due to ambient state that contaminates baseline results. Paired ablation testing (WITH vs. WITHOUT), across multiple repetitions, provides a more accurate measure of skill improvement and efficiency gains. This approach reveals if a skill genuinely helps or if the base model already possesses the capability. When automating optimization, ensure evaluation harnesses are hardened against reward-hacking by separating correctness, efficiency, and security metrics, and isolating grading components. Finally, effective SKILL.md files encode operational habits and verification reflexes rather than simply dumping extensive documentation. Frontier models often have public documentation in their pre-training, making compact, actionable constraints more valuable. Regularly re-evaluating skills with new models and deleting those with zero delta ensures an efficient and current skill set.

https://cloud.google.com/blog/topics/developers-practitioners/evaluate-agent-skills-before-they-bloat-your-context-window/ cloud.google.com

RSS Hunter • Nov 3

Google Cloud Developer plugin now available in Antigravity Marketplace

Autonomous AI agents building cloud solutions need speed, safety, and reliability, but often lack cloud-specific context. This can lead to incorrect syntax, invalid commands, and unauthorized resource provisioning. To address these issues, the google-cloud-developer plugin is now available in the Antigravity Marketplace. This plugin provides foundational skills, safety guardrails, and live documentation grounding for Google Cloud development. Configuration is simplified as the bundled Developer Knowledge Model Context Protocol server is pre-authorized. The plugin solves the problem of outdated training data by providing live documentation grounding. It also enforces safety and cost guardrails, ensuring least-privilege IAM patterns and requiring consent for billable API enablement. Additionally, the agent exhibits environment awareness, inspecting local configurations before executing commands. The plugin includes core baseline skills like finding Google skills, retrieving developer knowledge, and managing gcloud commands securely. It also ensures secure authentication through its google-cloud-recipe-auth skill. Installation is a one-click process through the Antigravity Marketplace UI or a single command-line instruction. Once installed, agents automatically ground their answers in current Google Cloud documentation, providing accurate and verified information.

https://cloud.google.com/blog/topics/developers-practitioners/google-cloud-developer-plugin-now-available-in-antigravity-marketplace/ cloud.google.com

RSS Hunter • Nov 2

Beyond Migration: Using Database Migration Service for disk shrinking

Database migration typically involves moving databases from on-premises to cloud or between cloud providers. Google Cloud's Database Migration Service (DMS) supports Cloud SQL for SQL Server as a source, enabling continuous, low-downtime replication between Cloud SQL instances. This allows for operational patterns like storage management, specifically disk shrinking, with minimal application downtime. Disk shrinking is necessary because database storage often only increases, and while data deletion frees space within database files, the underlying disk retains peak allocated capacity.Features like Cloud SQL automatic storage increase prevent outages, but manual shrinking is needed to reclaim unused space. Shrinking the physical disk reduces ongoing storage costs, especially after major data archiving, recovery from storage spikes, or post-refactoring. Cloud SQL provides a built-in storage shrink feature, but it requires downtime proportional to the disk size, which can be hours for multi-terabyte drives.DMS offers a minimal-downtime alternative by continuously replicating databases to a newly provisioned Cloud SQL instance with a smaller disk. This approach keeps the cutover window short. DMS replicates data by taking an initial full backup and then continuously applying transaction log backups, similar to native SQL Server log shipping.This synchronization happens at the user database level, so server-level objects like logins, linked servers, and SQL Server Agent jobs are not automatically replicated and must be manually migrated. The DMS disk shrink workflow involves provisioning a new target instance with a smaller disk, starting a continuous DMS job, allowing replication to catch up, and then performing a brief cutover.Pre-cutover preparation is crucial, including scripting and recreating server-level objects like logins, SQL Server Agent jobs, linked servers, extended events, and instance configurations on the target. For TDE-enabled instances, the TDE certificate must be exported and imported. Post-cutover, orphaned database users must be resolved because logins created on the destination will have new Security Identifiers (SIDs) that don't match the source SIDs in the migrated databases.These orphaned users need to be detected and re-mapped using ALTER USER statements. DMS is a versatile tool for day-two operations, allowing engineers to right-size storage and reduce infrastructure costs with minimal downtime when strict production SLAs prevent lengthy maintenance windows.

https://cloud.google.com/blog/products/databases/use-dms-to-shrink-cloud-sql-for-sql-server-disk/ cloud.google.com

RSS Hunter • Nov 2

The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources

Mandiant responded to multiple incidents in 2026 involving "LLMJacking," where threat actors hijacked enterprise access to Large Language Models (LLMs). These intrusions, impacting organizations globally across various sectors, resulted in significant fraudulent cloud charges, sometimes exceeding $100,000 USD daily. Google Threat Intelligence Group (GTIG) identified diverse financially motivated threat clusters behind these compromises, noting a division of labor between initial access providers and "LLM Mixers" who monetize stolen access. The attack lifecycle involves initial access through publicly exposed LLM endpoints or stolen cloud identity tokens, such as IAM credentials and GitHub PATs. Threat actors also target LLM API keys directly, validating them stealthily to avoid detection. Later, threat actors escalate privileges, solidify access, and perform internal reconnaissance, enumerating cloud services and repositories for sensitive credentials. They abuse cloud identity permissions and VM configurations, creating unauthorized accounts and injecting SSH keys for persistence. Some actors exploit vulnerabilities in LLM routing software to gain administrative control. The ultimate goal is LLM monetization through token proxying, automated model streaming, and GPU provisioning, accumulating substantial fraudulent charges. Threat actors host their own proxy endpoints and agentic workloads, deploying containerized backdoors and provisioning powerful GPUs. They also monetize compromised API quotas by selling access through LLM Mixers, using open-source gateways to pool stolen credentials. One notable example, jet-night.com, leverages stolen API keys to offer below-market rates, passing substantial costs to victim organizations.

https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/ cloud.google.com

RSS Hunter • Nov 2

Shutting the Door on the XCPE Botnet

Google and partners dismantled the XCPE backdoor, a botnet of over 1.3 million set-top boxes. Videostrong Technology Co., an Android OEM/ODM, intentionally developed and operated it for financial gain. Videostrong monetized the backdoor by selling access to criminal affiliates, who loaded ad-fraud, residential proxy, and additional malware modules onto infected devices. Google has severed ties with Videostrong, banning them from making devices with preloaded Google apps. Videostrong exploited a gap in Google's compatibility tests using obfuscation techniques to load malicious code after device boot. Google implemented changes to its review process to prevent similar activity. This campaign was a serious breach of trust, enabling a wide array of criminal activities on user devices without consent. Google's disruption efforts included legal actions against C2 domains and server infrastructure used by Videostrong and its affiliates. The company also improved firmware integrity checks for certified Android TV devices. The XCPE botnet utilized a modular, three-stage architecture: a primary system-level backdoor (x.cpe), a loader and execution engine (com.abc.nexus), and various monetization modules. The botnet uses a two-stage C2 process involving HTTP requests for configuration and persistent MQTT connections for commands. This allowed for silent app installations, Google Play Protect disabling, arbitrary shell execution, screen captures, and network reconnaissance.

https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet/ cloud.google.com

RSS Hunter • Nov 2

Innovate on your own business terms: Google Cloud spend caps now generally available

Google Cloud Budgets now offers generally available spend caps to protect workloads from runaway costs without resource deletion. This release introduces programmability, real-time visibility, and automated guardrails. The new spend caps offer automation through a new API, allowing programmatic enforcement of financial boundaries. Real-time visibility is enhanced with live cost reports, which trigger within minutes for AI services, providing immediate context for breaches. Automated monthly resets eliminate the need for manual cap lifting, though a manual override option remains. Best practices include targeting non-production environments first with strict caps. Configuring alerts wisely by ensuring correct role assignments is crucial. It’s also important to understand that fixed costs like Provisioned Throughput are not halted by spend caps, only pay-as-you-go and CUD-covered requests. Spend caps integrate with Early Anomalies Detection for a comprehensive defense playbook. This dual-pronged approach offers predictive monitoring and financial enforcement. Early Anomalies focus on spotting cost spikes, while spend caps provide absolute protection. Users can start setting spend caps via the Google Cloud Billing Console and integrate programmatic guardrails using the new spend caps API documentation.

https://cloud.google.com/blog/topics/cost-management/google-cloud-spend-caps-now-generally-available/ cloud.google.com

RSS Hunter • Oct 30

When the Kubernetes API went silent: A three-layer networking mystery

A severe issue plagued Google Kubernetes Engine (GKE) clusters in europe-west, causing intermittent API server connection timeouts for pods. This problem, which emerged in January 2026, affected hundreds of developers and brought production deployments to a standstill. Initial investigations ruled out customer-side changes and common network issues like conntrack exhaustion. The complexity grew as the problem impacted multiple GKE clusters and even external client connections, pointing to a systemic issue.Packet captures revealed that synchronous packets from pods were reaching the control plane VMs, but instead of a SYN-ACK, an out-of-place ACK was being returned. This indicated a problem with TCP connection state management on the control plane nodes. Simultaneously, metrics for Private Service Connect showed a sharp increase in "Proxy protocol drop: invalid ACK packet" coinciding with a software version rollout. This USPS change, intended to fix a security vulnerability, was inadvertently dropping challenge ACKs.Challenge ACKs, defined by RFC 5961, are a security mechanism where a server sends an ACK to verify the legitimacy of a new connection attempt using a previously used port after an old connection has closed. The USPS change incorrectly classified these legitimate challenge ACKs as invalid, causing them to be dropped silently. This behavior was exacerbated in GKE clusters using Private Service Connect due to its NAT layer, which frequently caused port reuse and thus triggered challenge ACKs more often.A temporary mitigation involved rolling back the USPS change, which immediately resolved the "invalid ACK packet" drops and restored connectivity for the affected GKE clusters. However, this rollback was merely a band-aid, as it did not address the root cause of why the control plane VMs were holding onto connections in a FIN_WAIT_2 state for an unusually long time. This persistent long-held connection state was the underlying issue that created the conditions for the challenge ACK problem. The investigation then delved deeper to uncover the remaining bugs responsible for this prolonged connection state.

https://cloud.google.com/blog/products/networking/the-three-layer-gke-network-mystery/ cloud.google.com

RSS Hunter • Oct 30

ARTEX and Friends: Enter Agentic Offensive Frameworks

Recent intrusions highlight adversaries weaponizing agentic frameworks for highly automated attacks. Threat actors are increasingly abusing open-source pentesting frameworks like ARTEX, Hexstrike, and CAIRN. This signals a shift towards machine-speed intrusions, exponentially scaling attack complexity. The mechanics of attacks remain similar, but autonomous frameworks present new defensive challenges. Security teams must rethink defenses against scalable, autonomous software. Mandiant suggests long-standing best practices for defense, including control-plane isolation and least privilege. Adversaries are leveraging these LLM-powered frameworks to automate various stages of intrusions. ARTEX, an autonomous LLM-driven pentesting platform, abstracts the attack lifecycle with specialized sub-agents. It translates high-level goals into machine commands, enabling automated reconnaissance and privilege escalation. Diverse threat actors, including financially motivated groups and suspected state-sponsored actors, have adopted ARTEX. These frameworks demonstrate rapid execution, achieving deep system access in minutes. ARTEX exhibits forensically noisy, iterative trial-and-error approaches to exploit vulnerabilities and achieve objectives.

https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/ cloud.google.com

RSS Hunter • Oct 30

New Gemini courses for financial services and legal teams

Google Skills is offering new, free industry-specific video learning bundles focused on using Gemini and agents. Two bundles are specifically designed for financial services and the legal profession. These bite-sized courses aim to help professionals work smarter with agentic AI by demonstrating how to utilize Gemini for efficiency.For financial services, the courses offer practical applications like quickly analyzing large volumes of market data for client meetings. The financial services section includes four video courses covering advisor insights, portfolio resilience, bond issuance acceleration, and credit market opportunity discovery. In the legal field, Gemini can streamline compliance reviews and document drafting by flagging violations and suggesting remedies. The legal section provides five courses on regulatory scanning, DSAR responses, contract review, document redaction, and NDA drafting. For those ready for more advanced applications, the Gemini Agent Ready (GEAR) program offers industry-recognized skill badges and credits for interactive training. GEAR allows teams to build and test production-grade agentic AI systems in a risk-free environment.

https://cloud.google.com/blog/topics/training-certifications/new-gemini-courses-for-financial-services-and-legal-teams/ cloud.google.com

RSS Hunter • Oct 30

Grounding agents in one context graph connecting semantic models you already trust

AI agents often fail to answer business questions accurately due to a lack of understanding of business-specific definitions, a problem compounded by scattered semantic models. Knowledge Catalog addresses this by unifying semantic models from various tools into a single context graph. This allows AI agents to access consistent, validated definitions, improving accuracy significantly. The platform now supports native ingestion of semantic models from Looker, BigQuery, dbt, Snowflake, Databricks, and SAP. This integration ensures agents use the same business logic as human analysts, leading to more reliable answers.Grounding agents in Knowledge Catalog results in nearly 4X greater accuracy, up to 33% lower latency, and up to 75% fewer tokens used. The unified context graph reuses existing semantic models and enhances them with self-learned context from unstructured sources. It also pairs business logic with enterprise trust by linking definitions to data quality scores and freshness signals. The context graph maps the entire data estate, including tables, semantic models, and glossary terms, with lineage and join paths. Each source, like Looker LookML or dbt MetricFlow, adds its unique perspective to the graph. Overlapping definitions are preserved and labeled, empowering data stewards to reconcile conflicts. All of this can be explored and governed in Knowledge Studio, which allows users to curate context sets for various use cases. Ultimately, Knowledge Catalog enables AI agents to provide trusted, accurate business insights by leveraging a comprehensive understanding of an organization's data.

https://cloud.google.com/blog/products/data-analytics/expanded-semantic-model-support-in-knowledge-catalog/ cloud.google.com

RSS Hunter • Oct 29

Cloud CISO Perspectives: Introducing new $250,000 tier for Google Cloud VRP (Q&A)

Google Cloud has introduced a new $250,000 "Root-in-Cloud" tier for its Vulnerability Reward Program (VRP) to incentivize high-impact architectural security research. This tier targets complex vulnerabilities like tenant-isolation bypasses and cross-service logic flaws, requiring deep human intuition and agentic tools. To achieve this reward, researchers must demonstrate full administrative control over arbitrary Google Cloud organizations or projects without prior access or leaked credentials. The program also specifies clear cryptographic validation for testing, ensuring safety and reproducibility. Additionally, remote code execution in Google's production infrastructure (Borg) will be evaluated for Root-in-Cloud eligibility, with strict rules against further exploitation. The new tier reflects the evolving security research landscape, where automated tools have increased report volume but human ingenuity remains crucial for significant findings. Chris Betz, CISO, and Michael Cote, VRP lead, discussed these changes at the Escal8 conference. Cote noted that while automation democratizes vulnerability discovery, it also pressures researchers to find more impactful bugs and accelerates exploit development for n-day vulnerabilities. Google emphasizes responsible disclosure policies to protect users, despite competitive pressures to publish quickly. Enterprise CISOs are advised to prepare for agent-generated submissions, compress remediation timelines, and demand coordinated disclosure from security partners.

https://cloud.google.com/blog/products/identity-security/cloud-ciso-perspectives-introducing-new-tier-for-google-cloud-vrp/ cloud.google.com

RSS Hunter • Oct 29

Querying Databricks Apache Iceberg Tables with the borderless Lakehouse

Enterprises can now query Databricks-managed Apache Iceberg tables directly from BigQuery using Google Cloud's Lakehouse. This eliminates the need for complex data copying pipelines, reducing costs and latency. Databricks stores Parquet files in Google Cloud Storage, and Lakehouse reads the associated Iceberg metadata directly. This borderless approach extends to other cloud providers like AWS and Azure, allowing BigQuery to access data without replication. Lakehouse also enables read and write interoperability, allowing multi-statement SQL commands in BigQuery. Security is centralized through delegated access and BigQuery controls applied to external Iceberg tables. Catalog federation and credential vending simplify connections by using Databricks Unity Catalog for metadata. BigQuery uses Iceberg metadata for efficient query planning, reading only relevant data files through partition pruning. Lakehouse caching further accelerates queries for cross-cloud data by storing retrieved blocks locally. Regular maintenance, including compaction and vacuuming, is crucial for optimal performance and cost management. Compaction merges small files into larger ones, while vacuuming purges unreferenced data files. This integration allows for scalable engineering workloads and concurrent analytics without data migration, paving the way for modern AI workloads.

https://cloud.google.com/blog/products/data-analytics/querying-databricks-iceberg-tables-with-google-clouds-lakehouse/ cloud.google.com

RSS Hunter • Oct 29

How to upgrade embedding models in AlloyDB AI with zero downtime

Upgrading embedding models in production without downtime presents significant challenges. Re-embedding entire datasets, rebuilding indexes, and managing schema changes can disrupt user queries and degrade the user experience. Mathematical incompatibility between models further complicates direct comparison of embeddings. AlloyDB AI offers a solution to these problems by simplifying vector lifecycle management. Its model endpoint management allows in-database access to various embedding models, while auto embeddings efficiently generate and update new embeddings in the background. AlloyDB's ScaNN index offers significantly faster build times compared to open-source alternatives. Native PostgreSQL features like concurrent index creation and atomic column renames enable zero-downtime blue/green and canary rollouts. The process begins by checking prerequisites and adding a nullable column for the new embeddings. Auto-embeddings are then initialized to backfill existing data and keep embeddings updated. Manual mode for auto-embeddings allows for scheduled refreshes to catch up changed rows. Before cutting over traffic, it's crucial to validate vector completeness and retrieval quality. Building a ScaNN vector index, optimized for high dimensions, is essential for efficient search performance. Finally, traffic cutover can be achieved using an atomic column rename swap or a more advanced approach with GUC session variables and a unified UNION ALL set-returning function for flexible release strategies.

https://cloud.google.com/blog/products/databases/upgrade-embedding-models-in-alloydb-ai-with-zero-downtime/ cloud.google.com

RSS Hunter • Oct 28

Introducing the AlloyDB Omni web UI for easier cluster observability

Managing PostgreSQL databases across diverse environments is challenging with command-line tools. AlloyDB Omni, a self-managed PostgreSQL edition, brings enterprise features to any infrastructure. To address visibility issues, the AlloyDB Omni Web UI is now generally available for Red Hat and containers. This production-ready, read-only console provides direct insight into system telemetry, query performance, and configuration. Users can quickly switch between connection profiles and monitor hardware metrics like CPU, memory, and disk I/O. The UI helps identify slow queries and resource-intensive SQL statements visually. It also allows for tracking the Columnar Engine's performance for analytical query acceleration. Administrators can audit database parameters centrally to prevent configuration drift. The Web UI integrates AI tooling, offering visibility into vector search and AI workflows. It is designed for secure deployment within enterprise and air-gapped environments, requiring Prometheus for hardware metrics.

https://cloud.google.com/blog/products/databases/alloydb-omni-delivers-a-web-ui-for-cluster-observability/ cloud.google.com

RSS Hunter • Oct 28

Behind the scenes, two months later: How we ship Google Agent Skills like products

Google Agent Skills emphasizes treating skills as evolving products, not static documents. This philosophy necessitates rigorous automated quality gates for every change. The continuous integration and delivery pipeline enforces six checks: structural conformance, linters, semantic versioning, evaluation suite validation, link validation, and AI review. Structural conformance and linters ensure correct formatting and file structure. Strict semantic versioning is crucial for developers to manage updates and ensure reproducible agent behavior. Evaluation suite validation guarantees the reliability and accuracy of performance tests. Link validation proactively identifies and fixes broken internal and external links.The AI review agent acts as a sophisticated quality checker, identifying issues beyond syntactic errors. It ensures tasks are appropriate for instructions, preventing the "deterministic trap" by separating rigid commands into scripts. The AI also enforces a modular L1/L2/L3 architecture, keeping core instructions concise and reference materials organized. Furthermore, it mandates non-interactive script design, ensuring scripts accept inputs via flags or environment variables. Finally, a human subject matter expert provides the ultimate approval after all automated checks have been successfully passed.

https://cloud.google.com/blog/topics/developers-practitioners/behind-the-scenes-two-months-later-how-we-ship-google-agent-skills-like-products/ cloud.google.com

RSS Hunter • Oct 28

Near-zero downtime upgrades: Announcing Cloud SQL for MySQL blue-green deployments

Organizations must use current database versions for security, compliance, and performance, including AI capabilities. Major version upgrades traditionally involve extensive coordination and significant application downtime. Mission-critical applications can suffer from even short maintenance outages, leading to lost revenue and disrupted customer experiences. To address this, Google Cloud has launched a preview of fully managed blue-green deployments for Cloud SQL, initially for MySQL. This feature allows major version upgrades and configuration changes with minimal disruption. It works by maintaining a synchronized parallel environment, enabling safe testing with production data before a seamless switchover. The original database remains available as a fallback. Historically, delaying upgrades exposes systems to vulnerabilities and prevents access to performance gains and new AI features. Manual blue-green deployments are complex to set up, synchronize, and manage for cutover. Cloud SQL's managed solution transforms this risky process into a predictable, low-downtime operation. The process involves a live "blue" environment, a continuously replicating "green" staging environment, and a swift "switchover" where the "green" instance becomes the new primary. This managed approach offers near-zero downtime cutovers, requires no application changes, and allows for safe, real-data testing before commitment.

https://cloud.google.com/blog/products/databases/cloud-sql-blue-green-deployments/ cloud.google.com

RSS Hunter • Oct 28

How to troubleshoot GKE workloads faster with VPC Flow Logs

Understanding network traffic is crucial for managing Kubernetes environments efficiently. Standard cloud flow logs are insufficient for Kubernetes due to the ephemeral nature of pod IP addresses. Google Cloud's VPC Flow Logs solve this by enriching flow records with Google Kubernetes Engine (GKE) metadata like pod, workload, namespace, and service information. This enhancement provides workload-level attribution for network traffic without needing extra agents.To utilize this, users must upgrade their log bucket to Observability Analytics and enable VPC Flow Logs organization-wide, ensuring all metadata is included. For Standard GKE clusters, intranode visibility also needs to be enabled. These preparatory steps allow for seamless integration and detailed network insights.Once configured, traffic analysis can be performed visually using Flow Analyzer, which is part of Network Intelligence Center. Flow Analyzer transforms raw log entries into interactive charts and tables, allowing users to group and filter traffic by various Kubernetes attributes. This capability helps identify communication patterns and dependencies between microservices.For instance, users can map microservice dependencies by organizing flows by GKE workload, quickly identifying which endpoints are communicating. The tool can also drill down into a single service, revealing all its callers and their respective traffic shares, aiding in performance investigations.Furthermore, Flow Analyzer can detect cross-zone traffic by filtering flows where source and destination zones differ. This helps pinpoint specific pods driving inter-zone data transfer costs. However, it's important to note that VPC Flow Logs do not annotate pod-to-internet traffic, and blocked traffic by network policies is not recorded. Additionally, flow logs are sampled, making them better suited for ranking and trending rather than precise per-connection accounting.

https://cloud.google.com/blog/products/containers-kubernetes/using-vpc-flow-logs-to-troubleshoot-gke-workloads/ cloud.google.com

RSS Hunter • Oct 28

How GKE networking scales to support high densities of concurrent AI agents

The transition to autonomous AI agentic workflows necessitates secure, high-density sandboxes, straining conventional infrastructure. This demand requires unprecedented scale, often up to one million concurrent code-execution sandboxes. Kubernetes networking efficiency is crucial for the economic viability of such initiatives. Advanced workflows like reinforcement learning involve extreme pod churn, demanding sub-second provisioning and high compute density. Agent Sandbox on GKE offers secure, lightweight isolation for these dynamic environments. Agent Substrate on GKE further enhances density and sub-second state rehydration for millions of concurrent idle sessions. GKE Dataplane V2 optimizes network identity management, resolving scaling limits and enabling sub-second provisioning. Traditionally, managing network identities with dynamic labels presents scaling challenges, approaching cluster-wide limits. GKE Dataplane V2 migrates high-cardinality data to annotations and uses advanced filtering to bypass per-pod identity generation. This approach allows identical agent types to share a single identity, maintaining low latency and avoiding identity limits. Agent Substrate integrates these optimizations, achieving efficient activation and suspend/resume latency for large-scale AI workloads.

https://cloud.google.com/blog/products/networking/gke-networking-dataplane-for-large-agentic-ai-workloads/ cloud.google.com

RSS Hunter • Oct 28

Step into a new dimension with XREAL AURA, the first-of-its-kind wired XR glasses

The world of work is evolving, with AI and new form factors like XR glasses transforming productivity. XREAL AURA, a new set of wired XR glasses, is launching built on Android XR. These glasses feature a split-compute architecture for spatial computing and an optical-see-through display. The lightweight design, under 95g, allows for extended use by employees. XREAL AURA offers out-of-the-box support for enterprise apps and allows laptops to be connected for a spatial computing experience. Management and security are handled through the Android Enterprise framework, including Managed Google Play and zero-touch enrollment. Key security features ensure app distribution, remote deployment, and device protection. XREAL AURA enables users to see both the physical world and digital data simultaneously. This unlocks new enterprise use cases like virtual monitors, expert assistance, and 3D design. Android XR, powered by devices like XREAL AURA and managed by Android Enterprise, brings advanced computing and AI to daily work.

https://cloud.google.com/blog/products/chrome-enterprise/step-in-to-a-new-dimension-with-xreal-aura-a-first-of-its-kind-wired-xr-glasses/ cloud.google.com

RSS Hunter • Oct 28

Introducing VMware solution on Google Cloud

Google Cloud announces the general availability of its self-managed VMware solution, offering full administrative control over VMware Cloud Foundation (VCF) on dedicated Google Cloud bare metal. This new option complements Google's existing managed VMware Engine, providing greater flexibility for organizations to migrate and modernize workloads without altering operational playbooks. It is driven by Broadcom's VMware Cloud Foundation 9.x, allowing customers to maximize their VCF licensing investments. The solution caters to organizations needing direct control over their virtualization stack, custom maintenance windows, and third-party integrations.The self-managed solution utilizes dedicated GCE Z3 bare metal instances, featuring high-performance Intel Xeon processors, substantial RAM, all-flash NVMe storage, and 200 Gbps networking. This architecture supports transactional databases and provides low-latency access to native Google Cloud services like BigQuery and the Gemini platform. Storage is built on VMware vSAN, with support for NetApp volumes as well.Key benefits include commercial flexibility, allowing customers to bring existing VCF subscriptions and apply Google Cloud commitments to Z3 bare metal. NVMe memory tiering and vSAN Express Storage Architecture significantly reduce server and storage TCO, respectively. The solution also offers active live patching to reduce downtime.Google Cloud provides operational and technical advantages, including triple-governance choices (Google, customer, or partner frameworks) and granular capacity sizing. Global virtual networking and seamless AI acceleration through direct connections to BigQuery and Gemini are also differentiating factors.Customers can scale bare-metal capacity rapidly while retaining full administrative control, offering cloud flexibility with required infrastructure control. For those preferring managed services, Google Cloud partners provide end-to-end support for the self-managed VMware solution, covering architecture, deployment, migration, and ongoing operations.The VMware solution on Google Cloud is generally available in 22 Google Cloud regions, with further expansion planned. Interested organizations can find more details on the Google Cloud webpage, review documentation, or contact their Google Cloud account team or an authorized partner.

https://cloud.google.com/blog/products/infrastructure-modernization/vmware-solution-on-google-cloud/ cloud.google.com

RSS Hunter • Oct 27

Powering the agentic enterprise with latest innovations in Oracle AI Database@Google Cloud

Google Cloud and Oracle are expanding their partnership to integrate Oracle AI Database@Google Cloud with Google’s Agentic Data Cloud and Gemini Enterprise, spanning AI compute, infrastructure, enterprise data, and agentic AI. This collaboration aims to unify Oracle’s operational data with Google Cloud’s data and AI ecosystem, including BigQuery and Gemini, to enable autonomous, agentic workflows and break down data silos. Key foundational capabilities for agentic AI include the Remote MCP Server with Data API for secure SQL interaction with Oracle databases and Knowledge Catalog integration for unified metadata discovery and governance. Additionally, the Gemini connector for Oracle AI Database@Google Cloud, currently in preview, allows natural language queries directly within the Gemini app, grounded in governed Oracle data. The partnership also extends to connecting agentic workflows across the application layer, bringing Oracle data into Gemini Enterprise and embedding Gemini models natively within Oracle applications. To empower customer choice, Google Cloud and Oracle offer various data unification options: bi-directional Google Cloud borderless Lakehouse and Oracle AI Lakehouse for shared Apache Iceberg tables, sub-second CDC streaming with OCI GoldenGate for real-time data replication into BigQuery, and BigQuery query federation with Oracle for on-demand, in-place analytics. The global footprint of Oracle AI Database@Google Cloud is expanding with new regions and a planned FedRAMP High certification, ensuring secure and compliant operations. This partnership transforms enterprise data into an active, intelligent operational engine, enabling organizations to deploy autonomous AI agents at scale with flexibility and security. Customers can access Oracle AI Database@Google Cloud through the Google Cloud Marketplace for streamlined deployment, billing, and support.

https://cloud.google.com/blog/products/databases/oracle-ai-databasegoogle-cloud-whats-new-at-oracle-ai-world/ cloud.google.com

RSS Hunter • Oct 27

Securely connecting Gemini Enterprise to Snowflake data

Enterprise AI needs to move beyond basic chat interfaces to generate actionable insights from data warehouses with strict security. This guide outlines building a secure bridge between Google Cloud’s Gemini Enterprise and Snowflake using the Model Context Protocol (MCP) and Google Agent Development Kit (ADK). This allows an AI agent to understand natural language, generate accurate SQL via Snowflake Cortex, and execute queries with user-level permissions.This advanced architectural approach enables business users to ask complex questions, like "What were our top 5 selling items in Texas last quarter?" The ADK agent delegates both SQL generation and execution to a governed Snowflake Cortex Agent exposed through the Snowflake MCP server. This process ensures deterministic text-to-SQL translation, keeps query execution within Snowflake’s governed boundary, and minimizes risks of schema hallucinations or unvalidated SQL.The system flow begins with configuring a Snowflake security integration using OAuth 2.0 for user impersonation, preventing broad model access via generic service accounts. Next, apply the principle of least privilege by creating a dedicated role for the agent in Snowflake, granting specific access to databases, schemas, warehouses, semantic layers, and underlying tables. Users must set their default role and warehouse in Snowflake before authorizing the connection in Gemini Enterprise.Subsequently, provision a governed Cortex Agent in Snowflake using a semantic view and expose it via an MCP server with the CORTEX_AGENT_RUN tool type. This delegates SQL generation and query execution to Snowflake while enforcing the caller's OAuth identity and role permissions. Once the MCP server is provisioned, retrieve its endpoint URL using Snowflake queries.The Google ADK agent code then connects to this MCP server. The Python code defines a unique AUTH_ID to extract OAuth tokens injected by Gemini Enterprise, generating necessary authentication headers for the Snowflake MCP. The agent is built using the Gemini 2.5 Flash model, instructing it to use the Snowflake MCP toolset to answer business questions by translating natural language into SQL and executing it within Snowflake's governed boundary.Finally, organize the project files with specific layouts for deployment. Deploy the ADK agent to Agent Runtime in Agent Platform using the official Google Agents CLI. The CLI packages the code, sets up the server, and handles the deployment pipeline, outputting a unique project resource path. This resource path is then used to register the custom agent within the Google Cloud Console, linking its configuration for full integration into Gemini Enterprise.

https://cloud.google.com/blog/products/data-analytics/bridge-gemini-enterprise-and-snowflake-with-google-adk/ cloud.google.com

RSS Hunter • Oct 27

Bringing Google TPUs to Oracle Cloud Infrastructure

Oracle and Google Cloud are partnering to bring Google Tensor Processing Units (TPUs) to Oracle Cloud Infrastructure (OCI) starting in 2027, making OCI the first non-Google hyperscaler to offer them. Google designed TPUs over a decade ago with a co-design philosophy, integrating custom silicon with optical networking, power delivery, liquid cooling, and compiler software to optimize performance per watt and total cost. Modern TPUs, like the eighth-generation, offer significant computational power and efficiency, serving Google's Gemini models. Beyond raw performance, TPUs emphasize "goodput" for training and low latency/cost per token for inference through system-level co-design. Features like on-die Inter-Chip Interconnect (ICI) routing and Optical Circuit Switching (OCS) ensure high goodput and availability by dynamically rerouting around faults. Enhanced memory and interconnect topology further improve performance per dollar for low-latency serving. Google has also open-sourced TorchTPU, its native PyTorch stack, on GitHub, promoting a developer-friendly ecosystem. This allows developers to use familiar tools and easily port workloads between accelerators for optimal cost and performance. Bringing TPUs to OCI offers several benefits: OCI's data centers are engineered for AI density and liquid cooling, providing flexible capacity. Oracle Acceleron's secure, high-performance networking connects TPU capacity to the rest of OCI. Proximity to Oracle databases allows organizations to run fine-tuning and inference near their enterprise data without costly cross-cloud transfers. Finally, OCI will offer a multi-architecture choice, providing both TPUs and GPUs for optimal workload assignment. This collaboration expands access to purpose-built AI systems, fostering innovation and efficiency across the industry.

https://cloud.google.com/blog/products/infrastructure/bringing-google-tpus-to-oracle-cloud-infrastructure/ cloud.google.com

RSS Hunter • Oct 27

Gemini Robotics Embodied Reasoning 2 is now available on Google Cloud

Google has launched Gemini Robotics ER 2, a powerful new intelligence layer for robots. This specialized Gemini model acts as the high-level brain for robots, enabling them to think and act adaptively in the physical world. Gemini Robotics ER 2 works across diverse robot embodiments, from robotic arms to humanoids. It combines advanced video understanding with long-horizon planning and built-in safety features. This allows robots to engage in natural conversations, manage complex multi-minute tasks, and collaborate in teams. The model is now available in public preview on the Gemini platform for enterprise production environments. Organizations can leverage Google Cloud's enterprise-grade security and management tools with this cutting-edge embodied reasoning model. Gemini Robotics ER 2 transforms robots into sophisticated physical agents capable of self-correction and generalization to new situations. It offers improved task verification by accurately identifying critical events within video feeds. The intelligence layer scales across various robot types and facilitates multi-robot collaboration. Developers can declare low-level control interfaces as tools, enabling robots to understand natural language commands and explain their actions. The Gemini platform supports simulation, training, and deployment of these physical agents, integrating with Google Cloud's infrastructure for scalability and edge operations.

https://cloud.google.com/blog/products/ai-machine-learning/gemini-robotics-embodied-reasoning-2-is-now-available-on-google-cloud/ cloud.google.com

RSS Hunter • Oct 27

Google Cloud and NASA: Testing robotic systems for deep space missions

NASA's Artemis program necessitates crew safety and Earth-independent autonomy for future deep space missions. Communication delays to Mars will make real-time medical guidance impossible. Google Public Sector is developing the Crew Medical Officer Digital Assistant (CMO-DA) to aid astronauts remotely. They are now creating a robotic system proof-of-concept to support these missions. This versatile robot will handle logistics and equipment, freeing astronauts for science. It can also pivot to medical support, like preparing an ultrasound for a medic. Safely operating in confined spacecraft requires flexible, human-directed robots. Jet Propulsion Laboratory is adapting satellite tools for the robot to understand its 3D surroundings. A simulator was used for safe practice before testing with real hardware. Utilizing vision-language-action models, astronauts can direct the robot with text prompts. Space missions require edge computing, so models are trained on Google Cloud and run locally on efficient devices. The ultimate goal is a robot that can execute various tasks via voice command under astronaut supervision. This collaboration aims to enable more challenging scientific missions.

https://cloud.google.com/blog/topics/public-sector/google-cloud-and-nasa-testing-robotic-systems-for-deep-space-missions/ cloud.google.com

RSS Hunter • Oct 27

Easy to integrate, compliant by design: Bringing the Swiss Franc to Google Cloud Universal Ledger

Traditional payment systems are slow and expensive, leading to the rise of stablecoins for efficient transactions. However, regulated banks have avoided public stablecoins due to significant risks and regulatory uncertainty. Banks desire the speed of tokenized currency but built on their trusted foundations, explaining their turn to Google Cloud Universal Ledger (GCUL). GCUL provides the secure infrastructure for banks to issue and settle their own tokenized deposits, enabling 24/7 programmable payments without disrupting core operations. This approach offers the benefits of stablecoins like speed and low cost while addressing concerns about regulatory issues and impact on bank reserves. Switzerland's Crypto Finance Group successfully piloted this concept, demonstrating instant account-to-account transfers between two Swiss banks on the GCUL network. The pilot validated an architecture for commercial banks to modernize payment operations, adhering to strict financial security frameworks. GCUL's design emphasizes robustness, performance, and ease of integration, allowing banks to connect their existing systems. Regulatory compliance and governance are built into GCUL, with a "currency operator" like Crypto Finance setting the rulebook for network operations. This system mitigates counterparty risk through issuance limits and enables capital efficiency through periodic settlement. The Crypto Finance pilot showcases GCUL's potential for domestic transfers, with future applications including cross-currency settlement and autonomous payments. Ultimately, GCUL allows banks to offer stablecoin-like speed while preserving capital efficiency and regulatory compliance.

https://cloud.google.com/blog/topics/financial-services/easy-to-integrate-compliant-by-design-bringing-the-swiss-franc-to-google-cloud-universal-ledger/ cloud.google.com

RSS Hunter • Oct 26

Scale agents securely with IAM Helper Agent Skills and MCP Tools

The increasing use of autonomous agents in application development introduces significant challenges for identity and access management. These agents, capable of provisioning cloud resources and deploying services at machine speed, can encounter security friction that slows down CI/CD pipelines. To address this "agentic-era" IAM challenge, Google Cloud is introducing IAM Helper. IAM Helper provides intelligent, agent-facing building blocks that automate complex IAM workflows for autonomous code assistants and deployment pipelines. It acts as an agent-native orchestration layer for Google Cloud IAM, integrating with existing engines like Policy Intelligence and Privileged Access Manager. This integration allows autonomous code to directly call IAM skills, reducing administrative overhead and improving security. IAM Helper empowers agents to dynamically manage access, shifting the burden of policy evaluation and complex orchestration to the Google Cloud backend. Packaged using the Agent Skills standard, these end-to-end workflows and guardrails work with common agents like Gemini and Claude. IAM Helper skills incorporate built-in guardrails, separating read-only discovery from policy changes, with automated diagnostics and simulations. Policy changes require human confirmation via customizable risk tiers. For example, an agent encountering a permission error can automatically troubleshoot, request a temporary grant, and resolve the issue. Autonomous pipelines can self-heal by generating least-privilege policies, verifying them against logs, and routing changes for approval. IAM Helper also assists in authoring compliant policies, generating and validating IAM v1 and v2 rules while blocking risky configurations. It enables rapid troubleshooting of 403 errors by identifying missing permissions, and allows simulations of policy changes to assess blast radius before rollout. Moreover, it facilitates just-in-time privileged access instead of standing privileges, ensuring audited and time-bound access. These agent skills are powered by foundational Google Cloud IAM MCP tools, which provide atomic, read-only functions to query IAM endpoints efficiently. Using these tools avoids the need for custom API wrappers, maximizing token efficiency and allowing agents to securely execute multi-step operations. Teams can access the IAM Helper Agent Skills Catalog and official documentation to begin implementing these capabilities.

https://cloud.google.com/blog/products/identity-security/scale-agents-securely-with-iam-helper-agent-skills-and-mcp-tools/ cloud.google.com

RSS Hunter • Oct 26

Unifying enterprise context and semantics: LookML in Knowledge Catalog is now GA

Enterprises moving AI agents to production require more than just data access; they need data understanding. Google Cloud's Knowledge Catalog for Looker Core now indexes LookML semantic language, bridging this gap. AI agents need context, including table schemas, lineage, and governance, but also deterministic business semantics for metric calculations. A single tool cannot provide both broad organizational context and precise metric definitions. Knowledge Catalog offers broad enterprise context, while LookML provides deterministic mathematical semantics. This integration indexes LookML business logic into Knowledge Catalog for Gemini Enterprise and custom AI agents. Without explicit semantic rules, LLM agents can create conflicting metric definitions and generate incorrect SQL due to naive join fan-outs. Knowledge Catalog and Looker resolve this by modeling semantics once in LookML and accessing them across Google Cloud's AI ecosystem. This new release indexes LookML's deterministic semantics as a first-class layer in Knowledge Catalog, providing agents with exact definitions, join paths, and lineage. This metadata is automatically available to Gemini Enterprise without custom code, enabling it to generate accurate SQL by referencing technical schemas, glossaries, and indexed LookML logic. Looker Core on Google Cloud automatically indexes LookML models, Explores, Views, lineage, and dashboards directly into Knowledge Catalog. This integration enables agents to retrieve both broad context from Knowledge Catalog and explicit mathematical relationships from LookML.

https://cloud.google.com/blog/products/business-intelligence/lookml-metadata-indexing-in-knowledge-catalog-is-now-ga/ cloud.google.com

RSS Hunter • Oct 26

Expanding Claude availability and deployment choice on Google Cloud

Google Cloud is enhancing generative AI offerings by providing developers with more choices for deploying Anthropic's Claude models. A new Anthropic-managed deployment option for Claude models is now generally available on Google Cloud. This option complements the existing Google-managed deployment choice. Both options offer access to the latest Claude models on day zero and share the same pricing and Google Cloud billing.The key difference lies in who serves as the data processor and the availability of new Claude platform features. The Anthropic-managed option provides immediate access to features like Claude Managed Agents and code execution, with Anthropic acting as the data processor under their terms. Google Cloud IAM and billing consolidation are still utilized. Conversely, the Google-managed option maintains Google Cloud as the data processor under existing customer agreements, prioritizing strict governance and compliance with features like VPC Service Controls and CMEK. New Claude platform features will be integrated over time into the Google-managed infrastructure. The Google-managed option also offers native integrations with Google Cloud services. Regardless of the deployment choice, users can leverage Claude models such as Opus, Sonnet, and Haiku.

https://cloud.google.com/blog/products/ai-machine-learning/expanding-claude-availability-on-google-cloud/ cloud.google.com

RSS Hunter • Oct 22

Introducing new self-learning context enrichment in Knowledge Catalog

Google Cloud's Knowledge Catalog is enhancing its context engine for agents with new preview features. Self-learning context enrichment analyzes agent and user interactions to automatically identify and update missing or outdated business context. Knowledge Studio provides a visual context graph and conversational exploration for managing this context. This addresses the challenge of manually curating context as the number of agents scales. Gemini-powered enrichment extracts verified definitions from various business documents and code repositories. These definitions are then organized into governed, reusable context sets for agents. This improves agent accuracy, reduces latency, and token usage significantly. Enrichment capabilities connect to both structured and unstructured data sources. Proposed context updates are presented with source citations and confidence scores for review. User and agent interactions pinpoint areas where agents struggle, enabling automatic fixes. Automation can be configured with confidence score thresholds for auto-publishing changes. Context sets allow for curated, domain-specific subsets of the broader context graph. These sets enforce data governance and fine-grained access control. Knowledge Studio transforms Knowledge Catalog into an interactive command center for context management. It offers visual navigation, conversational exploration, and version control for changes. These new features aim to keep context current and improve agent performance across organizations.

https://cloud.google.com/blog/products/data-analytics/knowledge-catalog-self-learning-context-enrichment-for-ai-agents/ cloud.google.com

RSS Hunter • Oct 22

Inside Agent Compute Engine: Building the compute foundation for the agentic era

The software industry faces periodic architectural shifts, with warehouse-scale computing and containers emerging after the web scale boom, and TPUs developed due to deep learning demands. Google also introduced Titanium for hardware-rooted security guarantees. A new fundamental shift is the rise of agentic AI, where AI agents take action beyond just answering questions. These agents are increasingly writing code, running tools, and orchestrating workflows, rapidly consuming compute and storage resources. Traditional compute primitives are insufficient for running millions of these agents cost-effectively and with low latency. This necessitates a new form factor, leading to the development of Agent Compute Engine, a Google Cloud service providing hardware-isolated microVMs for AI agents.Agent Compute Engine aims to bridge the gap between the isolation of virtual machines and the speed and density of containers. Existing VMs are too slow to start and stop for frequently pausing and resuming agents. Containers, while fast, lack the required isolation and kernel-level control for certain agent tasks. The system needs to efficiently manage agents, understanding when they are active or idle to avoid resource waste and preserve working state. Agent Compute Engine is designed as a unified platform offering a microVM abstraction for persistent, hardware-isolated computing.This new architecture supports diverse workloads, including interactive agent interfaces, autonomous software engineering, large-scale evaluations, and lightweight sandboxes for Google services. Security is paramount, with a defense-in-depth approach anchored in hardware-rooted trust via Titan silicon and Titanium IPUs. Host integrity is maintained through stateless, immutable appliances, and agentic sessions are isolated within single-tenant microVMs. A zero-secrets architecture prevents sensitive credentials from residing within the sandbox, ensuring security even if the guest OS is compromised.Networking is restricted, with all traffic flowing through a mediated proxy that enforces policy-driven outbound brokering. End-to-end encryption is implemented for both data in transit and at rest. Automated patching, runtime detection, and continuous security measures are in place, alongside strict separation between the agent harness and sandbox. The system operates under the assumption that the sandbox is controlled by an attacker, thus holding no credentials and having no direct network access. Governance is handled through first-class agent identities, managed via a registry and an authentication manager that acts as a vault and broker for agents.

https://cloud.google.com/blog/topics/ai-infrastructure/agent-compute-engine-deep-dive/ cloud.google.com

RSS Hunter • Oct 22