Read the Google Cloud post with a startup pitch deck open next to it. A lot of slides just got harder to defend.
At AGNTCon + MCPCon this morning, Google launched Agent Compute Engine. It’s the compute service that already runs Gemini’s agent sessions. Every agent gets its own microVM behind a hardware-isolated Cloud Hypervisor boundary on Titanium, its own cryptographically verified ID and short-lived credentials. The part security people should underline: service credentials are injected at egress, outside the microVM. The agent never holds the key it uses. Preview is due “in the coming months” (Google Cloud blog).
That’s the sandbox. Then Google stacked the control plane on top. An Agent Gateway for policy on agent traffic. An Agent Registry as the source of truth for approved agents, tools, MCP servers, skills and models. SPIFFE-based Agent Identity. OpenTelemetry traces for every model call, tool invocation and agent hop. And it’s leaving Google’s walls: Envoy-based enforcement points for other clouds and on-prem, and an OS-level sandbox for Claude Code and Antigravity CLI on managed laptops, both “in preview soon.”
The timing is brutal. On October 21, Ultra Security came out of stealth with a $10M seed from Ludlow Ventures, Entrée Capital, Detroit Venture Partners and others. Its pitch: sit between AI agents and the MCP servers and connectors they call, and run every tool call, data read and prompt through policy in real time (Ultra via Business Wire). Guardrails, governance, observability, connectivity. It’s a sharp team. Founder Chase Lee built Trustpage, which Vanta acquired.
Put the two feature lists side by side. Tool-call policy, agent allowlists, tracing, credential protection. Google now gives a lot of that to anyone already paying for Google Cloud. That’s the platform-versus-best-of-breed fight in one news cycle.
Where the platform wins. Isolation and identity belong to whoever owns the hypervisor. A startup can’t put a hardware boundary under your agent. It can’t inject a credential outside a VM it doesn’t run. If the agent runs on Google, the strongest controls are Google’s, and they come bundled. Buyers will take that trade every time for workloads already living in one cloud.
Where best-of-breed still has a case. Three places.
First, neutrality. Read the gateway roadmap closely. Token budgets and model routing policies are coming this quarter. That’s useful. It also means the gateway deciding which model your agent calls is run by a company that sells models. A CISO can reasonably want the policy point owned by someone with no stake in the routing decision.
Second, the messy middle. Real fleets mix Gemini, Claude Code, open-source harnesses, SaaS copilots and agents inside vendor products. Google’s cross-cloud and endpoint pieces are still preview-soon. Ultra pitches local-first, vendor- and model-agnostic. If a startup can be the one policy that follows the agent across all of those, today, it has a product.
Third, the audit trail. Google’s own launch frames the problem as default-deny plus actions you can audit. Whoever owns the evidence an auditor trusts owns the renewal. Ultra leading with SOC 2, ISO 42001 and a FedRAMP 20x audit is a tell. It’s selling to the compliance buyer, not the platform team.
The money question. The public market already paid for this story. On OpenShell day, October 21, Okta rose 7.1%, Cloudflare 6.6% and CrowdStrike 4.4% as they announced OpenShell support (Yahoo Finance). Twenty-four hours later the biggest cloud pitched agent isolation, identity and policy as part of the cloud itself. If the hyperscalers keep absorbing the sandbox and the gateway, the durable value sits in cross-platform identity, detection that spans clouds, and the audit layer. It doesn’t sit in a proxy that sees tool calls.
For seed-stage agent-security companies, the bar moved this morning. “We see what your agents do” is now a cloud checkbox for single-cloud shops. The pitch that survives is “we’re the one control that works on every agent you run, including Google’s, and we don’t sell you the model.”
What we’d do this week. Inventory where your agents actually run. If nearly all of them sit on one cloud, pilot the native controls before you buy a point product. If they’re spread across clouds, SaaS and laptops, run the bake-off on one test: can the vendor enforce the same policy on a Claude Code session on a laptop and an agent in production, and give you one trail? Most can’t yet. The one that can is worth a premium.