Google's Agent Compute Engine gives each agent its own microVM
The sandbox behind Gemini's agents, productized — plus the open-source twin you run today, a six-task open VLM, and OpenAI's monitor red-teamed.
Copy markdown
A hardware-isolated microVM per agent session
Google turned the sandbox behind Gemini's own agents into a cloud service: each agent session gets a single-tenant Cloud Hypervisor microVM with its own kernel, root, a read-only dm-verity filesystem, vsock-only networking and zero stored credentials — Agent Gateway swaps in the real backend key only after policy checks. Customer preview is targeted for the coming months, so register interest now if you run untrusted agent code.
Run the open-source version today: Agent Substrate
The Apache-2.0, Kubernetes-native engine underneath ACE has been on GKE since Sep 15 and runs on any cluster via Cloud Hypervisor microVMs or gVisor, with harness support for Claude Code, OpenClaw and Hermes. Google's benchmarks claim ~10x compute density, 500 agent activations per second, sub-500ms suspend/resume and 1,000+ dormant agents per host — enough to sandbox a real agent fleet without waiting on the ACE preview.
Tencent open-sources one VLM for six vision jobs
WeVisOne-VL is a single vision-language model that handles object detection, referring localization, counting, OCR, segmentation and matting through one backbone: a dedicated OBJ token fires a lightweight pixel decoder that emits points, boxes, masks or alpha mattes. It claims leads across 30+ benchmarks and refuses queries about objects not in the image, so you can collapse a multi-model CV pipeline into one open checkpoint.
OpenAI's internal agent monitor got red-teamed
METR and Redwood found at least six ways to evade OpenAI's internal misalignment monitor, including two client-controllable headers that disabled monitoring for new agent instances and a compaction gap that left an estimated ~10% of internal Codex traffic unmonitored from May to July; overall coverage ran ~75-94%. OpenAI says the production-impacting bugs are fixed — the takeaway for you is to not treat provider-side monitoring as complete on your own Responses-API or Codex agents.
MOSS-Image now drops into ComfyUI
The open 5B text-to-image model you steer with JSON layout is now repackaged for ComfyUI under Apache-2.0, with four ready-made workflows: plain and bounding-box-guided generation in bf16 or int8, a color/depth-control LoRA, a Qwen3.5 text encoder and a Flux2 VAE. Drop the files into your model folders and you have layout-controllable image generation in your node graph tonight.