Google has moved Computer Use and Shell sandboxes in Gemini Enterprise Agent Platform to general availability. The release adds the controls that decide whether an execution environment is merely convenient or fit for governed production: private connectivity, service perimeters, customer-managed encryption and resumable state.
Google recorded the general availability release on September 9, 2026. Both sandbox types provide isolated Linux environments and expose direct execution through an /exec endpoint. Teams can now pause and resume a sandbox while preserving its filesystem state and connection identity.
The GA package in one control map
| Control | What Google says is available | Why it matters |
|---|---|---|
| Execution | Computer Use and Shell sandboxes with direct /exec | Tools run in an isolated environment instead of the application host. |
| Network boundary | VPC Service Controls and Private Service Connect | Traffic can remain inside approved service and network paths. |
| Encryption | Customer-managed encryption keys | Organizations control key policy and revocation. |
| Continuity | Pause and resume with filesystem and connection identity preserved | Long-running jobs can checkpoint without rebuilding state. |
Shell and Computer Use create different attack surfaces
A Shell sandbox executes commands against files, processes and network destinations. A Computer Use sandbox adds interaction with a graphical environment. That extra interface can expose browser sessions, clipboard contents, rendered secrets and application state that a command-only tool never sees.
Do not give both modes the same policy by default. A build agent may need package installation and compilation but no logged-in browser. A web-testing agent may need a browser but no access to production credentials. Separate images, identities and egress policies make those differences reviewable.
Persistent checkpoints change the cleanup model
Pause and resume is operationally valuable because a long task can survive scheduling gaps. It also means temporary files may stop being temporary. Downloaded data, command history, tokens cached by tools and browser state can remain available when the sandbox returns.
- Define which directories may persist across a pause.
- Expire credentials before the maximum resume window.
- Record the sandbox image and policy version with every checkpoint.
- Destroy state when ownership or workload purpose changes.
VPC Service Controls can block a convenient Notebook feature
Google also documented an adjacent compatibility change: Gemini Notebook Enterprise cannot ingest arbitrary web URLs when VPC Service Controls are enabled because a live crawl requires outbound traffic. Google Docs and YouTube sources remain supported.
This is a useful example of a real perimeter tradeoff. A private execution boundary can intentionally remove a feature that depends on unrestricted retrieval. Teams should list every tool that fetches a URL at runtime before enforcing the perimeter, then choose approved mirrors or ingestion pipelines for required sources.
A deployment sequence for the new sandboxes
- Create separate sandbox profiles for Shell and Computer Use.
- Attach the narrowest service identity required by the workload.
- Allowlist destinations and test blocked egress explicitly.
- Enable customer-managed keys and exercise key revocation in staging.
- Pause a representative task, rotate credentials, then resume it.
- Verify that logs connect the user request, tool action, sandbox and resulting change.
Our AWS AgentCore MCP deployment guide maps the same identity and tool-boundary problem on another cloud. For code-review agents that execute repository code, see our Copilot agent firewall analysis.
What GA does and does not certify
General availability means Google is offering the capability as a supported product. It does not certify an organization’s workload, data classification or tool policy. The customer still decides which code enters the sandbox, which secrets are mounted, where traffic can go and how resumed state is retired.
Primary source
Checked September 14, 2026. Product availability and features are based on Google’s release notes. Organizations should verify regional availability, quotas and pricing in their own Google Cloud account before deployment.
