Google makes agent sandboxes GA with private-network controls
Google made Computer Use and Shell sandboxes generally available in Gemini Enterprise Agent Platform. Shell sandboxes run untrusted commands in isolated Linux containers, while VPC Service Controls, Private Service Connect, customer-managed encryption keys, snapshots and pause-resume controls are now documented for the sandbox surface. Agent Gateway also gained VPC Service Controls enforcement.
Why it matters: Agent execution, network isolation, encryption and recovery now share a production-labelled control boundary. The Gateway change can apply perimeter rules to agent traffic, but only when private connectivity is configured correctly.