Google Doubles TPU 8i Silicon for AI Agents and Adds Secure Variant

Google has added two systems to its eighth-generation TPU lineup: TPU 8i Max, which packs two 8i chips into one package, and TPU 8tx, a confidential-inference variant hosted on 5th Gen AMD EPYC. The company has published no specs for the 8tx, no prices, and no ship dates for either system. Both appear as "coming soon" on Google's Cloud TPU page.

The moves arrive almost seven months after April's launch of TPU 8t for training and TPU 8i for inference. Google says the modular approach delivers specialized systems "in a matter of months rather than years." The claim is plausible here. The 8i Max is two existing dies on one substrate. The 8tx runs silicon Google already announced.

What does the 8i Max change?

The 8i Max doubles compute, SRAM, and HBM bandwidth of the 8i while fitting "the existing rack footprint," per Google. Google claims more compute per square foot and per watt. Derived figures put the part at roughly 20.2 FP4 PFLOPS, 768 MB of on-chip SRAM, and about 17.2 TB/s of HBM bandwidth.

The comparison with rivals is blunt. Nvidia's Rubin R200 is rated at 50 FP4 PFLOPS and 22 TB/s of HBM4 per socket. AMD's MI455X delivers 40 FP4 PFLOPS. The compute gap is closing. It has not closed.

The bandwidth doubling matters for agent workloads. Google calls the bottleneck "the memory wall." When dozens of AI agents cooperate across a codebase, with models targeting 1 million tokens of context, KV caches grow and each new token must read that cache from memory. It is a different route from Nvidia's LPX, which adds a second chip type for decoding and a storage tier for context.

Google also shipped supporting software. TPU Sync, an open-source "model-state layer for TPU clusters," tiers KV caches off chip HBM to host DRAM and, experimentally, shared storage "in milliseconds." Google says it cuts KV transfer latency by more than 90 percent, though time-to-first-token gains vary by workload. A new Agent Compute Engine service pauses idle agent sessions and moves their working memory aside.

What about the verified performance?

Third-party numbers remain thin. Google credits its vLLM-TorchTPU stack with "state-of-the-art price-performance marks" on InferenceX and AgentX benchmarks. Those are Google's own claims.

The only published independent results cover the previous generation. In SemiAnalysis testing in September, Ironwood running Qwen3.5 397B in FP8 delivered 50.4 percent more tokens per dollar than Nvidia's B200 and 96.0 percent more than the B300, at 20 tokens per second per user. November results showed Ironwood's FP8 beating Nvidia's FP4 GB300 NVL72 at 1.67 times performance per dollar on the same model. A caveat follows every promise: Ironwood lacks native FP4, and no eighth-generation result exists yet.

Who is the 8tx for?

The 8tx is "built on the same silicon as TPU 8t" and is "optimized for secure and confidential inference" plus small-scale training. Hardware isolation prevents snooping on sensitive data, including model weights, covering the moment data sits unlocked in memory during processing.

The target is regulated enterprises and governments running frontier or proprietary models. Google says such operators can "fine-tune models using their private data, distill large models into smaller ones, and train their agents" without moving sensitive data between clusters. The Pentagon reportedly held discussions with Google in April about TPUs in classified settings, though the 8tx is not specifically named.

The product appears to formalize existing capability. Google's Private AI Compute, described in a September technical brief as a "hardened TPU platform" with protections "comparable to a typical TEE," already runs confidential serving. It uses an AMD-based hardware Trusted Execution Environment for CPU workloads, which likely explains the switch from Axion hosts to EPYC. Google itself gives no reason for the change.

Competing options exist. Nvidia's NVL72 spans one security domain across 72 Rubin GPUs, 36 Vera CPUs, and the interconnects. Intel's TDX is adding trusted I/O for data moving to accelerators.

The 8tx adopts the 8i's Boardfly network over the 8t's 3D torus. Google claims "up to 2x lower latency compared to TPU 8t" with almost no performance penalty, though the metric is unclear. The logic holds: torus suits training, where chips swap data with predictable neighbors, but inference on large mixture-of-experts models sends small messages between distant chips. Boardfly needs at most seven hops against 16 at 1,024 chips.

What is missing?

Google lists no HBM capacity, pod sizes, availability dates, pricing, or customers for either system. The 8tx lacks published details on attestation, the mechanism by which customers verify confidentiality. TPUs are nonetheless a fast-growing business; Google claims nearly 100 customers, including Meta's recent move to the platform.

Shipping two specialized systems inside seven months signals a faster cadence than Google's historical norm. Proof will come only when benchmarks and hardware reach customers' hands.