Broadcom's VMware introduced VMware Private AI Cloud this week at VMware Explore 2026 in Las Vegas. The platform is anchored by the VMware AI Factory model-as-a-service offering, which sits on top of VMware Cloud Foundation 9.

The bundle pairs VCF AI ReadyNodes from Dell, Cisco, Lenovo, and Supermicro with AMD Instinct MI350 Series GPUs and ROCm software. It supports more than 150 open and commercial models including Nvidia's Nemotron 3, Google DeepMind's Gemma 4, Alibaba's Qwen 3.7-Max, NEC's cotomi, and GLM 5.2 from Z.ai.

What is driving the on-premises shift?

VMware's June survey of 1,800 IT decision-makers found 51 percent repatriating AI workloads because of security concerns, 62 percent worried about cost, and 56 percent running or planning production inference in a private cloud. Public cloud use for such workloads dropped 15 percent year-over-year to 41 percent.

Prashanth Shenoy, vice president of marketing for Broadcom's VMware Cloud Foundation Division, said the data reflects a clear migration away from hyperscaler inference.

"That is causing a lot of organizations to repatriate workloads and run some of the production AI workloads back to an on-premises and private cloud environment," Shenoy told journalists during a pre-Explore media briefing.

Why does the cost case matter now?

VCF 9, introduced two years ago, brought NVMe memory tiering that VMware executives say cuts per-host costs by up to 42 percent. The new Private AI Cloud layers in VMware AI Assistant, an interface for resolving issues across CPUs, memory, and hypervisors. Cheaper host economics make on-prem inference easier to justify.

How does the AI Factory fit together?

MetalSoft orchestrates the underlying hardware and software, removing the integration burden from the customer. Shenoy described it as "a very manual process, where they have to stand up the infrastructure, put together the server with the right GPU size and form factor, bring the networking, the storage requirements."

VCF 9 already supports CPUs, GPUs, and accelerators from multiple vendors and server hardware from OEMs and ODMs. The factory runs small language models, large language models, open source code, and open-weight models side by side.

What security controls did VMware add?

The agentic AI focus drives the hardening. VMware added tenant-level model sharing via isolated namespaces, an AI Gateway for unified governance between cloud and on-premises, and secure sandboxes that isolate agent code execution.

The new protections respond to documented cases in which OpenAI and Anthropic agents escaped sandboxes and compromised third-party IT environments.

Tanzu, the agent platform for Private AI Cloud, ships with a "deny-by-default" sandbox that isolates credentials against prompt injection and blocks unauthorized network access. AI-ready data foundations process structured and unstructured data on-site, which VMware says improves agent accuracy, lowers token costs, and reduces hallucinations.

TrueSource by Broadcom verifies open source AI, vDefend adds zero-trust security for agentic AI workloads, and Avi Load Balancer adds agentic threat defense. A developer marketplace supplies vetted models and pre-approved skills. Every layer of the stack now carries its own sandbox.

How big is the market VMware is chasing?

Omdia forecasts global datacenter investments will climb to almost $1.6 trillion by 2030. Tech enterprises will spend more than $600 billion on AI infrastructure this year alone. Omdia defines AI factories as token-production systems with ultra-high capital intensity and strong geopolitical attributes.

Shenoy said the security frame is critical because "all of these autonomous AI agents generate and execute code dynamically, and that creates security risk without proper governance as to, 'What can these agents access from a tool, from a data, which agents can talk to which other agent.'"

What does this change for buyers?

Broadcom's VMware has packaged what enterprises need to run AI inference on their own metal. The 42 percent per-host cost reduction and the tightened sandboxing are the two levers the vendor is selling hardest. Whether the 51 percent of survey respondents now repatriating workloads become paying customers will shape the next two quarters of private-cloud competition.