Google Ships TPU 8tx With Encrypted In-Use AI Compute and 8i Max

Google has introduced TPU 8tx, which it describes as the first cloud TPU system with hardware-enforced confidential computing, keeping data and model weights encrypted even while a processor works on them. The company announced the system alongside TPU 8i Max, a double-capacity packaging of its reasoning chip, in a blog post Monday morning from Amin Vahdat, Google's SVP and chief technologist for AI and infrastructure.

The launch closes a persistent gap in enterprise AI security. Encrypting data at rest and in transit is routine practice; the hard part has been the moment a processor actually works on that data, when it normally has to be decrypted in memory. Google built TPU 8tx to remove that exposure for AI workloads, and it brought AMD along to do it.

How many TPU systems has Google shipped this year?

Four. With TPU 8t for training and TPU 8i for reasoning introduced at Cloud Next in April, the two new systems bring Google's eighth-generation family to four TPU systems in a single year. Vahdat said that pace is a first for Google. He also wrote that TPUs have grown into a business with nearly 100 customers, a list that includes frontier labs, trading firms, retailers and universities.

Google calls these systems rather than new chips. Each one rearranges the packaging, memory, networking and security around silicon Google already makes. TPU 8tx uses the same silicon as TPU 8t. TPU 8i Max combines two existing TPU 8i chips into one package.

What does TPU 8tx actually protect?

TPU 8tx targets regulated enterprises and governments running frontier or proprietary models and agents against sensitive data. Google said it keeps data and model weights protected and isolated even while in use — the phase of computing where conventional protection ends and decryption traditionally begins.

The system borrows the low-latency Boardfly network from TPU 8i, which Google says gives TPU 8tx up to 2x lower latency than TPU 8t with a near-zero performance penalty. Teams can fine-tune on private data, distill models and run reinforcement learning on the same system, without moving that data between clusters.

AMD supplies the host side. In its own announcement, AMD said 5th Gen EPYC processors serve as the host CPUs for TPU 8tx. The design uses AMD's Secure Encrypted Virtualization to extend protection from the CPU to the attached accelerators. An accelerator's identity and security configuration are verified before the accelerator gets direct access to protected memory. AMD says this architecture helps keep prompts, model weights and intermediate data encrypted in CPU memory and in transit between the host and the TPUs.

Two statements from Mark Lohmeyer, vice president and general manager for AI and computing infrastructure at Google Cloud, frame the pitch. "When teams move AI agents into production, they need confidence that their data and intellectual property stay private, even from the underlying infrastructure," Lohmeyer said in AMD's release. Speaking at a briefing covered by Network World, he added: "You shouldn't have to trade off between security and performance."

NVIDIA is courting the same buyers. In October it added a Confidential Bare Metal option for model builders, with Google Cloud among its early backers. Google's move puts confidential AI compute into its own custom silicon rather than a software layer on top of third-party hardware.

Why does TPU 8i Max matter for reasoning models?

TPU 8i Max goes after memory limits, the binding constraint on long-context reasoning models. Google combined two TPU 8i chips in a single package, giving the system double the compute, SRAM and HBM bandwidth of TPU 8i while fitting twice the silicon into the existing rack footprint.

Network World, citing Lohmeyer, reported the specific figures: 384 GB of high-bandwidth memory, which is 33% more than TPU 8i; 17.2 TB per second of memory bandwidth; and 768 MB of on-chip SRAM.

For operators running reasoning workloads with long prompts and large KV caches, the package roughly doubles what fits in one rack slot without requiring a new generation of silicon.

What did Google announce on the software side?

The hardware launch carried a software payload:

• TPU Sync, now open-sourced. The tool tiers KV caches off the chip and synchronizes reinforcement-learning weights. Google says it cuts KV transfer latency and time to first token by more than 90%. Network World reported that TPU Sync is also available for v7, v6 and v5 TPUs.
• Cloud Pathways and GKE dynamic slicing, now generally available. Google says dynamic slicing makes job startup up to 5x faster and fault recovery up to 4.5x faster.
• A TPU agent suite, in preview. It plugs into Claude Code, Cursor and Google Antigravity to automate onboarding and kernel tuning. The suite builds on the TorchTPU release from October.

The open-sourcing of TPU Sync for hardware three generations old signals Google's effort to make its installed TPU base more attractive to developers who might otherwise default to NVIDIA's CUDA ecosystem.

Where will these TPUs run?

Google's reach with TPUs is widening beyond its own cloud. Oracle plans to offer TPUs on Oracle Cloud Infrastructure starting in 2027. That arrangement would put Google's custom accelerators inside a rival hyperscaler's data centers, an unusual arrangement in a market where chip designers have historically kept their silicon exclusive to their own clouds.

Vahdat's post did not give pricing or availability dates for either new system. Google scheduled a broadcast on the new TPUs for 9 a.m. PT Monday.

The stakes are straightforward. Nearly 100 customers now run workloads on TPUs, four TPU systems shipped in one year, and confidential computing — long the blocker for regulated industries adopting frontier AI — is now enforced in hardware on Google's accelerators. NVIDIA's Confidential Bare Metal move in October shows both chip vendors reading the same demand signal from enterprise buyers; the question for the coming year is whether encrypted in-use compute becomes table stakes across the industry.