Google's TPU 8i Max and 8tx Split Agentic AI Hardware by Memory and Confidentiality

Google's eighth-generation TPU lineup just got two more members, and they point in different directions. The TPU 8i Max is built for the largest context windows and the densest racks. The TPU 8tx is built for running models on data that can't leave a protected boundary. Together they suggest Google sees agentic AI as a workload that needs more specialized silicon than a single training-or-inference chip can offer.

The company introduced the original 8t and 8i pair at Google Cloud Next 2026 in April. The 8t targets large-scale training, and the 8i targets real-time reasoning. Those two chips covered the classic split between building models and running them. The new additions extend that family into two problems the first pair didn't fully address: memory-hungry long-context inference and inference on sensitive data.

What the 8i Max changes

Google says the TPU 8i Max doubles the compute, SRAM and high-bandwidth memory of the TPU 8i. It also fits twice the silicon into the same rack footprint, which the company frames in terms of floor space per square foot and power per watt in data centers. Those are the figures Google published, and they're the ones to build planning assumptions around until independent measurements arrive.

Why does memory matter so much here? Think of a context window as the model's working space, the amount of material it can hold in view while it answers. A bigger window lets a model work across a long document, a long conversation history, an audio or video file, or a large codebase. The catch is that every token the model consults has to be fetched, processed and sometimes fetched again. Larger windows push hard on the chip's ability to hold that working set close to the compute.

That's the core logic behind the 8i Max. More on-chip memory means fewer trips between processors and fewer trips to slower memory. Google's argument is that this cuts latency and reduces the power a model needs to work through a big pile of information. Those two effects matter most in agentic systems, where a model may revisit the same context across many steps rather than answering once.

Google connects this to its Gemini frontier models, which support a 1 million-token context window. The company describes that as the industry standard for flagship models and equates it to roughly 750,000 words or 1,500 pages of text. Smaller models often top out between 128,000 and 256,000 tokens. The gap between those figures is the gap the 8i Max is meant to serve: workloads where a smaller window forces an application to chop, summarize or re-fetch its inputs.

What the 8tx is for

The 8tx takes a different route. Google says it optimized the chip for secure, confidential inference, with regulated enterprises and public-sector customers in mind. Those customers want to run frontier or proprietary models, plus autonomous agents, against their most sensitive data.

The underlying problem is an old one with a new twist. Data is typically encrypted at rest and in transit. But a model has to decrypt that data to process it, and that's the moment when it's most exposed. Google's answer is to build a secure enclave into the hardware layer itself, one that keeps both the sensitive data and the model weights protected and isolated while computation runs.

The 8tx shares its architecture with the TPU 8t and pairs it with custom AMD central processing unit hosts. That detail is worth noting because it shows Google is willing to build a complete system around its accelerator rather than treat the chip as a drop-in component. A confidential enclave is only as strong as the host environment around it, so the system-level design is the part to scrutinize.

Why training and inference on one system matters

Here's the thing that might matter most for practitioners. Google says the 8tx combines training-grade compute with fast inference in a single confidential system. Organizations can run models and customize them in the same place.

In practice, that opens up several workflows that regulated teams often find awkward today. They can fine-tune a model on private data, distill a large model into a smaller one, and train agents with reinforcement learning. Google says all of this can happen without moving data between separate clusters. That's significant because each data transfer adds exposure, and each additional environment adds operational work to keep consistent.

Teams in this position often end up splitting their pipeline across a training environment and a separate serving environment, then managing the handoff of data and weights between them. Collapsing those steps into one protected system reduces both the number of places sensitive material lives and the number of places something can go wrong. It doesn't remove the need for careful key management or access controls, though. Hardware isolation is one layer in a stack, and the rest still needs design work.

What to watch next

Several questions remain open. Google's published figures for the 8i Max are relative to the 8i, so anyone sizing a deployment will want absolute throughput, latency and memory numbers for their own models. The 8tx's value depends on how its enclave performs under real workloads, how it handles attestation, and how it fits with existing identity and data-governance tooling. None of that is settled by a product announcement.

Cost is the other variable. Denser racks can lower floor space and power per unit of compute, but the total cost of a deployment depends on pricing, utilization and how much of a long context a given application actually needs. A 1-million-token window is only worth paying for if the application uses it. Many agent workflows will get more value from better retrieval and smaller windows, so the 8i Max will fit some workloads far better than others.

Still, the direction is clear. Google is treating long context and confidential inference as hardware problems rather than purely software ones, and it's building chips around each. If the 8i Max delivers on its memory claims and the 8tx enclave holds up under scrutiny, the choice for teams running agents on sensitive data may come down less to which model to use and more to which system will keep the data where it belongs.