VMware wants to become the enterprise home for AI Agents

VMware all in on private AI cloud on VCF

At Explore 2026, the overarching announcement was VMware reshaping and expanding its product portfolio into VMware private AI cloud on VCF. VMware argued that it is cheaper to run production AI privately , instead of the public cloud alternative, using these three points:  

• Sweat the hardware you already own. Consider existing VCF licenses and underutilized servers, NVMe memory tiering as a lower-cost second memory tier, AMD and Intel accelerators in addition to NVIDIA and bare metal provisioning of heterogeneous servers through the MetalSoft integration.
• Keep GPUs busy and spend visible. Multi-tenant model sharing deploys a model once and shares it across tenants. Token-level metering attributes AI spend per team instead of the unpredictable per-call API bills that pushed many organizations to rethink public cloud AI spend in the first place.
• Stop moving data. AI-Ready Data Foundations in Tanzu prepare, govern and publish enterprise data in place, avoiding the round trip through cloud services. 

While these are interesting value propositions, it is critical to remember that the savings mechanisms live inside the VCF subscription that customers already pay for, while nearly every new AI capability announced this week arrives as a separately licensed add-on on top of it.

The private path also means owning the GPU problem instead of renting it. Procuring accelerators means long lead times, volatile pricing and capital tied up in silicon that the next generation devalues, while the public cloud sells the same GPUs by the hour with none of that exposure. Private inference only beats public cloud APIs when the GPUs stay busy. The cost case is real, but it is a case for spending more with Broadcom in exchange for spending less on hardware and tokens.

A platform for agents in 7 announcements

Beyond cost, one assumption runs through every layer of the new portfolio and matters most to those building on it: the next workload is an agent, and agents are untrusted by default. They get sandboxes instead of open networks, declared intentions instead of standing permissions and metered tokens instead of open-ended API bills. Seven announcements from Explore 2026 fill in this picture: 

1. VMware Private AI Cloud, the complete stack. Build, run and govern AI workloads on private infrastructure, positioned on VCF.

2. VMware AI Factory, the delivery model. Validated metal-to-model stacks with OEM/ODM partners (Dell, Cisco, Lenovo, Supermicro, AMD) plus a MetalSoft partnership that adds bare-metal provisioning to VCF Operations.

3. Model-as-a-service on VCF. vLLM as default runtime, 150+ open models, newly validated families including Nemotron 3, Gemma 4, Qwen 3.7-Max, GLM 5.2 and NEC cotomi.

4. AgentMinder, a new product, GA now. Identity, runtime policy and observability for AI agents across the enterprise.

5. Agentic AI security across vDefend and Avi. Discovery of MCP servers and LLMs on the network, shadow AI monitoring, blocking of unauthorized MCP tools.

6. TrueSource, a new open-source portfolio. Spring Enterprise plus verified Java, Python and Node.js artifacts and supported open-source data engines.

7. AI-ready Data Foundations in Tanzu Platform. Alongside agent sandboxes, buildpacks and an AI gateway: enterprise data prepared, governed and published for agent consumption. 

How much of the VMware Private AI Cloud stack is new? 

The cost and infrastructure pillars mostly shipped before the show.

NVMe memory tiering arrived with VCF 9.0 in June 2025. Cluster-wide dedupe, GPU and model metrics came with 9.1 in May 2026. Explore re-presents them as the foundation. AI Factory itself is the successor to VMware Private AI Foundation with NVIDIA, rebranded and opened up. What was an NVIDIA-only add-on becomes a multi-vendor program with AMD Instinct GPUs and ROCm, an OEM/ODM validation program including Dell day-zero server certification and the MetalSoft integration. 

What's genuinely new beyond that is the model service with its hybrid gateway, token metering, AgentMinder the TrueSource portfolio, and the MCP-aware security features in vDefend and Avi.

The Tanzu layer is itself a mix. Agent buildpacks and the agent foundation type arrived as tech preview in April 2026 and are now fully supported. Data Foundations folds last year's Tanzu Data Intelligence into the platform, and the new parts are the isolated credential store, agent templates with autonomy levels, the sub-agent marketplace with A2A support and MCP tool filtering with token quotas.

The infrastructure story is last year's release notes. The significant releases center around agents and models.

Below is how the seven announcements are relevant to the daily life of platform engineers and developers.

Tanzu sandboxes and AgentMinder

This approach keeps agents on a short leash.

The Tanzu sandbox is deny-by-default

This means no egress, no service access until each binding is granted. The credential store sits entirely outside the sandbox, so an agent authenticates tools without ever holding a secret. Broadcom's best engineering line of the week: you cannot leak a secret that you cannot read. AgentMinder gives every agent an identity, a declared mission and per-call policy evaluation, audited over OpenTelemetry and integrated through AuthZEN.

For developers. Prompt injection stops being a credential-theft vector, because there is nothing to steal. You keep your own harness (the loop that drives your agent and executes its tool calls), since Broadcom ships one but runs third-party harnesses side by side. The cost shows up when something fails. The agent is often just missing a permission, a binding never granted or a tool switched off, and debugging your code will not find that. Check platform policy first, and remember that every tool call is logged and evaluated against policy.

For platform engineers. The templates, the pre-approved skills catalog and the approval queue become yours to operate, and the queue is where this succeeds or fails. Picture the developer whose MCP server for a new SaaS tool sits in the approval queue for three sprints, so the agent runs on a laptop with a personal API key and a copied service account instead. Governance that frustrates builders manufactures exactly the shadow AI this same portfolio is sold to hunt.

AI-Ready Data Foundations in Tanzu

Data becomes a governed product.

The data half of the Tanzu release

Agents are only as good as the data they can reach, and most enterprise data is not ready for them. It sits in databases, document stores and S3 buckets, unlabeled and unprepared. Just pointing an agent at it burns tokens. The common fix so far was shipping that data to a cloud service for preparation and pulling it back. The Tanzu Data Foundations do the preparation in place: they ingest data where it lives, parse documents with OCR tuned to the document type, add a semantic layer so the agent reasons over meaning instead of raw text, and track where every piece came from and what it might be used for. The finished result is published to the platform's marketplace as a data product that agents discover and query through a built-in MCP server. The engine underneath is Greenplum with Iceberg interoperability.

For developers. You discover a governed data product whose owner has already decided what it might be used for, instead of pointing your agent at a raw file share and paying for the guesswork in tokens and hallucinations.

For platform engineers. Curation is a human bottleneck and it is now your backlog. Every data product needs an owner willing to publish and maintain it. Until that happens, agents starve inside a perfectly governed platform. Your job becomes recruiting data owners, and the Fall 2026 date gives you the runway. The pattern is worth stealing even if you never buy the product.

Model-as-a-service on VCF

The service combines a model catalog with metering.

Models become a catalog on VCF

Deploy once, share across tenants with private namespaces, and use vLLM as the default runtime. The detail that matters most surfaced in the analyst briefing rather than the press release: the AI gateway is hybrid, one API fronting the local catalog and cloud frontier models, with Google, Anthropic and OpenAI named.

For developers. You request an endpoint instead of filing a GPU ticket and you swap between a local Gemma and a frontier model without changing your integration. The trade is that your next project review includes a token line item with your name on it.

For platform engineers. You operate the catalog and the meter. You set the per-team quotas, you carry the utilization math -- private inference only beats cloud APIs when the GPUs stay busy, so expect pressure on which models teams may run -- and you answer the freshness question. Models move monthly and nobody published a validation lag or a GA date, so ask for both before you promise self-service to your developers.

TrueSource

In effect, dependency trust becomes a subscription.

TrueSource is the announcement with the shortest path to a build pipeline. Spring Enterprise plus SLSA Build Level 3 artifacts across Java, Python, and Node.js, with supported Postgres, RabbitMQ, MySQL, and Valkey. Available now, site licensed.

For developers. The mechanics are the point. CVE-only patches, delivered simultaneously across all supported release lines before the CVE goes public, applied without a version upgrade. That is the difference between a Tuesday dependency bump and an emergency sprint where a forced upgrade breaks two transitive dependencies.

For platform engineers. You own the subscription and the standardization decision. Pointing your artifact registry and base images at a single vendor's curated stream makes that vendor your supply chain trust anchor, and the Bitnami history shows such terms can tighten after you standardize. Read the license with the same care you read the code and keep an exit path from the curated stream to upstream.

vDefend and Avi

These controls turn MCP into a policed protocol.

The enforcement machinery lands on the platform team. The Tanzu gateway exposes an MCP server while switching off individual tools inside it, sets token quotas per team and journals every agent action. vDefend discovers MCP servers and LLMs on the network and flags shadow AI, and Avi blocks unauthorized MCP tool calls.

For developers. The MCP server you spun up last quarter without asking is about to appear on a security dashboard. Get it onboarded before the network blocks it, because on this stack an unregistered tool stops being invisible and starts being an incident.

For platform engineers. You now operate a new failure domain. A gateway that evaluates every tool call is a latency tax and a single point of failure, and an over-tight policy that denies a production agent mid-workflow is a brand-new outage class, so treat policy changes with the same rollout discipline as code. Then there is the boundary question nobody answered: VCF has an agent framework, Tanzu has sandboxes and a gateway, AgentMinder governs globally, and no published line divides them. The reconciliation work lands on you, so put the question to your account team before the architecture puts it to you in production.

Conclusion

Omdia data shows cost opened the evaluation door for two thirds of this market, while security ranks first and cost only fourth in choosing an alternative. 73% judge that alternative on AI workloads. These seven announcements answer the Omdia survey almost line by line. What they do not answer is packaging. Everything above arrives as a paid layer on top of VCF, much of it dated Fall 2026.

The agent contract is coming to your environment either way. Whether it shows up as an entitlement or as three new line items is the question to ask before your renewal, while you still have leverage.

Torsten Volk is principal analyst at Omdia covering application modernization, cloud-native applications, DevOps, hybrid cloud and observability.Omdia is a division of Informa TechTarget. Its analysts have business relationships with technology vendors.