Broadcom has introduced VMware Private AI Cloud, a proposal that brings together private cloud infrastructure, inference services, AI agents, and traditional enterprise applications on top of VMware Cloud Foundation (VCF). The idea is to let organizations run models close to their data, control GPU and token usage, and apply security and governance policies without building an AI platform that’s completely separate from their existing infrastructure.
VMware Private AI Cloud in 20 seconds
- VMware Private AI Cloud is built on VMware Cloud Foundation 9.
- It combines virtual machines, Kubernetes, inference, and AI agents.
- It includes VMware AI Factory to automate deployment from hardware to models.
- VCF supports more than 150 models and different accelerators.
- Broadcom is adding specific controls for AI agents, data, and applications.
The announcement, made during VMware Explore 2026, brings together several of the AI-related updates Broadcom has introduced under a single architecture. VMware AI Factory provides the automation layer; AgentMinder controls agent actions; Tanzu handles applications and data; while vDefend and Avi Load Balancer add security mechanisms for these new workloads.
The idea tying all these pieces together is fairly simple: bring the model to the data instead of moving the data to an external service.
For certain organizations, that difference can matter when models need to access internal documentation, code, databases, or information subject to regulatory restrictions. Running inference inside controlled infrastructure doesn’t automatically solve every security or compliance problem, but it does let a company define more precisely where data is processed and which systems can use it.
Private cloud starts managing GPUs, models, and tokens too
VMware Cloud Foundation has spent years providing infrastructure for virtual machines and enterprise applications. Broadcom is now trying to extend the concept so the platform treats AI as just another category of production workload.
That means managing resources that, until recently, weren’t part of the day-to-day operation of many data centers.
GPUs are one of them.
VCF supports accelerators and processors from different vendors, while Broadcom works with server vendors to offer compatible configurations. The company wants to avoid every AI project ending up with its own isolated set of hardware.
Capacity can be shared across departments, applications, and models.
Multi-tenant model sharing lets different business units, for example, use a single instance of a model while keeping separate spaces, instead of reserving memory and GPUs to repeatedly deploy the same architecture.
Broadcom is also increasing visibility into GPU and vGPU utilization and is adding metrics tied to tokens, latency, compute, and memory.
This is where one of the terms the company keeps using throughout VMware Explore 2026 comes in: AI tokenomics.
In public AI services, cost is usually expressed directly in terms of tokens or requests. When the model runs on a company’s own infrastructure, the bill is spread across servers, accelerators, storage, power, licenses, and staff.
The token still has a cost, but it’s less visible.
Measuring how many tokens a given infrastructure produces, and what share of CPU, GPU, and memory it consumes, makes it easier to compare different configurations.
Broadcom also credits VCF 9 with features like NVMe memory tiering and cluster-wide storage deduplication to reduce hardware requirements. The actual benefit will depend on the specific workload, data set, and configuration used.
Private cloud isn’t necessarily cheaper than an external API either. For small, variable, or experimental projects, paying purely for usage can be more efficient than buying accelerators that end up partly idle.
The economics shift when there are steady workloads, enough users, and high hardware utilization.
VMware AI Factory connects the physical server to the first model
The operational foundation of VMware Private AI Cloud is VMware AI Factory, also announced by Broadcom at VMware Explore.
This layer automates the process from preparing servers all the way to deploying inference services.
Broadcom claims certain installations can go from needing weeks to complete that journey to doing it in hours. That claim comes from the company and isn’t a guaranteed time for any given data center, since each environment can have different networking, storage, firmware, security, and hardware requirements.
The announced integration with MetalSoft aims to extend this automation down to bare-metal servers.
VCF will be able to provision or reimage physical machines from different vendors through its management console and then coordinate the deployment of vSphere, vSAN, Kubernetes, and the components GPUs require.
The company is also expanding its acceleration options.
Broadcom and AMD are working on a VMware AI Factory configuration based on AMD Instinct and ROCm, while VCF keeps support for other CPU and GPU architectures.
Models can run on top of that infrastructure.
Broadcom says VMware Cloud Foundation supports more than 150 open and commercial models and has announced specific validations for NVIDIA’s Nemotron 3, Google DeepMind’s Gemma 4, NEC’s cotomi, and Z.ai’s Qwen and GLM 5.2.
The intent is to offer them internally through a Model as a Service approach.
Instead of every development team having to install and maintain its own LLM, the platform team can provide a managed catalog. Applications would consume those models through internal services governed by common policies.
The upcoming AI Gateway will extend this approach through an interface for local and external models, adding application authorization, usage limits, and model-selection mechanisms.
The result points toward hybrid architectures.
A company could use a small model hosted locally for numerous internal queries, reserve a larger model for certain processes, and turn to a public provider when it needs capacity it doesn’t have available in its own infrastructure.
Agents force a rethink of private cloud security
The most novel part of VMware Private AI Cloud probably isn’t running models, but managing agents capable of acting on other systems.
A model that only generates text has a relatively contained risk surface. An agent can query APIs, read data, use tools, modify applications, or run code.
Broadcom is adding specific controls for that situation.
AgentMinder gives agents identities and ties their authorization to a mission, approved tools, and the resources they can use.
Operations are checked at runtime, so holding a valid identity at the start doesn’t mean permission for any later action.
Tanzu Platform takes another precaution: a deny-by-default architecture.
Agents don’t get access to APIs, networks, MCP (Model Context Protocol) servers, or the internet unless it’s explicitly granted. Broadcom is also introducing an isolated credential store so agents themselves don’t have direct access to secrets that could end up exposed through a malicious instruction.
This approach specifically addresses the prompt injection problem.
An agent can process a document, email, or page containing instructions designed to alter its behavior. If it has visible credentials and broad permissions, the potential impact grows.
Keeping it from seeing credentials and externally limiting which tools are available reduces some of that exposure, though it doesn’t eliminate the risk.
Broadcom is also preparing Secure AI Sandboxes, virtualized environments where code dynamically generated by agents can run without giving it direct access to the rest of the infrastructure.
vDefend, for its part, will extend its Zero Trust mechanisms to agentic workloads.
The company says it will be able to identify agent-related components through continuous traffic analysis, spot unauthorized use of AI tools, and apply AI-generated signatures for intrusion detection and prevention systems (IDPS).
Some of these capabilities are announced for future releases and shouldn’t be read as available today.
Avi Load Balancer will also expand its protections to control which tools agents can use, spot anomalous behavior, and limit attempts to extract sensitive information.
This combination shows an important difference from the first generation of enterprise AI platforms.
The concern is no longer just installing a model inside the data center. The platform needs to control who can use it, what data it receives, what tools it can invoke, and what happens when an agent tries to take an action.
Broadcom is also connecting Tanzu with data preparation for AI. Data owners will be able to build data products from structured and unstructured sources and publish them as governed services that applications and agents can consume.
That makes it possible to separate access to data from direct access to the original systems.
An application could receive information prepared specifically for its function without necessarily having permissions over the entire enterprise database.
VMware Private AI Cloud is thus an attempt to expand the traditional idea of private cloud. The platform still hosts virtual machines, Kubernetes, and conventional applications, but it now adds models, GPUs, agents, data products, and token consumption as resources that also need to be managed.
How valuable this approach turns out to be will largely depend on whether companies can operate these workloads without creating yet another layer of complexity.
Broadcom is betting on integrating them into the tools VCF already uses, rather than building a completely separate infrastructure for AI.
That may be one of the important debates for enterprise data centers in the coming years. Running AI on a company’s own infrastructure is already technically possible. The challenge is shifting toward how to do it in a repeatable, governed, and economically justifiable way as models start becoming part of production applications.
Frequently asked questions
What is VMware Private AI Cloud?
It’s Broadcom’s approach for running and managing AI inference, models, and agents inside VMware Cloud Foundation alongside virtual machines, Kubernetes, and other enterprise applications.
How does VMware Private AI Cloud relate to VMware AI Factory?
VMware AI Factory is the automation foundation of VMware Private AI Cloud. It handles the deployment and operation of the infrastructure needed to go from physical servers to AI model services.
Which AI models does VMware Cloud Foundation support?
Broadcom says VCF can run more than 150 models and has announced validations for Nemotron 3, Gemma 4, cotomi, Qwen, and GLM 5.2, among others.
Does VMware Private AI Cloud keep data from leaving the company?
It lets organizations deploy models and applications inside private infrastructure, which makes it easier to keep certain data within that environment. However, actual data residency will depend on the architecture, applications, models, and external services each organization decides to use.
