Google's Agent Substrate tackles the sandbox problem as AI agents become enterprise workloads

The rise of AI agents handling enterprise operations has made sandboxing a fundamental requirement rather than a secondary consideration. Agents that generate code, invoke tools or control browsers must operate within strict security boundaries. Yet those boundaries cannot drive infrastructure costs through the roof.

Google's response is Agent Substrate, an open-source initiative built atop Kubernetes that Google has contributed to the Cloud Native Computing Foundation alongside its gVisor sandbox technology. For the past 18 months, enterprise customers have consistently raised the same concern: they need to execute agent workloads with both security and efficiency on their existing infrastructure, according to Brandon Royal, product manager for AI agents and infrastructure at Google Cloud.

Any agent needs to be fully isolated. Whether it's accessing tools or using a computer or a browser, there needs to be some level of isolation, period, full stop.

Brandon Royal, Google Cloud

Royal and Benjamin Elder, staff software engineer at Google, discussed the project during an exclusive interview at KubeCon + CloudNativeCon NA, speaking with theCUBE Research's John Furrier and Rebecca Knight.

Agent sandboxing that locks down by default

Agent Substrate begins with hardened sandbox runtimes densely deployed across Kubernetes clusters. Every data flow moves through a policy enforcement layer that maintains awareness of identity, ensuring agents can only access resources they have been explicitly authorized to use, Elder explained. The system also protects credentials by delivering them at the moment of use rather than exposing them to the agent itself.

Don't expose credentials to the sandbox. Don't let the agent touch the credentials. Instead, when it requests to do something, you can make a decision about outside the sandbox.

Benjamin Elder, Google

Security represents only part of the challenge. Agents operating in groups frequently sit idle while waiting for language model responses or human input. Agent Substrate addresses this by snapshotting dormant agents out of active memory and CPU, storing them offline, and reactivating them when needed. This approach reclaims cluster resources that would otherwise remain allocated.

Should you be holding compute while you're getting coffee? Because you might come back in five minutes. You might come back in five hours or five days. We don't know.

Brandon Royal, Google Cloud

Google is already deploying the technology in production. Gemini Managed Agents now operates on Agent Substrate and benefits from the same density, efficiency and security protections, Royal noted. Google Cloud has also launched Agent Compute Engine to provide hosting for AI agents.

https://www.youtube.com/embed/AOSIU7_LVnU?feature=oembed

Agents are going to become the predominant workload in the future. Maybe it's six months, maybe it's 12 months, but we see this as a really big area of growth.

Brandon Royal, Google Cloud