[DigitalToday reporter Chi-gyu Hwang] Google formally launched 'GKE Agent Sandbox' in May and also unveiled the 'Agent Substrate' project.

Silicon Valley technology analyst Janakiram MSV (자나키람 MSV) wrote via The New Stack that Google's move can be read as effectively acknowledging that Kubernetes is not a suitable control layer for AI agents.

Agent Sandbox provides a secure environment to run untrusted code. Agent Substrate adds a separate scheduling layer that bypasses the Kubernetes API server. That is because the API server was not designed from the start to fit an agent-based approach.

Agents are stateful sessions that sit idle most of the time, briefly become active to run code, and then quiet down again.

Because the code agents run is generated by AI on the spot, hosts must treat it on the assumption that it is risky.

Janakiram MSV said Kubernetes was built to manage a fixed number of long-running replicated services, making it a poor fit for agents that constantly generate fine-grained scheduling events.

Amazon Web Services, Microsoft and Google all agree that sessions are a new computing unit, but they differ on how to isolate them.

Agent Sandbox provides gVisor-based kernel isolation by default and applies a default-deny network policy. It also offers a pluggable interface that can be swapped for Kata Containers when full isolation is required.

Agent Substrate reuses the sandbox security runtime and snapshot functions. It is operated by placing a small control system dedicated to agents alongside a Kubernetes cluster.

Agent Substrate and Kubernetes are not in a competitive relationship. A sandbox is suitable for running untrusted code, Substrate for handling large numbers of idle sessions, and Kubernetes for equipment provisioning. In real deployments, the three are often used together.

The key question is who controls the control layer. Janakiram MSV said the main point to watch is whether it will converge into a single open-source project, as container orchestration converged on Kubernetes, or whether fragmentation will recur as each hyperscaler rolls out its own approach.