Three projects, one layer each
On November 5, Google announced on its Open Source Blog and the Google Cloud Blog that it is donating Agent Substrate, gVisor and OpenRL, three open-source projects that started at Google, to the Cloud Native Computing Foundation (CNCF). All three were accepted into the CNCF Sandbox last month and are now onboarding community maintainers and independent build infrastructure, with gVisor on a path toward Incubation. Google presents them as one stack for agent infrastructure: gVisor isolates untrusted code, Agent Substrate runs stateful agents, and OpenRL runs reinforcement-learning post-training on Kubernetes.
On the same day, Agent Substrate reached 1.0 and became generally available on Google Cloud as Agent Substrate on GKE; the open-source code can also run on any conformant Kubernetes cluster.
Agents spend most of their time waiting
Google's starting point is that during an interactive session an agent spends 90% to 95% of its time waiting on model inference, external APIs or human review. Keeping a dedicated Pod running for every agent ties up memory and CPU, while scaling to zero means re-cloning repositories and reinstalling packages, pushing wake-up latency past 20 seconds.
Agent Substrate separates state from compute. Actors hold each agent's memory, files and discrete identity; Workers are reusable sandbox Pods drawn from a warm pool; and Gateways enforce inbound and outbound access by Actor identity and inject secrets, keeping sensitive keys out of the agent environment. When an agent goes idle, its state is snapshotted to tiered storage and the Worker returns to the pool; when the next request arrives, the Actor is restored on any free Worker in under 500 milliseconds. Google says 1.0 can take production workloads across millions of sandboxes at 10x the density of standard container runtimes, with more than 500 suspend and resume activations per second; these are Google's own figures. Since public development started in May, the project has grown to more than 100 contributors, and Nous Research is building Hermes Enterprise on it.
Why hand it to a neutral foundation
gVisor is a userspace application kernel written in Go that Google open-sourced in 2018. It intercepts system calls in userspace so sandboxed code never talks directly to the host kernel. Google says Anthropic and OpenAI use it to contain code execution and that Modal and Snowflake run their execution sandboxes on it; Ant Group, Modal and Tines are joining as maintainers. Google also gives a concrete reason for the move: sandbox providers all carry host kernel patches that bring gVisor's I/O close to native Linux, but upstream Linux maintainers declined to merge them while a single vendor owned the project, and neutral governance opens a path to upstreaming them.
OpenRL only appeared as a research preview in February. It offers four primitives, sample, forward_backward, optim_step and save_state, through a Tinker-compatible API, has been validated with Gemma and Qwen, and still has TPU support on the roadmap. Google says it is by far the newest of the three and is being donated early so chipmakers, inference engines and model developers can shape it before the design hardens. For teams running coding agents or RL evaluations at scale, Agent Substrate is worth testing on their own workloads; the performance numbers so far come only from Google.
via: Google Open Source Blog: Sandboxing Untrusted AI Agents at Scale, Google Cloud Blog: Powering open infrastructure for autonomous agents