Google announced the availability of Agent Substrate on Google Kubernetes Engine (GKE). Agent Substrate is an open-source, secure-by-default agent execution runtime engineered to run millions of sandboxes at 10x higher density than standard container runtimes. The announcement lists sub-500ms resume operations, over 500 suspend/resume activations per second, and a native zero-trust kernel with network isolation as headline capabilities.

The post frames the problem as scaling an agent platform from a local prototype to hundreds of thousands of concurrent, long-lived agents that generate code and drive automated execution. It names four infrastructure constraints: opaque trust boundaries, since models can generate and run arbitrary code and kernel-level isolation plus dynamic network controls are needed to avoid host escape, credential theft, and data exfiltration; tool access friction, since agents need full computer environments for CLI tools, headless browsers, and filesystem workspaces; massive bursts, since harnesses, benchmarks, and reinforcement learning rollouts can produce thousands of sandboxes per minute and cause disk contention from repeated image decompression; and idle compute, since autonomous agents are dormant most of the time while waiting on inference or tool responses.

Agent Substrate avoids the trade-off between isolation and latency by decoupling agent execution from machine management. It offers security by default via hardware-isolated Cloud Hypervisor microVMs or gVisor sandboxes, with egress proxies enforcing granular network policies and injecting credentials outside the reach of agents; sub-second activation by dispatching agents onto pre-warmed workers without container boot delays; suspension of idle actors in hundreds of milliseconds; and portability across any Kubernetes cluster and agent framework, including Claude Code, OpenClaw, and Hermes.

Four architectural principles guide the design. First, secure by default at the kernel and network: teams choose Cloud Hypervisor microVMs (full Linux kernel compatibility) or gVisor with even lower overhead, and an integrated gateway controls egress and ingress. Second, a control plane and data plane built for low-latency activation: the control plane handles data-aware scheduling, while the data plane performs hundreds of suspend/resume operations per second on pre-warmed workers, with snapshots written to local disk and Google Cloud Storage; a sandbox resumes in under 500ms and can be immediately re-suspended once idle. Third, high-density active-only compute economics: suspending agents releases RAM and CPU, allowing over 1,000 dormant agents per host and 10x compute density; an optional Filestore agent volume controller provides persistent NFS storage for workloads needing shared filesystems across turns. Fourth, Kubernetes as a foundation: Kubernetes manages machines, self-healing nodes, autoscaling, and worker pod lifecycles, while the purpose-built data plane handles high-frequency suspend-resume, avoiding the seconds of delay added when routing each sub-second tool invocation through the standard Kubernetes Pod lifecycle; existing primitives like Agent Sandbox and kernel-isolated Pods continue to work side by side.

On GKE specifically, custom ComputeClasses dynamically manage machine pools across shapes and families, including spot and on-demand pools, with native support for Google Axion Arm processors that the post says deliver up to 30% better price-performance for sandbox workloads compared to competitive cloud offerings. Optional Filestore agent volumes attach and detach NFS mounts in milliseconds and provide Read-Write-Many access and POSIX-compliant file locking for safe multi-agent collaboration.

The post names Nous Research, the team behind the Hermes Agent, as an early design partner; it cites Hermes as the number-one AI agent globally by OpenRouter usage across productivity, coding, CLI, and personal agents. Hervé Bizira, Nous Research‘s Chief Business Officer, is quoted saying Agent Substrate addresses per-agent isolation and extensible access control at the platform layer while preserving compute resources. Agent Substrate is open source and available to all GKE customers for non-production workloads; GA support for production is available via allowlist.