The company’s open-source donation addresses a growing engineering challenge: securely running thousands of autonomous coding agents without paying for idle computing resources.
Google is moving three AI infrastructure projects toward independent governance under the Cloud Native Computing Foundation (CNCF), seeking to establish an open foundation for running autonomous software agents securely and efficiently.
In its November 5 announcement, Google confirmed the donation of gVisor, Agent Substrate and OpenRL, following their acceptance into the CNCF Sandbox.
The company also announced that Agent Substrate had reached version 1.0 and become generally available on Google Kubernetes Engine (GKE).
The development highlights a significant shift in software infrastructure: autonomous agents require different computing resources from conventional applications, especially when they execute untrusted code and remain inactive between tasks.
Why AI Agents Challenge Traditional Kubernetes
Kubernetes was designed primarily to manage containerized applications that continuously execute workloads.
AI coding agents behave differently.
They may generate code, run tests, call external tools and then pause while waiting for model responses or human instructions.
Google says those pauses create unnecessary infrastructure costs when each agent retains dedicated computing resources.
Its Agent Substrate architecture separates an agent’s persistent state from the computing environment used to execute individual tasks.
The system stores an agent’s memory, files and identity independently, allowing execution resources to be shared across different sessions.
Google claims the architecture can restore suspended agents in under 500 milliseconds, with 10 times the density of conventional container arrangements.
These figures are company-reported performance claims and may vary across workloads.
gVisor Provides an Additional Security Boundary
The second component, gVisor, addresses the risks of executing code that has not been reviewed by a human developer.
Originally open-sourced by Google in 2018, gVisor uses a userspace application kernel to intercept system calls and reduce direct interaction between containerized applications and the host operating system.
This isolation is particularly important when multiple AI agents run code on shared infrastructure.
According to The New Stack’s November 6 analysis, written by Paul Sawers, the technology is already used by major companies, including OpenAI and Anthropic.
Google says gVisor supports millions of sandboxed workloads daily through its cloud infrastructure.
However, isolation does not remove every security risk. Organizations must still manage permissions, network access and potentially harmful actions performed through authorized tools.
Neutral Governance Could Reduce Vendor Dependence
Drew Bradstock, Google’s vice president of product management for orchestration and Kubernetes, framed the move as an opportunity to establish shared infrastructure for increasingly autonomous applications.
The company is also transferring development responsibilities toward community maintainers and independent infrastructure.
According to gVisor maintainers Etienne Perot and Jing Chen, external organizations including Modal, Ant Group and Tines have committed to participating in the project’s maintenance.
The transition could reduce dependence on Google’s internal development priorities.
Nevertheless, CNCF Sandbox acceptance represents an early project maturity stage, not certification that the software is suitable for every production environment.
The Next Competitive Battle Is Agent Infrastructure
In a CNCF technical analysis, ambassador Lin Sun distinguished secure agent execution from the additional challenge of running large numbers of agents economically.
The analysis describes how Agent Substrate allows inactive agents to share execution resources rather than retaining dedicated Kubernetes Pods.
The third donated project, OpenRL, addresses reinforcement-learning training and evaluation across large numbers of isolated environments.
For startups building autonomous software, these components could reduce the need to develop proprietary orchestration systems.
However, adoption will depend on operational reliability, compatibility and independently demonstrated cost savings.
Google’s broader bet is that the next generation of AI applications will require a shared infrastructure standard—and that controlling the ecosystem may matter more than controlling every component.
