Google is contributing two projects to the Cloud Native Computing Foundation as Sandbox projects: Agent Substrate, a Kubernetes orchestration layer for isolated AI agent sessions, and gVisor, its application kernel used for container sandboxing. The move was noted in SecurityWeek’s In Other News column.
Agent Substrate is built to run agent sessions in isolation and can reportedly restore saved agent state in under 500 milliseconds. The pairing is meant to give platform teams a common way to contain untrusted code that autonomous agents generate or run.
Placing the projects under CNCF governance could make them easier for other vendors and enterprises to adopt. Sandbox status is the foundation’s earliest maturity tier, so the projects will still need to prove themselves in broader use.