Google released two infrastructure projects in May 2026 that reveal where AI workloads are breaking Kubernetes: Agent Substrate and Agent Sandbox. These tools show that traditional container orchestration wasn't built for how AI agents actually behave.
What Changed
Google made GKE Agent Sandbox generally available in May 2026, alongside Agent Substrate. These aren't just improvements to Kubernetes. They're purpose-built runtimes addressing a fundamental mismatch: Kubernetes optimizes for long-running services, but AI agents create bursty, stateful workloads that sit idle most of the time.
Agent Substrate reports 30x or more oversubscription with sub-second activation. Agent Sandbox can allocate 300 sandboxes per second per cluster, with 90% of allocations finishing in 200 milliseconds. These numbers highlight the gap between what Kubernetes delivers and what AI workloads need.
Key Findings
Kubernetes can't efficiently pack idle agents. Running AI agents on standard Kubernetes means reserving resources for workloads that might execute once an hour. Kubernetes wasn't designed for this pattern. It expects containers to consume resources consistently. Agent Substrate allows massive oversubscription, letting you run 30 times more agents on the same hardware because the system knows most won't activate simultaneously.
Model-generated code creates new execution risks. When an LLM writes code to fulfill a user request, you're executing untrusted input. This isn't like running vetted application code. Agent Sandbox provides gVisor-based isolation for this scenario, creating a security boundary between the generated code and your infrastructure. If you're running agents that generate and execute code, you need this level of isolation. Standard container security won't suffice.
Sub-second activation becomes critical at scale. The 200-millisecond allocation time for Agent Sandbox isn't just about speed. It's about making the security overhead invisible to users. When an agent needs to execute code, you can't introduce multi-second delays for sandbox provisioning. That latency compounds across every agent interaction.
Resource efficiency directly impacts your compliance posture. If you're running AI agents that process customer data, PCI DSS v4.0.1 Requirement 3.5.1 requires you to minimize data retention periods. When your infrastructure can't efficiently pack workloads, you'll keep more data in memory longer than necessary because spinning down and reactivating is too expensive. Agent Substrate's oversubscription model lets you deactivate idle agents without sacrificing response time.
What This Means for Your Team
You're probably running Kubernetes for your containerized applications. That's fine for web services, APIs, and batch jobs. But if you're adding AI agents to your stack, you need to evaluate whether Kubernetes will handle them efficiently.
Ask yourself: are your agents long-running services or event-driven executors? If they're event-driven (processing user requests, running scheduled tasks, generating reports), Kubernetes will waste resources. You'll either over-provision to handle bursts or under-provision and face slow response times.
The security implications are more immediate. If your agents generate code based on user input or model output, you're running untrusted code. Your current container isolation might not provide adequate boundaries. ISO 27001 Control 8.31 requires separation of development, test, and production environments. Model-generated code blurs this line because you don't control what gets executed until runtime.
For compliance teams: SOC 2 Type II CC6.6 requires logical access controls that restrict access to system resources. When agents generate code dynamically, your access control model needs to account for code that didn't exist when you designed your security boundaries. Agent Sandbox's gVisor isolation provides this separation, but you'll need to document how it fits into your control environment.
Action Items by Priority
Immediate: Audit your current agent workloads. Identify which services generate or execute code based on model output. These are your highest-risk workloads. Document what isolation mechanisms you're using today. If you're relying solely on container-level isolation, you have a gap.
This quarter: Benchmark your resource utilization. Track how much CPU and memory your agent workloads actually consume versus what you've allocated. If you're seeing utilization below 30% during idle periods, you're a candidate for specialized agent runtimes. Calculate the cost difference between your current approach and a 30x oversubscription model.
Next quarter: Test sandbox allocation latency. If you're evaluating Agent Sandbox or similar tools, measure allocation time under load. You need to know whether you can provision isolated environments in under 500 milliseconds. Anything slower will degrade user experience for interactive agents.
Ongoing: Map agent security to your compliance framework. Update your system security plan to address model-generated code execution. If you're subject to NIST 800-53 Rev 5, review AC-6 (Least Privilege) and SC-7 (Boundary Protection) to ensure your controls account for dynamically generated workloads. Document how your agent runtime provides separation of duties.
Strategic: Evaluate whether you need a dedicated agent runtime. If you're running more than a handful of AI agents, calculate the total cost of ownership for Kubernetes versus a specialized runtime. Include infrastructure costs, operational overhead, and security tooling. The 30x oversubscription ratio suggests significant savings are possible, but you'll need to weigh that against the operational complexity of running multiple orchestration platforms.
