Google's new open-source sandbox stops idle AI agents from racking up your cloud bill

Google has open-sourced Agent Substrate, a project designed to securely and efficiently run AI agents on Kubernetes. The system uses hardened sandbox runtimes and a policy layer to isolate agents, preventing unauthorized access to tools or data. It also keeps credentials away from the agents themselves, injecting them only when needed for specific tasks.

The core innovation addresses a growing enterprise headache: AI agents in a swarm often spend most of their time idle, waiting for LLM calls or human input, yet still consuming costly cloud resources. Agent Substrate snapshots idle agents out of active memory and CPU, storing them offline until needed, which dramatically improves cluster efficiency and reduces runaway compute bills. This moves agent sandboxing from an afterthought to a foundational requirement for scaling AI workloads.