Google wants to emulate one of its biggest ever open-source success stories, donating three core AI agent infrastructure projects to a neutral foundation in the hope they become industry standards, just as Kubernetes did for containers.
In a blog post published on Thursday, Drew Bradstock, VP of product management, Kubernetes and orchestration at Google, confirmed that the company is donating gVisor, Agent Substrate, and OpenRL to the Cloud Native Computing Foundation (CNCF).
The move comes amid growing concerns about the security of autonomous AI agents, particularly their ability to execute code and interact with external systems. In July, models undergoing a cybersecurity evaluation at OpenAI escaped their restricted environment and breached Hugging Face’s production infrastructure, highlighting the challenges of keeping increasingly capable agents contained.
“We believe that these donations will accelerate the development and adoption of agentic workloads through these projects similarly to what we saw with Kubernetes.”
Bradstock, for his part, argues that addressing such security risks, while making agents more economical to run and train, requires closer cooperation across the various facets of the underlying software and hardware infrastructure. And he believes that putting its technologies under neutral governance could encourage the kind of industry-wide participation that helped Kubernetes become ubiquitous.
“We believe that these donations will accelerate the development and adoption of agentic workloads through these projects similarly to what we saw with Kubernetes,” Bradstock writes.
Why Google’s giving away gVisor
By way of a brief recap, Google open-sourced gVisor in 2018 to improve container security. As The New Stack explained later that year, the technology uses a lightweight kernel running in user space to intercept application system calls, providing an additional layer of isolation between containers and the underlying host operating system. This makes it particularly useful for running untrusted code, including code generated by AI agents.
The technology is used by major AI companies, including Anthropic, which runs code generated by Claude inside gVisor containers on its web platform; and OpenAI, which uses it to isolate code execution. In a security report published just on Wednesday, OpenAI cited sandboxes such as gVisor and Firecracker as important for limiting the damage from exploited Linux kernel vulnerabilities.
The donation itself has been in the works for several weeks. The CNCF accepted gVisor’s application in late September, with Google publicly announcing its plans a few days later. The project’s onboarding process began last week, ahead of Thursday’s broader announcement incorporating all three projects.
In its original October announcement, gVisor contributors and Google software engineers Etienne Perot and Jing Chen sought to reassure users that the company remained committed to the technology. With demand for affordable, secure sandboxes growing, they argued that independent governance could encourage wider participation and adoption, both within Google and beyond.
“We (the gVisor contributors at Google) have been pushing for this move internally with the expectation that this will accelerate gVisor’s growth and adoption both within and outside of Google, in a similar manner as what has happened with Kubernetes,” they wrote at the time.
“We have been pushing for this move internally with the expectation that this will accelerate gVisor’s growth and adoption both within and outside of Google.”
Agent Substrate addresses a different challenge: how to run large numbers of autonomous agents without wasting computing resources while they sit idle. As The New Stack reported in July, the project introduces an additional runtime layer on top of Kubernetes, allowing agents to be suspended when inactive and resumed when needed, without repeatedly creating and destroying Kubernetes Pods. It does this by separating an agent’s persistent state from the computing resources executing it, with gVisor providing one of the available options for securely isolating that execution.
As part of the announcement this week, Google officially released Agent Substrate 1.0 and made it generally available on Google Kubernetes Engine (GKE).
OpenRL, meanwhile, focuses on reinforcement learning, allowing developers to fine-tune AI models on their own Kubernetes infrastructure. Publicly introduced in June, the project coordinates the training and evaluation processes used to improve models. It also integrates with Agent Substrate, allowing training exercises to run inside isolated environments that can be secured using gVisor.
Collectively, the three projects address the execution, security and training requirements of autonomous AI agents.
Going vendor neutral
The move to CNCF governance should also change how gVisor is developed and maintained. In their October announcement, Perot and Chen outlined plans to move the project’s development and testing infrastructure outside Google, give external maintainers permission to merge code, and introduce a governance model that prevents any single company from exercising unilateral control.
Notably, in the project’s CNCF application submitted through GitHub in September, Perot identified a divide among gVisor’s existing adopters. At one end are major technology companies such as Anthropic and OpenAI, which can invest in adapting the technology to their needs; at the other are specialist startups whose businesses depend heavily on secure code execution. The opportunity, Perot suggested, lies in reaching the much broader market between those two camps.
Such companies “don’t have the resources to invest specifically into security but would happily adopt an off-the-shelf, widely-available sandboxing runtime,” Perot wrote in the application.
There’s also the question of why more cloud providers haven’t integrated gVisor into their commercial offerings. In their October announcement, Perot and Chen noted that Google, DigitalOcean and Modal were among the few providers selling general-purpose computing services powered by gVisor, despite evidence that customers were already installing the technology themselves on competing cloud platforms. The engineers suggested that concerns about Google’s control of the project could explain the discrepancy.
“The remaining explanation of the lack of direct integration is likely the project’s (pre-donation) governance risk,” they wrote.
But perhaps the most interesting obstacle concerns the Linux kernel itself. Google and other companies using gVisor maintain their own kernel modifications to improve its performance, particularly for I/O-intensive applications. Those improvements aren’t universally available, potentially leaving other users with slower execution environments.
Bradstock attributes the difficulty in getting those improvements incorporated into the mainline Linux kernel to gVisor’s hitherto Google-centric credentials.
“Upstream Linux maintainers declined to merge them while the project was owned by a single vendor.”
“Upstream Linux maintainers declined to merge them while the project was owned by a single vendor,” Bradstock writes.
There is also documented resistance to at least one earlier gVisor-related kernel proposal on technical grounds. As LWN reported in 2022, Linux kernel maintainers raised security and design concerns about a proposed performance improvement, including questions about its usefulness beyond gVisor.
While such interactions don’t focus on Google’s ownership as a reason for the objections, it’s clear that moving to CNCF governance should go some distance toward addressing concerns about single-vendor control.
And for Google, that effort now extends beyond gVisor. With Agent Substrate and OpenRL also moving to the CNCF, the company is hoping to establish a common foundation for autonomous agents.
“Vendor-neutral ownership lets cloud providers, hardware vendors, and independent software companies participate in the future growth of agentic workloads equally,” Bradstock writes.
The post Kubernetes, mark II? Why Google’s giving away gVisor, a code sandbox used by Anthropic and OpenAI appeared first on The New Stack.
