{"slug": "agents-may-soon-be-the-main-workload-and-most-of-the-time-theyre-doing-nothing", "title": "Agents may soon be the main workload, and most of the time they’re doing nothing", "summary": "Google LLC donated its open-source Agent Substrate project, built on Kubernetes, to the Cloud Native Computing Foundation alongside its gVisor sandbox, Google Cloud product manager Brandon Royal said at KubeCon + CloudNativeCon NA. Agent Substrate routes all agent traffic through a policy and identity layer so an agent reaches nothing it hasn't been explicitly granted, injects credentials on the wire rather than exposing them to the sandbox, and snapshots idle agents out of memory and CPU to restore them later. Gemini Managed Agents now runs on Agent Substrate, and Royal said agents will become the predominant workload in \"maybe six months, maybe 12 months.", "body_md": "### Agents may soon be the main workload, and most of the time they’re doing nothing\n\nAs AI agents take on more enterprise work, agent sandboxing has become a basic requirement rather than an afterthought. Every agent that writes code, runs tools or drives a browser needs hard walls around it. Those walls also can’t come at the cost of runaway compute bills.\n\nGoogle LLC’s answer is Agent Substrate, an open-source project built on Kubernetes that the company [donated to the Cloud Native Computing Foundation](https://cloud.google.com/blog/products/containers-kubernetes/open-infrastructure-for-autonomous-agents-comes-to-cncf) alongside its gVisor sandbox. Customers have raised the same problem for the past 18 months: They need to run agentic workloads securely and efficiently on the infrastructure they already have, according to [Brandon Royal](https://www.linkedin.com/in/brandonroyal/) (pictured, left), product manager, AI agents and infrastructure, at Google Cloud.\n\n“Any agent needs to be fully isolated,” Royal said. “Whether it’s accessing tools or using a computer or a browser, there needs to be some level of isolation, period, full stop.”\n\nRoyal and [Benjamin Elder](https://www.linkedin.com/in/bentheelder/) (right), staff software engineer at Google, spoke with theCUBE Research’s [John Furrier](https://www.linkedin.com/in/furrier/) and [Rebecca Knight](https://www.linkedin.com/in/rebecca-m-knight-3667a94/) at [KubeCon + CloudNativeCon NA](https://www.thecube.net/events/linux-foundation/kubecon-cloudnativecon-na-2026), during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how agent sandboxing is central to Google’s open-source Agent Substrate. *(* Disclosure below.)*\n\n### Agent sandboxing that locks down by default\n\nAgent Substrate starts with hardened sandbox runtimes densely packed on Kubernetes clusters. All traffic passes through a layer that applies policy and understands identity, so an agent can reach nothing it hasn’t been explicitly granted, Elder explained. The project also keeps secrets out of the agent’s hands by injecting credentials on the wire.\n\n“Don’t expose credentials to the sandbox,” Elder said. “Don’t let the agent touch the credentials. Instead, when it requests to do something, you can make a decision about outside the sandbox.”\n\nSecurity is only half the equation. Agents in a swarm spend much of their time blocked, waiting on a large language model call or on a human to follow up. Agent Substrate snapshots those idle agents out of memory and CPU, stores them offline and restores them when they’re needed, freeing resources across the cluster, according to Elder.\n\n“Should you be holding compute while you’re getting coffee? Because you might come back in five minutes. You might come back in five hours or five days,” Royal said. “We don’t know.”\n\nGoogle is already building on the project. Gemini Managed Agents now runs on Agent Substrate and gets the same density, efficiency and security guarantees, Royal noted. Google Cloud also recently [introduced Agent Compute Engine](https://siliconangle.com/2026/10/22/google-cloud-introduces-agent-compute-engine-to-host-ai-agents/) to host AI agents.\n\n“Agents are going to become the predominant workload in the future,” Royal said. “Maybe it’s six months, maybe it’s 12 months, but we see this as a really big area of growth.”\n\nHere’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of [KubeCon + CloudNativeCon NA](https://www.thecube.net/events/linux-foundation/kubecon-cloudnativecon-na-2026):\n\n*(* Disclosure: Google Cloud sponsored this segment of theCUBE. Neither Google Cloud nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)*\n\n##### Photo: SiliconANGLE\n\n# A message from John Furrier, co-founder of SiliconANGLE:\n\nSupport our mission to keep content open and free by engaging with theCUBE community. **Join theCUBE’s Alumni Trust Network**, where technology leaders connect, share intelligence and create opportunities.\n\n- **15M+ viewers of theCUBE videos** , powering conversations across AI, cloud, cybersecurity and more\n- **11.4k+ theCUBE alumni** — Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network\n\n### Are you an AWS customer?  Support SiliconANGLE financially by buying your AWS services from our Marketplace portal page and links: [https://siliconangle.com/aws-marketplace/](https://siliconangle.com/aws-marketplace/)\n\n##### **About SiliconANGLE Media**\n\n[SiliconANGLE](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fsiliconangle.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=SiliconANGLE&index=9&md5=646b1b564e2259100a2b8638aab0a552),\n\n[theCUBE Network](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecube.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Network&index=10&md5=7de2a85f95ab4a4a495cede20b8cb1da),\n\n[theCUBE Research](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fthecuberesearch.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+Research&index=11&md5=7bb33676722925eb57d588ec343e4f6f),\n\n[CUBE365](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.cube365.net%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=CUBE365&index=12&md5=d310fb35919714e66ad8d42c9c0c1bc6),\n\n[theCUBE AI](https://cts.businesswire.com/ct/CT?id=smartlink&url=https%3A%2F%2Fwww.thecubeai.com%2F&esheet=54119777&newsitemid=20240910506833&lan=en-US&anchor=theCUBE+AI&index=13&md5=b8b98472f8071b23ebb10ab9a8dd0683)and theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.\n\nFounded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.", "url": "https://wpnews.pro/news/agents-may-soon-be-the-main-workload-and-most-of-the-time-theyre-doing-nothing", "canonical_source": "https://siliconangle.com/2026/11/11/agent-sandboxing-how-google-s-substrate-isolates-ai-agents-kubeconna/", "published_at": "2026-11-11 15:59:56+00:00", "updated_at": "2026-11-11 16:20:16.307862+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure", "ai-safety", "developer-tools"], "entities": ["Google LLC", "Google Cloud", "Agent Substrate", "Cloud Native Computing Foundation", "gVisor", "Kubernetes", "Brandon Royal", "Benjamin Elder"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/agents-may-soon-be-the-main-workload-and-most-of-the-time-theyre-doing-nothing", "markdown": "https://wpnews.pro/news/agents-may-soon-be-the-main-workload-and-most-of-the-time-theyre-doing-nothing.md", "text": "https://wpnews.pro/news/agents-may-soon-be-the-main-workload-and-most-of-the-time-theyre-doing-nothing.txt", "jsonld": "https://wpnews.pro/news/agents-may-soon-be-the-main-workload-and-most-of-the-time-theyre-doing-nothing.jsonld"}}