Agent Substrate is an open-source, security-hardened runtime for running millions of AI agents on Kubernetes with zero-trust sandboxing. It is a low-opinion infrastructure layer — not an agent SDK — engineered so that large fleets of autonomous, mostly-idle agents can share clusters safely and cheaply. The project has earned about 5,700 stars on GitHub and is actively developed, with its latest updates in 2026.
Agent Substrate maps a large registry of stateful “actors” (agents and tools) onto a smaller pool of ready workers. Because agents spend most of their lives waiting on models, tools or humans, Substrate snapshots idle actors out of memory and restores them on demand — resuming in under 400 milliseconds and sustaining more than 1,500 activations per second, which enables 10x–30x oversubscription compared with standard containers. Every actor runs inside a VM-grade sandbox (gVisor or a Cloud Hypervisor microVM) with isolated compute, identity, networking and storage, and receives a short-lived SPIFFE cryptographic identity. Credentials never enter the sandbox: an egress gateway injects API keys and tokens into approved outbound requests outside it, so a prompt-injected or compromised agent has nothing to exfiltrate. Networking is default-deny, and policy enforcement is pluggable at the edge.
Agent Substrate is completely free and open source under the Apache-2.0 license. You run it on your own Kubernetes infrastructure.
Agent Substrate is for platform teams deploying large numbers of untrusted or autonomous agents who need strong isolation, credential safety and container-beating density on Kubernetes.