Securing AI agents with gVisor and microVMs in Kubernetes

On October 26, 2026, the Cloud Native Computing Foundation published a technical deep dive into securing autonomous AI agents within Kubernetes environments. The article details how kagent v1.0, combined with the Agent Substrate platform, addresses critical gaps in isolation, security, and scalability for agentic workloads. This approach moves beyond standard containerization to provide robust policy enforcement and resource management for production-grade AI systems.

What happened

Standard container runtimes often provide insufficient isolation for untrusted code. While Docker and similar engines create separate namespaces, they share the host kernel, leaving potential avenues for escape or lateral movement. In the context of AI agents, which may execute arbitrary tool calls, handle sensitive credentials, or process untrusted model outputs, this "flat" sandboxing model presents significant risk. Ingress and egress traffic are frequently wide open, and without strict network policies, an agent can communicate with any endpoint it chooses.

To address these vulnerabilities, the CNCF article introduces a layered architecture centered on kagent and Agent Substrate. Kagent serves as the runtime environment for declarative and bring-your-own (BYO) agents, supporting frameworks like LangGraph and ADK. Agent Substrate acts as the underlying infrastructure layer, providing the necessary sandboxing capabilities. Together, they ensure that agents operate within strictly defined boundaries, minimizing the blast radius of any potential compromise and ensuring high availability through efficient resource multiplexing.

The proposed solution requires both hardware and software-level isolation. It also mandates policy enforcement at the AI Gateway level to control traffic as it reaches its destination. By implementing these controls, engineering teams can prevent untrusted agent code from escaping into the host environment or compromising underlying infrastructure. This setup also allows for state snapshotting, enabling agents to resume operations seamlessly after interruptions.

How it works

Agent Substrate achieves isolation by running agents in Workers, which are Kubernetes Pods managed by a control plane called ateapi. The core innovation lies in how these Workers isolate the agent processes. For software-level isolation, the system uses gVisor. gVisor runs the workload in user space using a dedicated application kernel called Sentry. Sentry intercepts and handles system calls, preventing the agent from directly interacting with the host kernel. This adds a robust security boundary without the overhead of full virtualization.

For hardware-level isolation, Agent Substrate employs microVMs. These lightweight virtual machines run directly on physical CPU cores using hardware virtualization extensions. This approach ensures that even if the software isolation layer is breached, the agent remains confined within a virtualized hardware environment. The combination of gVisor and microVMs provides defense in depth, protecting both the kernel and the physical hardware from malicious or erratic agent behavior.

Kagent simplifies interaction with this complex infrastructure. Without kagent, developers would need to interact with Agent Substrate via low-level programmatic calls, such as curl requests to specific Actors. Kagent provides a user interface and declarative configuration options, allowing teams to manage agents using familiar Kubernetes patterns. It abstracts the complexity of the underlying Substrate, making it accessible for standard development workflows while maintaining strict security guarantees.

Key details

• Isolation layers: Agent Substrate uses gVisor for software-level isolation via the Sentry user-space kernel and microVMs for hardware-level isolation on physical CPU cores.
• Runtime management: Kagent v1.0 acts as the runtime, supporting declarative deployment and BYO agents from frameworks like LangGraph and ADK.
• Resource efficiency: Agents run as Actors that spin up only during active sessions and spin down afterward, optimizing hardware resource usage in multi-tenant environments.
• State management: The system supports snapshotting, allowing agents to save their state and resume operations from where they left off.
• Deployment model: Installation involves configuring kubectl-ate, installing Agent Substrate, and deploying kagent via Helm, which creates a default WorkerPool with two Workers.
• Configuration: Agents are defined using Harness and AgentTemplate Custom Resource Definitions (CRDs), specifying image paths, snapshot locations, and allowed templates.

Why it matters

For software engineers and technical leads, the shift toward agentic workflows introduces new operational challenges. Traditional microservices have predictable inputs and outputs, but AI agents can generate dynamic code, make external API calls, and access sensitive data based on natural language prompts. Without strong isolation, a single compromised agent could potentially access other services in the cluster or exfiltrate data. The architecture described by the CNCF provides a blueprint for mitigating these risks without sacrificing performance or developer velocity.

Furthermore, the ability to declare agent configurations and manage them through a UI aligns with modern DevOps practices. Teams can version control their agent definitions, apply consistent policies across environments, and monitor resource usage effectively. The session-based actor model ensures that costs remain manageable, as resources are only consumed when an agent is actively processing a request. This efficiency is crucial for scaling agentic applications to thousands of concurrent users.

Adopting this level of security also facilitates regulatory compliance. By ensuring that agent code cannot escape its sandbox and that all traffic is subject to policy enforcement, organizations can better demonstrate control over their AI systems. This is increasingly important as governments and industry bodies introduce stricter guidelines for AI deployment in critical sectors.

What you can do

• Set up a local Kubernetes cluster using Kind or Minikube to test the installation steps outlined in the CNCF guide.
• Install kubectl-ate to enable command-line interaction with the Agent Substrate control plane.
• Deploy kagent v1.0 via Helm, ensuring the substrateWorkerPool.create setting is enabled to provision default Workers.
• Define an AgentTemplate and Harness using the provided YAML examples, replacing placeholder image paths and snapshot locations with your own values.
• Use the kagent UI to create new agent templates and harnesses, verifying that Actors spin up only during active sessions.
• Review your current network policies and consider how gVisor and microVM isolation could complement existing security measures for AI workloads.