GKE Agent Sandbox

Modern AI programs don’t just answer questions. They also write small programs and execute them immediately, for instance to check an invoice or analyze a spreadsheet. But this code hasn’t been reviewed by anyone by hand—it’s freshly created in the moment. Simply letting it run on your own server would be risky. GKE Agent Sandbox is a service from Google that provides exactly such a sealed-off play area for this purpose. There, the code runs with very few privileges and cannot access the data or systems next to it.

Why self-written AI code is dangerous

A language model generates text, and program code is also just text. The model has no understanding of consequences. It can accidentally write a command that deletes files or opens a connection to the internet. Such mistakes happen rarely, but with millions of requests per day, they are guaranteed to happen eventually.

On top of that, there’s an attack pattern called prompt injection. In it, someone hides an instruction to the AI inside a seemingly harmless webpage or email. If the assistant reads this text, it might mistake the instruction for a task from its user. It could then execute code that reads out the company’s credentials and sends them off.

A sandbox doesn’t solve this problem, it only limits the damage. The attacker ends up in an empty room with no access to anything of value. Experts call this principle damage limitation through isolation, similar to how fire doors confine a fire to one part of a building.

The double wall of container and micro-VM

The foundation is Kubernetes, a widely used system for managing many small program packages across many servers. Google operates it as a ready-made service under the name Google Kubernetes Engine, or GKE for short. The individual packages are called containers. A container normally shares the operating system kernel with all other containers on the same machine. If an attacker finds a vulnerability there, the entire server is open to them.

That’s why Agent Sandbox puts up a second wall in front of it. Each container gets its own, very small virtual machine with its own operating system kernel. Such micro-VMs start up in a fraction of a second, not in minutes like classic virtual servers. Technically, this is built on components like gVisor and Kata Containers, which Google has made freely available.

Lifespan also matters. A sandbox often exists for only a single task and is deleted afterward. Everything the code left behind disappears along with it. In addition, you can specify how much compute time and memory it’s allowed to use. This way, an infinite loop doesn’t bring down the server, only its own sandbox.

Who uses this and what it costs

You rarely encounter the service directly, since it runs in the background at companies. But you use it indirectly as soon as an AI assistant executes code for you. When a chatbot analyzes an uploaded spreadsheet and sends back a chart, a sandbox is involved somewhere. Tools that independently write and test software also need such environments.

The topic has been appearing more often in business news since 2025. Google, Amazon, and Microsoft are competing for the companies that want to deploy AI agents in production. Agents are AI programs that independently carry out multiple work steps in sequence. Whoever offers the safest and cheapest execution environment ties these customers to their cloud in the long run.

A common misconception is that a sandbox makes the AI itself safer. It doesn’t. The model can still produce nonsense or be deceived. The sandbox only ensures that this nonsense remains without consequences. Additional isolation also costs some computing power, which is why operators have to weigh security against cost.