September 21, 2026
An agent sandbox comes up from a manifest, like a pod in Kubernetes: Google opens the AX runtime
AX gives an agent an isolated sandbox, an outbound-host allowlist, and a ready-made repository — through four manifests instead of code.
The first task in AX fits into four commands: apply, watch, ssh, suspend.
This is Google's open runtime for agents. Untrusted code goes into a sandbox with CPU and memory limits rather than onto a work machine.
Four primitives. Task describes the sandbox itself with its limits. Workspace provides ready-made git repositories, MCP servers, and skill packages; Gateway maintains an outbound-host allowlist; Model sets the provider and model with keys from a Kubernetes secret.
The CLI deliberately mirrors kubectl: apply, get, describe, watch, delete. Manifests use apiVersion ax.io/v1alpha1, and the demo.sh script from the repository runs the full lifecycle.
Installed with one command. `go install github.com/google/ax/cmd/ax@latest` places the ax binary in $(go env GOPATH)/bin; that directory must be kept in PATH.
Then the infrastructure begins. You need a Kubernetes cluster, ko, your own container registry, and the control plane is deployed with `make deploy AX_IMAGE_REPO=<your-registry>` — the command installs Redis and images in the ax-system namespace. The default example uses Google's gemini-3.8-flash, but the Model manifest can supply any provider.
AX has another layer underneath: the cluster must have access to the Agent Substrate Control API. Google already has that layer in GA, and the company claims 300 sandboxes per second per cluster for GKE Agent Sandbox.
Previously, this was a blog announcement. On 21.05.2026, Google engineers Jaana Dogan and Ethan Bao showed Agent Executor in preview: an event log and snapshots instead of a lost session, resumption from the last sequence after a disconnect, and branching trajectories from a checkpoint. The runtime now has a binary and manifests, while the google/ax repository under Apache 2.0 had reached 2999 stars and 147 forks by 21.09.2026.
The runtime is described as harness-agnostic. It works with LangChain and LangGraph, Agent Development Kit, the Agent2Agent protocol, and custom agents.
The Hacker News post about AX received 100 points and 36 comments (20.09.2026). People debate the framework's YAML-heavy design and confuse AX with the identically named Ax, the axllm.dev framework.
Until the stable release, ax.io/v1alpha1 manifests will break — Google says so in the README.
