What Is Google AX?

Google AX, short for Agent Executor, is an open-source control plane for running agent workloads on Kubernetes. You write a Task in YAML, run ax apply, and AX starts it as an isolated sandbox, sets up its workspace, and lets you watch, suspend, resume, shell into, and delete it. Google's repository calls it an "open agentic orchestration runtime." The README calls it a "declarative orchestrator."

Is it an agent framework? No. AX doesn't decide how your agent reasons, plans, or calls tools. Your agent is a container image and a command. LangGraph, CrewAI, ADK, or your own loop runs inside an AX task.

What's Agent Substrate? The layer underneath. Substrate is a separate open-source project that runs the sandboxes, snapshots them, suspends and resumes them, and routes traffic to them. AX is the declarative API on top. AX can't run without it.

Does it need Kubernetes? Yes. The only documented install path is a Kubernetes cluster with Agent Substrate already installed, plus Go, kubectl, ko, and a container registry.

How mature is it? Very early. The latest release is v0.3.1 (September 25, 2026). The API is ax.io/v1alpha1, the README warns of "major breaking changes prior to a stable release," and v0.3.0, five days earlier, was a ground-up redesign. Google's launch post called it a "preview."

Who's it for right now? Platform and infrastructure teams that already run Kubernetes and want to experiment with large fleets of sandboxed, suspendable agent tasks. Not someone looking for a way to build one agent.

Framework, AX, or Agent Substrate?

Most "AX vs LangGraph" questions come from treating three layers as one. They stack:

So comparing AX with LangGraph or CrewAI as alternatives is misleading. You wouldn't pick one instead of the other. You'd pick a framework to write the agent and, if you need it, something like AX to run a lot of them in sandboxes. Google's launch post lists LangChain/LangGraph, ADK, and A2A agents among the things it's meant to run, and Substrate's README calls itself "framework and agent harness agnostic."

There's one wrinkle. AX does contain an agent: if a workspace binding has a plain-English goal, the task runner hands it to Google's Antigravity agent on first boot to install toolchains before your command starts. That's environment setup, not your agent's logic.

Where sandboxed execution, policy gates, and recovery sit in an agent's architecture

concept↗

What AX does today, and what's only documented

This is where most current coverage goes wrong. Several features appear in AX's README, docs, or website but aren't wired up in the code. We checked each one against the source at commit d0bc38b (main, September 26, 2026).

• IMPLEMENTED: the code does it. We haven't run it.
• DECLARED: the field or resource exists and AX accepts it, but no code path acts on it the way the docs describe.
• UNVERIFIED: the code exists, but a public report says it doesn't work and we can't confirm either way.
• REMOVED / ROADMAP: once shipped and now gone, or planned and not shipped.

If you read about AX before September 24, some of it has changed

AX has changed shape twice since launch, and most search results describe an older version.

May 20, 2026: the launch. Google's Cloud blog introduced Agent Executor as a runtime for durable agent execution, with an event log, session consistency through a single-writer design, client reconnection with response backfill, and trajectory branching. The v0.2.x README described "a distributed harness runtime" with a built-in Antigravity harness.

September 19–20, 2026: the redesign (v0.3.0). A single commit restructured AX into "a general-purpose orchestration layer for agentic tasks." It removed the legacy Python harness, the SQL event log, and the skill examples, moved task state into Redis, and introduced today's ax-server / ax-controller / ax-task-runner split. Most of the May feature list no longer describes the code.

September 24–25, 2026: Gateway removed (v0.3.1). The commit message says Gateway "introduced an unnecessary layer and architectural bifurcation between Agent Substrate and AX," and that AX will align with Substrate's own networking instead. AX went from four primitives to three.

AX and Agent Substrate

Substrate does the hard runtime work. Its README describes it as a runtime that maps "a larger set of 'actors'" onto "a smaller set of ready 'workers'," relying on agents being idle most of the time. It creates, destroys, suspends, and resumes actors, snapshots their memory and filesystem, assigns them to worker pods, and routes requests to them. It builds on Kubernetes pods and autoscaling rather than replacing them.

AX turns your YAML into Substrate calls. The controller reads Tasks from a Redis stream, creates a Substrate atespace (Substrate's tenant and naming boundary) and actor template, and starts or resumes an actor named after the task. Inside the sandbox, AX's own ax-task-runner runs as PID 1: it prepares the workspace, serves a small metadata endpoint, and starts your command.

A few details matter for operators:

• You can't use AX without Substrate. AX expects Substrate's Control API at api.ate-system.svc.cluster.local:443, and the README tells you to confirm it's up before deploying AX.
• Networking is Substrate's. Tasks don't get their own Kubernetes Service. Requests go through Substrate's atenet-router with an ate-target-actor: <atespace>/<task> header, and the router resumes a suspended actor before forwarding.
• You'll probably touch Substrate directly. Installing it, sizing worker pools, configuring snapshot storage, and, now that AX has no Gateway, setting egress policy are all Substrate tasks.
• Versions can drift. AX v0.3.1 pins a Substrate commit from September 11, 2026. Substrate v0.2.0, released September 25, lists breaking API and wire-protocol changes. Neither project says which Substrate release AX v0.3.1 supports.

The claims behind the architecture are vendor claims. Substrate's README says it runs sandboxes at "10x higher density than standard container runtimes," with "sub-500ms resume operations at over 500 suspend/resume activations per second." AX's README says it's "built to run billions of tasks per cluster." Substrate's demo video shows about 250 actors multiplexed onto 8 pods. We found no published benchmark for AX itself.

Kubernetes is required

There's no local, single-machine, or managed path in AX's docs. To try it you need:

1. A Kubernetes cluster with Agent Substrate installed. Substrate supports the latest stable Kubernetes release and the previous minor release. Its development quickstarts cover a local kind cluster and GKE; on GKE, some required beta APIs "can only be enabled at cluster creation."
2. Go, kubectl, ko, and a container registry your cluster can pull from.
3. The AX control plane, deployed with make deploy, which installs Redis and builds images with ko into the ax-system namespace. The Makefile builds the task runner for linux/amd64.
4. Your own snapshot storage. The shipped controller manifest points AX_SNAPSHOTS_BUCKET at a Google test bucket (gs://snapshot-substrate-test-ax-substrate/...), which you'll need to change. The docs don't mention it.

What that means depends on where you start. This part is our judgment, not Google's:

Maturity and release status

In practice, pin exact versions of both AX and Substrate, expect your manifests to need edits between minor releases, and read commits rather than release notes before upgrading. Google hasn't called AX production-ready, and the gaps above and below mean we won't either.

Security and isolation

AX's isolation comes from Substrate. What AX adds on top is thin, and in some places it weakens the picture.

Two open issues from outside researchers matter for anyone thinking about untrusted agents or multiple tenants:

Who should care now

These are our recommendations from the facts above, not Google's.

If you do run coding agents inside AX sandboxes, the controls that keep their output correct, like plan approval, deterministic checks, and factual QA, still belong in your agent's workflow. AX gives the agent a place to run, not a process.

The coding-agent workflow: scope, plan approval, bounded edits, deterministic checks, and factual QA

workflow↗

Trying it

If you've decided an evaluation is worth it, the order is: install Agent Substrate by following its README, confirm kubectl get svc api -n ate-system responds, install the CLI with go install github.com/google/ax/cmd/ax@latest, deploy the control plane from a clone of the repo with make deploy AX_IMAGE_REPO=<your-registry>, then ax apply -f examples/task.yaml. The AX README and demo.sh have the full commands. Before you apply the example, check the snapshot bucket, create the gemini-api-secret secret if you want workspace goals, and pin both projects to known versions.

What we haven't verified

• Whether AX v0.3.1 works with Substrate v0.2.0, or only with the September 11 Substrate commit it pins.
• What egress an AX task actually gets under Substrate v0.2.0 without a policy you create yourself.
• Whether workspace goals run at all, given the readiness bug reported in issue #375.
• Suspend and resume latency, task density, or throughput. We have no measurements, and neither project has published an AX benchmark.
• Whether ax-server is reachable from task sandboxes in a default install, as issue #376 says.
• When Google will call AX stable, or whether it will follow Substrate into a foundation.

How we separate vendor documentation, source reading, community reports, and our own inference

concept↗

Change log

Sources & Documentation

1. Google Cloud Blog: Introducing Agent Executor, Google's distributed Agent Runtime (May 20, 2026) — Launch post: "available now in preview," original feature list (event log, session consistency, connection recovery, trajectory branching), framework compatibility, relationship to Agent Substrate.
2. google/ax: README — Definition, breaking-change warning, three primitives, prerequisites, quick start, CLI. Apache 2.0.
3. google/ax: Releases — v0.1.0 through v0.3.1 (September 25, 2026); only v0.1.0 has release notes.
4. google/ax: docs/concepts.md, docs/sandbox.md, docs/networking.md, docs/roadmap.md, DESIGN.md — Task, Workspace, and Model; in-sandbox runner behavior and debug guest services; atenet-router routing; roadmap items; Redis-based architecture.
5. google/ax source at commit d0bc38b — Reconciler, Substrate client (gVisor sandbox, snapshot config), workspace setup, model client, API proto, server, and deploy/ax-controller.yaml, read to check which documented features are wired up.
6. google/ax commit 0b5427c: Remove Gateway concept (September 24, 2026) — Removes the Gateway resource and egress allowlist "to avoid bifurcation with Substrate."
7. google/ax commit dc4f36c: Restructure AX into a general-purpose orchestration layer (September 19, 2026) — The v0.3.0 redesign: removes the Python harness and SQL event log, moves state to Redis.
8. google/ax issues #363, #369, #371, #375, #376 — Community reports: git argument injection, unapplied resource limits, undocumented-provider mismatch, workspace-goal readiness bug, unauthenticated control plane.
9. agentexecutor.io — Google's AX site; still lists Gateway among four primitives as of September 26, 2026.
10. agent-substrate/substrate: README — What Substrate is, density and resume claims, framework compatibility, pre-1.0 status, supported Kubernetes versions, kind and GKE quickstarts.
11. Agent Substrate v0.2.0 release notes (September 25, 2026) — Breaking changes, default-deny egress enforcement, authorization checks "not enforced yet."
12. Agent Substrate: API guide, network egress contract, and threat model — Sandbox sizing and gVisor default of unlimited resources, egress enforcement point, "little to no security hardening at this time."
13. InfoQ: Google Open-Sources AX (September 22, 2026) — Third-party coverage describing four primitives including Gateway; summarizes Hacker News and Reddit reaction.
14. DEV Community: Google Open Sourced AX… Hacker News Isn't Buying the Number (September 22, 2026) — Community report on the launch discussion: Kubernetes overhead, the "billions" claim, pod identity under multiplexing.