Google has introduced AX, an open-source, Apache 2.0-licensed orchestrator and declarative runtime designed to execute and scale autonomous AI agent workloads. The platform is hosted at agentexecutor.io and on GitHub as google/ax. Running on top of Agent Substrate, AX treats agents as stateful actors rather than microservices or batch jobs. It offers sub-second task suspension and resumption alongside four core declarative primitives.
Modern AI agents present operational requirements that diverge significantly from traditional infrastructure models. Unlike stateless microservices that handle short-lived request-response lifecycles or batch jobs that execute deterministically to completion, autonomous agents are stateful, bursty, and long-running. They execute intensive compute during reasoning, tool execution, and local code evaluation, interspersed with prolonged idle periods while awaiting model responses, external API feedback, or human-in-the-loop intervention. In conventional Kubernetes or container orchestration setups, keeping dedicated sandboxes active during these idle phases leads to compute underutilization, while cold starts in conventional container runtimes introduce latency that degrades interactive agent loops.
AX addresses this operational profile through an architecture rooted in systems research from teams across Google and Google DeepMind. The platform operates on Agent Substrate, an execution runtime engineered specifically for dense actor multiplexing. In AX, each agent session runs as an isolated actor sandbox with strict CPU and memory resource boundaries. When an agent enters an idle state, such as waiting for an inference provider or a tool call, the platform checkpoints its execution state and suspends it. AX is designed to resume suspended actors in sub-second intervals with zero cold-start delay, multiplexing dozens of tasks onto shared host workers to conserve compute resources.
The control plane exposes four declarative Kubernetes-style primitives defined under the ax.io/v1alpha1 API group. The Task primitive defines the execution lifecycle, sandbox resource constraints, and references to supporting infrastructure. The Workspace primitive handles pre-execution environment assembly. Developers can declaratively mount Git repositories, configure Model Context Protocol servers, install skill bundles, or provide natural-language goals that an initialisation agent executes to bootstrap toolchains and system dependencies prior to task start.
The Gateway primitive manages outbound network security policies, restricting sandboxed agents to explicit allowlists of hostnames and network ports while handling credential injection into outbound requests. The Model primitive establishes a unified control point for LLM provider parameters, runtime configurations, and secrets stored in Kubernetes.
Interaction with the system is driven through the ax command-line tool, written in Go. Platform operators deploy the control plane to Kubernetes using ko and Redis into the ax-system namespace, interfacing through existing Kubernetes contexts via kubectx. Developers manage workloads using commands including ax apply to register manifests, ax watch to stream task phase and condition changes in real time, ax ssh to access interactive sandbox environments for debugging, and ax suspend and ax resume to manually control task execution state.
The project is positioned for production agent deployment as well as research environments that require running sandboxed trajectories, reinforcement learning loops, and agent benchmark evaluations at scale.
However, as active discussions on Hacker News demonstrate, the technical community is divided. Infrastructure engineers praise the platform for solving the prohibitive cloud costs of idle agents waiting on model APIs or human input. At the same time, developers criticise the marketing claim of ergonomic workflows due to the heavy operational overhead of maintaining Kubernetes clusters, container registries, and custom CRDs via tools like ko.
Meanwhile, discussions cross-posted to Reddit emphasise that AX serves as a foundational execution runtime rather than a high-level application orchestrator like LangGraph or CrewAI. Practitioners across security and systems channels highlight the vital blast-radius containment of gVisor-isolated sandboxes alongside early teething issues like egress proxy dropped connections and rudimentary secrets management.
This ultimately positions AX not as a quick-start framework for solo hackers, but as an essential compute primitive for enterprises managing large-scale, long-running agentic fleets.
