AX (Agent Executor) is Google's open-source, Apache-2.0 orchestrator for running autonomous agent workloads in a cluster. You declare an agentic task in YAML — apiVersion ax.io/v1alpha1, kinds Task, Workspace, Gateway and Model — and AX sandboxes it on Agent Substrate, pre-wires its Git repos, MCP servers and skill packages, fences its outbound network to an allowlist, and runs it at scale. The CLI is deliberately kubectl-shaped: ax apply, get, describe, watch, delete, plus agent-specific verbs ax suspend, ax resume and ax ssh. It first shipped as v0.1.0 on May 20, 2026; v0.3.0, tagged September 20, 2026, topped Hacker News and the repository sits at roughly 3.7k stars.

What is the difference between Google AX and Agent Substrate?

Agent Substrate is the execution runtime: an open-source, secure-by-default sandbox layer optimised for GKE that stores millions of suspended agent snapshots and restores them on demand onto a pool of warm workers, with sub-500 ms resumes and native zero-trust kernel and network isolation. AX is the orchestration layer above it: it owns the declarative API, task lifecycle, workspace provisioning and egress policy, and calls Agent Substrate's Control API to provision atespaces, create actors and assign workers. Think Agent Substrate as the kubelet-and-container-runtime tier and AX as the scheduler and API server.

Why does AX use Redis Streams instead of Kubernetes CRDs?

Because agent tasks are short-lived and numerous. AX's design document says storing millions of short-lived tasks as Kubernetes custom resources pushes etcd past its comfort zone — single-digit-gigabyte storage limits, write-rate bottlenecks and control-plane degradation. So AX keeps task state in Redis hashes and uses Redis Streams as the work queue between a stateless gRPC API server (ax-server) and a horizontally scaled pool of reconciliation controllers (ax-controller) that consume the stream with XREADGROUP and drive tasks toward desired state on Agent Substrate.

How do I try Google AX?

Install the CLI with go install github.com/google/ax/cmd/ax@latest. You need a Kubernetes cluster, ko, a container registry the cluster can pull from, and a reachable Agent Substrate Control API (in-cluster default api.ate-system.svc.cluster.local:443). make deploy AX_IMAGE_REPO= deploys Redis and the control plane into the ax-system namespace; then ax apply -f examples/task.yaml creates a Task, Workspace, Gateway and Model in one file, ax watch task streams phase changes, and ax ssh shells into the sandbox if spec.debug is true. The README warns that core concepts and protocols are still changing and major breaking changes are likely before a stable release.

Quick Answer

What Is Google AX (Agent Executor)? Open Orchestrator (2026)

Published: September 21, 2026

The one-paragraph answer

AX (Agent Executor) is Google’s answer to the question “what does Kubernetes look like when the workload is an agent, not a microservice?” It is an Apache-2.0 project at github.com/google/ax that lets you declare agentic tasks as ax.io/v1alpha1 manifests and run them — sandboxed, network-fenced, suspendable, SSH-able — on top of Agent Substrate, Google’s open sandbox runtime for GKE. First release v0.1.0 on May 20, 2026; the v0.3.0 release tagged September 20, 2026 took the top AI slot on Hacker News and pushed the repo to roughly 3.7k stars. Google’s own framing is that agent execution needs a scheduler-and-runtime layer rather than a library.

Verified September 21, 2026 against the AX README, DESIGN.md, the GitHub releases page, and Google Cloud’s Agent Executor and Agent Substrate announcements.

Why agents need their own orchestrator

The README states the problem plainly: agents “are neither stateless microservices nor run-to-completion batch jobs. They accumulate state, need strict isolation, call out to model APIs and tool servers, and can burn money in a loop if nobody is watching.” Kubernetes Deployments assume statelessness; Jobs assume a finite run; neither gives you “pause this agent for six hours while a human reviews, then resume exactly here.” AX gives four small primitives that cover it declaratively:

You want to…	AX gives you
Run untrusted agent code in an isolated sandbox with CPU/memory limits	Task
Pre-wire Git repos, MCP servers and skill packages so every agent starts warm	Workspace
Lock outbound traffic to an explicit host allowlist	Gateway
Configure which LLM the platform uses, with credentials from a Kubernetes secret	Model
Pause an idle agent and pick up exactly where it left off	`ax suspend` / `ax resume`
Shell into a running agent to see what it is doing	`ax ssh`

A minimal manifest is two documents — a Workspace that clones github.com/golang/go on branch my-fix, and a Task whose goal is “Ensure that Go tool chain is available and is built from source” with debug: true so you can ax ssh in. ax apply -f task.yaml, ax watch task test, ax ssh test -- ls -al /workspace.

Architecture: why Redis, not etcd

AX’s DESIGN.md is unusually candid about the design constraint: “Storing millions of short-lived tasks as Kubernetes CRDs pushes etcd past its comfort zone (single-digit GB storage limits, write-rate bottlenecks, control plane degradation).” The control plane therefore has four binaries:

ax — the developer CLI; applies manifests, watches resources, tunnels to the cluster, follows your active kube context (kubectx prod-cluster && ax get tasks just works).
ax-server — stateless gRPC API on port 8080 (/healthz over plain HTTP); validates manifests, persists to Redis, publishes events.
ax-controller — horizontally scaled reconciliation workers that consume the Redis Stream with XREADGROUP, provision atespaces and actors on Agent Substrate, apply egress policy, and drive tasks toward desired state. Scale by adding replicas.
ax-task-runner — the entrypoint inside every task container; bootstraps the workspace, serves a metadata server, runs the agent command. Custom runner images can embed the runner package directly.

State lives in Redis (task hashes, event streams, pub/sub). Agent Substrate handles atespace provisioning, actor creation and activation, worker assignment and egress-policy filtering. The gRPC service exposes Get/List/Update/Delete for Tasks, Gateways, Workspaces and Models plus SuspendTask, ResumeTask and a server-streaming WatchTask.

What Agent Substrate is

Google open-sourced Agent Substrate alongside AX and made it available on GKE. It is a secure-by-default execution runtime built to run millions of sandboxes at roughly 10x the density of standard container runtimes: instead of keeping idle, input-waiting agents resident, it stores millions of suspended agent snapshots and restores them on demand onto a shared pool of warm workers, with sub-500 ms resumes and 500+ suspend/resume activations per second, plus native zero-trust kernel and network isolation. It runs on any Kubernetes but is optimised for GKE. AX is the orchestrator; Substrate is the runtime; the pairing is Google’s “Kubernetes moment for agents” pitch.

What changed recently

The September 2026 release stream, per the GitHub releases page, is mostly hardening: the Antigravity sidecar dropped /etc/hosts hacks and Vertex env-var overrides now handled natively by google-antigravity 0.1.7; a path-traversal guard was added on conversation_id in the harness server; the Interactions harness now persists with a durable directory and resumes from it; run_command now treats the workspace directory as authoritative (fixing tool calls that ran from /); and CI workflow actions were pinned with read-only permissions on September 20. The default example Model is google / gemini-3.8-flash, but Model is a generic provider/credential object.

What it is not

Not a framework. AX does not tell you how to write the agent loop — bring LangGraph, ADK, the Codex or Claude Agent SDK, or Antigravity. It runs whatever your task container runs.
Not stable. The README warns of “major breaking changes prior to a stable release,” and the API is v1alpha1.
Not a hosted service. You operate the cluster, Redis and Substrate yourself; there is no SLA. Managed alternatives are compared in Google AX vs OpenAI Agents API vs Claude Code Projects vs Cursor Projects.
Not the same as Vertex AI Agent Engine. Agent Engine is Google Cloud’s managed runtime; AX is the open, self-operated layer.

Who should care

Platform teams that already run Kubernetes and want a data-plane-owned way to run coding or research agents at fleet scale — hundreds to millions of short tasks, with egress allowlists and suspend/resume — are the target. If you have three agents and a cron job, AX is overkill; a hosted harness or a single container is fine (hosted harness vs DIY loop, Docker vs process vs remote sandbox). If you are choosing between Ray, Kubernetes and Slurm for agent workloads, AX is the first project to make “Kubernetes, but agent-shaped” concrete (Ray vs Kubernetes vs Slurm); the egress lock-down guide covers what the Gateway primitive is for.