Run millions of agents, securely.
Every agent runs in its own microVM or gVisor sandbox. Idle agents suspend, resume in under 500ms on any ready worker, and keep their memory and filesystem state.
Every agent has an identity, but no credentials, no open network, and no unauthorized way out of the sandbox.
Instead of sharing a process across users, Agent Substrate isolates every actor in its own single-tenant sandbox while multiplexing thousands of them across shared physical hosts.
Every actor gets a short-lived SPIFFE X.509 certificate and on-demand JWTs that are injected on egress and federate with every cloud provider and external service.
Actor sandboxes execute credential-free. The egress gateway pulls secrets from pluggable secret stores and injects API keys and tokens out-of-band on authorized outbound calls. The agent never holds a secret.
Actors launch in isolated network namespaces with no inbound access, no peer-to-peer traffic, and no control-plane reachability. Inbound calls must authenticate at the router, and outbound traffic is blocked unless allowed by an egress policy.
Give every user, session, or task its own dedicated Cloud Hypervisor microVM or gVisor sandbox with isolated compute, network, and storage. Local worker state is scrubbed between runs.
Agents are idle most of the time. Stop paying for it.
Suspend an actor and resume it on any available worker in the pool in under 500ms.
Memory and filesystem state survive hibernation through full-state snapshots, so actors pick up where they left off.
Pack a large registry of stateful actors onto a small pool of shared workers. The demo runs about 250 actors on 8.
Runs on any Kubernetes 1.37+ cluster. Kubernetes handles nodes, autoscaling and recovery. Substrate's own control and data plane handle agent scheduling and suspend/resume, so the Kubernetes API stays off the request path.
Manage actors with kubectl ate
# 1 · create an atespace, template, and actor kubectl ate create atespace demo kubectl ate create actor-template -f counter-template.yaml kubectl ate create actor my-agent -a demo --template counter # 2 · proxy to the actor & send a request (wakes on demand) kubectl ate proxy actor my-agent -a demo & curl -X POST http://localhost:8000/ # 3 · inspect state or suspend back to snapshot storage kubectl ate get actor my-agent -a demo kubectl ate suspend actor my-agent -a demo
Bring any agent. It is just an OCI container.
An actor is a standard OCI container whose memory and filesystem persist across requests. Package an entire agent runtime inside an actor so it suspends when idle and resumes, or connect an external agent platform to execute untrusted code and tools inside isolated actor sandboxes.