What it does
Caption: Project mark shipped in the AX README · Source: google/ax on GitHub · repo
AX runs agent workloads as first-class cluster jobs. You declare work in YAML (apiVersion: ax.io/v1alpha1), apply it, and the control plane sandboxes the task, attaches workspace assets, and enforces network policy.
Four primitives from the README:
| Need | Primitive |
|---|---|
| Isolated agent run with resource limits | Task |
| Pre-wire git repos, MCP servers, skill packages | Workspace |
| Outbound traffic allowlist | Gateway |
| Platform LLM + credentials from a Kubernetes secret | Model |
Operator verbs that matter on Monday: ax apply, ax watch, ax ssh (requires spec.debug: true), ax suspend / ax resume, ax delete. Install path documented: go install github.com/google/ax/cmd/ax@latest, then make deploy AX_IMAGE_REPO=<registry> into namespace ax-system (needs a cluster, ko, a pullable registry, and a reachable Agent Substrate Control API).
Product site copy on agentexecutor.io matches the README pitch: declare a task, AX sandboxes it, fences network, and aims at billions of tasks per cluster.
Why it is moving now
Agent runtimes are neither stateless microservices nor clean batch jobs. They hold state, call model APIs, and can burn budget in a loop. AX's DESIGN.md states the project keeps task state in Redis (hashes + streams) rather than millions of short-lived Kubernetes CRDs, to avoid etcd pressure. That is a concrete infra bet rather than a blog slogan.
The project is also sitting on the open-source radar: Hacker News front page on 21 September 2026 linked the product site as "Google's Open Agentic Orchestrator."
License + activity + maturity (demo | usable | production-shaped)
- License: Apache License 2.0 (
LICENSEin the repo). - Activity: README and DESIGN.md are present; install and deploy docs are written. GitHub API rate limits blocked a fresh star/commit census during this draft window, so star counts are not stated here.
- Maturity: demo → early usable. README warning (verbatim intent): core concepts, protocols, and specs are still being refined; major breaking changes are likely before a stable release. Treat APIs as unstable. Not production-shaped for a regulated agent fleet without your own hardening, SLO, and change-control layer.
When to pick it vs the default alternative
| Situation | Lean AX | Lean something else |
|---|---|---|
| You already run Kubernetes and need egress-fenced agent sandboxes with suspend/resume | Yes, pilot | - |
| You want a managed cloud agent harness with a vendor SLA | - | Lab Agents APIs (OpenAI Agents API, Claude Managed Agents, etc.) |
| Single-laptop multi-agent demos without a cluster | - | Local harnesses (PAIR, plain Docker Compose, vendor CLIs) |
| You need a stable CRD API frozen for 12 months | - | Wait for AX stable, or wrap behind your own API |
Failure modes
- Breaking API churn before stable: manifests you write this month may not apply next month.
- Cluster tax: requires Kubernetes, image registry,
ko, Redis, and Agent Substrate. Not a single-binary laptop toy despite the cute CLI. - Debug SSH only when opted in:
ax sshneedsspec.debug: true. Leaving debug on in shared clusters expands the attack surface. - Egress misconfig: a Gateway allowlist that is too wide defeats the isolation pitch; too narrow breaks tool calls.
- Cost loops: AX helps you see and suspend tasks; it does not by itself stop a mis-specified agent from spending tokens until you watch it.
Links
- Repo: github.com/google/ax
- Site: agentexecutor.io
- Agent Substrate dependency: github.com/agent-substrate/substrate
- Design notes:
DESIGN.mdin the AX repo