Cosmonic Pushes Sandbox Density Limit Using Wasm on Kubernetes
TL;DR — Key Takeaways
-
1.42 million sandboxes. One 64-core server. Cosmonic’s wasmCloud demonstration highlights how lightweight WebAssembly environments could dramatically increase AI agent density.
-
AI agents don’t all need heavyweight infrastructure. Task-specific agents can potentially run in compact Wasm sandboxes, reducing resource consumption while maintaining execution isolation.
-
Kubernetes wasn’t designed for millions of persistent agents. As agent deployments grow, control-plane performance, memory consumption and inefficient pod allocation are becoming increasingly urgent challenges.
Cosmonic this week at the KubeCon + CloudNativeCon North America 2026 conference demonstrated an instance of a Kubernetes cluster running an instance of Wasm Cloud on a single 64-core server that was capable of running 1.42 million sandboxed environments for hosting artificial intelligence (AI) agents.
Company CTO Bailey Hayes said that capability provides IT teams with an alternative approach to deploying AI agents using WebAssembly sandboxes that can scale using existing instances of Kubernetes.
In general, WebAssembly lends itself better to AI agents that have a limited number of specific tasks to perform. In contrast, an AI coding agent might require a larger sandbox based on a micro virtual machine, she added.
However, the bulk of the AI agents that will be deployed by the average enterprise are going to be focused on a narrow range of tasks. As such, Wasm can be used to provide a sandbox to isolate them. That’s critical because, in the absence of a sandbox, an AI agent is liable to access services and applications that should be off-limits.
Cosmonic is making a case for running AI agents on Kubernetes clusters using an open-source Wasm Cloud platform that provides access to a Kubernetes Operator that makes it possible to deploy Wasm components. Now being advanced as an open-source project under the auspices of the Cloud Native Computing Foundation (CNCF), AI agents may prove to be a “killer application” for wasmCloud, noted Hayes.
At the moment, there are significant performance concerns when AI agents are deployed on Kubernetes clusters. Issues ranging from how efficiently infrastructure is consumed by AI agents to the performance capabilities of the Kubernetes control plane are all now being encountered.
Additionally, there is a clear need for additional primitives to secure AI agents running on servers that host Kubernetes clusters. Google has contributed an open-source Agent Substrate framework that makes it possible to run long-running agent workloads at scale on Kubernetes clusters more efficiently, to the Cloud Native Computing Foundation (CNCF).
Agent Substrate makes it possible to decouple stateful agent sessions and identities from active compute in a way that creates a snapshot of idle agents that is then stored and, when needed, restored in under 500 milliseconds to reduce costs by consuming infrastructure resources more efficiently. Right now, every active agent is given its own pod, which locks up memory and CPU resources while the agent sits idle. As a consequence, the Kubernetes control plane needs to track millions of persistent objects it was not designed to manage.
At the same time, performance enhancements for the Kubernetes control plane are needed as well. As the number of calls made by AI agents to the application programming interfaces (APIs) exposed exponentially increases, the overall performance of the Kubernetes control plane becomes a significant concern.
Unfortunately, it won’t be until next year before these enhancements find their way into a distribution of Kubernetes. In the meantime, vendors such as Solo.io are making an enterprise edition of the Agent Substrate available for IT teams to deploy themselves.
One way or another, AI agents will be deployed on Kubernetes clusters. The fundamental decision that IT teams will need to make is determining to what degree they want to wait for Kubernetes to be optimized for AI agents or adopt an alternative framework for building and deploying AI agents more efficiently on existing distributions of Kubernetes.
Frequently Asked Questions
How did Cosmonic run 1.42 million AI agent sandboxes on one server?
Cosmonic demonstrated a Kubernetes environment running wasmCloud on a single 64-core server capable of supporting 1.42 million sandboxed environments. WebAssembly's lightweight execution model allows many isolated workloads to operate with less overhead than traditional containers or virtual machines. The density result does not necessarily represent 1.42 million simultaneously active, resource-intensive agents.
Why is WebAssembly suitable for deploying AI agents on Kubernetes?
WebAssembly provides lightweight isolation for agents performing narrowly defined tasks. This can reduce infrastructure overhead and help prevent agents from accessing unauthorized services. More complex workloads, such as AI coding agents, may still require larger sandbox environments based on micro virtual machines.
What challenges does Kubernetes face when scaling AI agents?
Resource efficiency, isolation and control-plane scalability are the biggest concerns. Persistent agent pods can consume CPU and memory while idle, and large agent populations can generate substantial API traffic. Approaches such as wasmCloud and Agent Substrate aim to address different aspects of these problems.
