The transition to autonomous AI agentic workflows necessitates secure, high-density sandboxes, straining conventional infrastructure. This demand requires unprecedented scale, often up to one million concurrent code-execution sandboxes. Kubernetes networking efficiency is crucial for the economic viability of such initiatives. Advanced workflows like reinforcement learning involve extreme pod churn, demanding sub-second provisioning and high compute density. Agent Sandbox on GKE offers secure, lightweight isolation for these dynamic environments. Agent Substrate on GKE further enhances density and sub-second state rehydration for millions of concurrent idle sessions. GKE Dataplane V2 optimizes network identity management, resolving scaling limits and enabling sub-second provisioning. Traditionally, managing network identities with dynamic labels presents scaling challenges, approaching cluster-wide limits. GKE Dataplane V2 migrates high-cardinality data to annotations and uses advanced filtering to bypass per-pod identity generation. This approach allows identical agent types to share a single identity, maintaining low latency and avoiding identity limits. Agent Substrate integrates these optimizations, achieving efficient activation and suspend/resume latency for large-scale AI workloads.