Google Publishes GKE Security Blueprint for AI Workloads

Google targets AI production security gap

Google Cloud has released a comprehensive security blueprint for organizations running artificial intelligence workloads on Google Kubernetes Engine, addressing what the company describes as a widening gap between AI prototypes and production-ready security models.

The framework, authored by Glen Messenger and Shannon Kularathna from Google's GKE security team, targets chief information security officers and platform engineering teams. It structures AI security into three distinct layers: infrastructure hardening, model integrity protection, and application-level defenses.

At the infrastructure layer, Google recommends Confidential GKE Nodes that extend hardware-level memory encryption to accelerators including Nvidia H100 GPUs and TPUs. The blueprint also calls for Workload Identity Federation, which allows inference pods to retrieve model weights from Cloud Storage without relying on long-lived credentials, and VPC Service Controls to establish perimeters around regulated data.

Model security extends beyond traditional software bills of materials

For model protection, Google introduces k8s-aibom, an open-source Kubernetes controller that automatically generates AI bills of materials. Traditional software bills of materials fail to capture AI-specific artifacts such as datasets and frameworks, creating visibility gaps in the supply chain.

At the application layer, Model Armor inspects prompts and responses for injection attempts, sensitive data exposure, and harmful content. GKE Sandbox, built on gVisor isolation technology, provides containment for AI agents that execute generated code or invoke untrusted tools.

The blueprint outlines a three-stage rollout: Deploy covers baseline controls like Workload Identity and Confidential Nodes; Operate moves to production hardening through signed image policies and log aggregation; Govern introduces organization-wide guardrails and automated incident response.

Cloud providers converge on layered AI security approaches

Google's framework joins similar initiatives from other major cloud providers. Amazon Web Services has published its AWS AI Security Framework alongside open-source Terraform blueprints through its AI on EKS project. AWS extended Amazon GuardDuty's threat detection to EKS clusters in June 2025, using a managed eBPF agent to identify credential exfiltration and reverse shells on the Kubernetes data plane.

Security vendor ARMO has critiqued the limitations of AWS-native tools for AI-specific threats. Yossi Ben Naim, ARMO's vice president of product management, argues that identity and audit tools answer what an agent is permitted to do but not whether permitted actions are normal for that specific agent. He proposes a four-stage cycle: observing agent behavior, assessing gaps between granted and used permissions, detecting baseline deviations, and enforcing tightened policy.

Microsoft has focused on agent identity through its Agent Factory series, introducing Microsoft Entra Agent ID to give individual agents scoped, short-lived credentials. The company uses PyRIT for automated red teaming to probe agents for weaknesses before deployment.

Why it matters

As organizations shift AI workloads from experimentation to production, traditional Kubernetes security controls prove insufficient. The platform understands orchestration and isolation but has no native concept of prompt injection, model weight theft, or sensitive data leakage through generated responses. These blueprints represent cloud providers packaging existing infrastructure capabilities into AI-specific operating models, but they also expose a fundamental gap: role-based access control and network policies remain necessary but not sufficient for securing autonomous AI systems that make runtime decisions about tool invocation and data access.

The details were first reported by Matt Saunders at InfoQ.