AWS launches Strands Box sandbox to restrict AI agent actions
The open-source tool uses policy checks and OS isolation to prevent coding agents from executing destructive commands or leaking credentials.
Key points
- Strands Box is in developer preview for Apple silicon Macs, with Linux support planned.
- The sandbox routes shell commands, code, and network traffic through four policy checkpoints.
- It uses the Dogwood policy engine to enforce rules based on an agent's action history.
AWS released Strands Box, an open-source sandbox designed to contain AI agents, according to Help Net Security. The tool pairs operating-system isolation with a policy layer that evaluates an agent’s past actions before permitting new ones. It is currently in developer preview and runs on Macs with Apple silicon, with Linux support planned for the future.
The software addresses risks associated with coding assistants that operate in what AWS calls “YOLO mode,” where agents execute commands without human review. In such environments, agents can leave their working directories, run destructive commands, or accidentally use credentials intended for other purposes. Strands Box aims to prevent these unauthorized actions by enforcing strict boundaries around agent behavior.
How the sandbox works
Strands Box places agents in a kernel-enforced sandbox using macOS Seatbelt, according to AWS engineer Marc Brooker. It routes shell commands, Python code, tool calls, and network traffic through four specific checkpoints: a shell interpreter, a Python interpreter, an MCP server broker, and a network gateway. This architecture ensures that the policy layer is the only exit path from the sandboxed environment.
Each checkpoint queries the Dogwood Local Engine, a policy language AWS open-sourced earlier this year. The engine denies any action unless a specific rule permits it. All four checkpoints write to a shared event history, allowing rules to link actions across different tools. For example, a rule can block outbound HTTP requests if the agent previously read a file from a customer-data directory, regardless of whether a shell command or Python script performed the read.
Policy examples and secret handling
Brooker provided examples of policies that allow an agent to run git push only after tests pass, or cap payments API usage at $100 per day. In an incident-response scenario, an agent might be limited to three Slack posts in ten minutes; the fourth attempt receives an HTTP 403 error that identifies the blocking rule, signaling the agent to wait.
The network gateway also manages secrets by replacing configured API keys with placeholder tokens. The gateway swaps in the real values only when requests leave the sandbox. For AWS calls, the gateway signs requests directly. If an agent dumps its environment variables, it will only see the placeholders, not the actual keys. Files granted directly in box.toml are fenced by the operating system and bypass the policy engine.
What should you do?
Developers using AI coding assistants should evaluate whether their current isolation methods, such as containers or microVMs, adequately control how agents use tools inside those boundaries. Strands Box offers a more granular approach by inspecting actions before they execute. Users in the developer preview phase should review the Dogwood policy language documentation to understand how to define rules that fit their specific workflow requirements.
What to do and how to stay safe: AWS
- Review current AI agent configurations to identify if they operate without human approval for destructive commands.
- Evaluate if existing container or microVM isolation provides sufficient control over tool usage within the sandbox.
- Monitor official channels for the release of Linux support and stable versions of Strands Box.
- Once the vendor provides an update, test policy rules in a non-production environment to verify they block intended actions.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What operating systems does Strands Box currently support?
It runs on Macs with Apple silicon during the developer preview phase, with Linux support planned for the future.
How does Strands Box handle API keys and secrets?
The network gateway replaces real API keys with placeholder tokens inside the sandbox, swapping in real values only when requests exit.
Can Strands Box link actions across different tools?
Yes, all checkpoints write to a shared event history, allowing rules to block actions based on previous behavior across tools.
