Strands Box: Open-source sandbox for AI agents
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned.
If you run coding assistants, you’re familiar with the problem Strands Box targets. Agents read files, run shell commands, execute code they wrote and call APIs, and many now run in what AWS calls “YOLO mode,” approving each action with no human review. An agent in that state can leave its working directory, run a destructive command or pick up a credential meant for something else.
Containers and microVMs can wall off what an agent reaches, but once a tool is inside that wall, isolation has nothing to say about how the agent uses it.
One exit, and it runs through policy
Strands Box puts the agent in a kernel-enforced sandbox, using macOS Seatbelt, and routes its shell commands, Python code, tool calls and network traffic through four checkpoints: a shell interpreter, a Python interpreter, a broker for MCP servers, and a gateway for network traffic. Marc Brooker, who wrote AWS’s companion post on the design, says the sandbox is there to guarantee that “the policy layer is the only way out of the box.”
Each checkpoint asks the Dogwood Local Engine whether to allow the action. Dogwood is a policy language AWS open sourced this year, and anything the engine checks is denied unless a rule permits it. All four checkpoints write to one shared event history, so a rule can link actions across tools. A rule can block outbound HTTP requests after the agent reads a file from a customer-data directory, whether a shell command or a Python script did the reading.
Brooker’s examples include letting an agent run git push only after tests pass, or capping a payments API at $100 a day. In AWS’s walkthrough, an incident-response agent may post to Slack three times in 10 minutes. The fourth post gets an HTTP 403 that names the rule, so the agent knows to wait.
The network gateway also handles secrets. For configured API keys, the agent holds a placeholder token, and the gateway swaps in the real value on the way out; for AWS calls, the gateway signs requests. An agent that dumps its environment variables turns up placeholders for those keys.
What the tool doesn’t cover
Files you grant the agent directly in box.toml are fenced by the operating system, and reads and writes to them do not reach the policy engine or its history. If you want a rule to govern a file, leave it off the direct grant list and have the agent reach it through the interpreters.
“While we believe our approach is the right one to address the real-world agent isolation challenges we hear from our customers, none of the options in this space come without trade-offs. In particular, Strands Box has more code it needs to trust (security folks would call this the trusted computing base), including complex code like interpreters and protocol interceptors. We have built that code in Rust, and invested in testing, fuzzing, and validation, to improve security. But the reality is that more code means more opportunity for bugs, and in this space, bugs could mean bypassed policy,” Brooker explained.
The rules themselves take work. Brooker acknowledges that Dogwood policies can look hard to read and write, and says frontier coding agents already write them well; AWS ships a policy-authoring skill for that job. A CLI that detects installed harnesses and generates a starter box.toml and baseline policy is on the roadmap.
Strands Box is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
