AWS has released Strands Box, an open-source sandbox that checks what AI agents do, not just what they can access. It is in developer preview for Macs with Apple silicon, with Linux support planned, and offers a practical way to put rules around agents that run commands, call tools and handle credentials.
AWS AI Watch analysis
What happened
Strands Box runs agents inside a kernel-enforced sandbox using macOS Seatbelt. Shell commands, Python code, MCP server calls and network traffic pass through separate checkpoints, which ask AWS’s Dogwood Local Engine whether a rule permits the action. The checkpoints share an event history, allowing policies to link actions across tools. For example, a rule could block outbound web requests after an agent reads a file from a customer-data directory.
AWS’s examples also include allowing a git push only after tests pass, limiting a payments API to $100 a day, and stopping an agent after three Slack posts in ten minutes. The fourth post would be denied, with an error identifying the rule. The network gateway can keep configured API keys out of the agent’s environment by giving it a placeholder and substituting the real key when a request leaves the sandbox.
There is an important boundary: files granted directly to an agent in box.toml are fenced by the operating system, but their reads and writes do not pass through the policy engine or appear in its event history. AWS also acknowledges that the interpreters and protocol interceptors add trusted code that could contain bugs and allow policy to be bypassed. The details come from Help Net Security’s report.
Why it matters
A container can limit where an agent goes; it does not necessarily decide what the agent should do once inside. Strands Box’s more specific pitch is to check actions against policies, including rules that connect activity across tools. That could give developers a way to constrain risky operations without requiring a person to approve every step.
The exceptions matter as much as the controls. Developers need to understand which files bypass policy checks, and the extra trusted code makes the security boundary something to test, not simply admire.
Our read
This is a useful, concrete answer to a growing agent problem: broad tool access is convenient right up until an agent uses it in the wrong order. Strands Box gives developers policy hooks and an audit trail to work with, but those safeguards depend on careful configuration and a codebase that holds up under scrutiny. The free, open-source preview is worth exploring for agent builders, with the direct-file exception firmly in view.
What to watch
- When Linux support arrives and which agent harnesses Strands Box supports.
- Whether AWS publishes further testing or security detail on the trusted components.
- How developers handle files that bypass policy checks and the shared event history.
Discussion spark: Should agent safeguards focus on restricting where an agent can go, or on enforcing rules about what it can do once it gets there?
Sources and evidence
- Source update (12 October 2026, 05:30 UTC)
not affiliated with or endorsed by Amazon Web Services (AWS)