AWS open-sources Strands Box, a Mac sandbox whose rules weigh what an agent already did
AWS released Strands Box, an open-source sandbox for AI agents whose rules weigh what an agent has already done before allowing its next action. Operators gain rules that can cap or sequence actions. They also take on more code to trust, by AWS's own account.
The Watch · Security desk
Operators: checked actions are denied unless a rule allows them. Brooker: policies can look hard to write. The agent holds placeholder API tokens. Files granted in box.toml skip the engine. Interpreters add trusted code. Rules can hold git push until tests pass or cap payments at $100 a day.
- What it costs cost Operators Anything the Dogwood engine checks is denied unless a rule permits it, claim 5
- What it costs cost Dogwood policy authors Brooker says policies can look hard to read and write; AWS ships a policy-authoring skill, claim 17
- What it limits constraint The agent Holds placeholder tokens for configured API keys; the gateway swaps in the real value on the way out, claim 19
- Who's exposed exposure Files granted in box.toml Fenced by the operating system; reads and writes do not reach the policy engine or its history, claim 11
- Who's exposed exposure Strands Box's trusted code Brooker: interpreters and protocol interceptors add code to trust; bugs could mean bypassed policy, claim 14
- What's now possible capability Git push and payments API Brooker's examples: git push only after tests pass; a payments API capped at $100 a day, claim 6
| Who | How | Kind | Claim |
|---|---|---|---|
| Operators | Anything the Dogwood engine checks is denied unless a rule permits it | cost | 5 |
| Dogwood policy authors | Brooker says policies can look hard to read and write; AWS ships a policy-authoring skill | cost | 17 |
| The agent | Holds placeholder tokens for configured API keys; the gateway swaps in the real value on the way out | constraint | 19 |
| Files granted in box.toml | Fenced by the operating system; reads and writes do not reach the policy engine or its history | exposure | 11 |
| Strands Box's trusted code | Brooker: interpreters and protocol interceptors add code to trust; bugs could mean bypassed policy | exposure | 14 |
| Git push and payments API | Brooker's examples: git push only after tests pass; a payments API capped at $100 a day | capability | 6 |
What happened
- The release is a developer preview that runs only on Macs with Apple silicon, with Linux support planned.
- Four checkpoints handle the agent's calls: a shell interpreter, a Python interpreter, an MCP broker and a network gateway, each of which asks the Dogwood Local Engine for a decision.
- The network gateway holds the real API keys and gives the agent placeholder tokens, so an agent that dumps its environment variables sees only placeholders.
- Files granted directly in box.toml are fenced by the operating system, and their reads and writes never reach the policy engine or its history.
Why it matters
- What's now possible capability One rule can cover a read-then-send sequence whichever tool did the read, so operators do not need a separate rule for the shell and another for Python.
- Who's exposed exposure A flaw in an interpreter or protocol interceptor is a route around the rules, so we'd expect researchers to probe those components first.
- What it costs cost The cost lands on whoever deploys it: under default-deny, every action the agent needs requires a rule someone writes, and Brooker concedes the policy language can look hard to read and write.
Next story · Product · Oct 1
AWS open-sources Strands Decider 2B to make agent routing decisions on a laptopConfirmed3 publishers
Container and microVM isolation limits what an agent can reach. Once a tool is inside the wall, isolation does not govern how the agent uses it, according to Help Net Security's account [15]. The gap matters most in what AWS calls "YOLO mode," where each action is approved with no human review [16].
Strands Box keeps the operating-system layer. The agent runs in a kernel-enforced sandbox built on macOS Seatbelt [3]. The sandbox's job, says Marc Brooker, author of AWS's companion post on the design, is to make sure "the policy layer is the only way out of the box" [13].
The rules AWS shows all need a record of earlier actions. Among Brooker's examples: an agent may git push once tests have passed, and a payments API can be held to $100 a day [6]. AWS's walkthrough allows an incident-response agent three Slack posts in 10 minutes. A fourth draws an HTTP 403 identifying the rule, signalling the agent to hold off [7]. In our view, a check that sees one call at a time cannot express any of these.
The history has a gap by design. Reads and writes of a directly granted file never reach it, so a rule keyed to earlier file reads will not see them [11]. AWS's instruction is to leave the file off the direct list and have the agent reach it through the interpreters [12].
Those interpreters are the code Brooker flags. He said Strands Box "has more code it needs to trust," including "complex code like interpreters and protocol interceptors" [14]. AWS built that code in Rust and invested in testing, fuzzing and validation, he said [14]. He also said "the reality is that more code means more opportunity for bugs, and in this space, bugs could mean bypassed policy" [14].
Everything above is AWS's description of its own design, relayed by Help Net Security. The account does not report independent testing or a bypass. Strands Box is free on GitHub [10].
What to watch
- Whether the Linux build ships, since the developer preview runs only on Apple-silicon Macs.
- Whether the roadmap CLI that generates a starter box.toml and baseline policy arrives, which would cut the rule-writing burden.
- Any independent test or bug report showing policy bypass in the interpreters or protocol interceptors.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives50
- Confidence65
Perspective Coverage
3 publishers- Builder
- Builder 45%
- Operator
- Operator 48%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again.
- [2]
Strands Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned.
- [3]
Strands Box puts the agent in a kernel-enforced sandbox, using macOS Seatbelt.
- [4]
Strands Box routes the agent's shell commands, Python code, tool calls and network traffic through four checkpoints: a shell interpreter, a Python interpreter, a broker for MCP servers, and a gateway for network traffic. Each checkpoint asks the Dogwood Local Engine whether to allow the action.
- [5]
Dogwood is a policy language AWS open sourced this year, and anything the engine checks is denied unless a rule permits it.
- [6]
Brooker's examples include letting an agent run git push only after tests pass, or capping a payments API at $100 a day.
- [7]
In AWS's walkthrough, an incident-response agent may post to Slack three times in 10 minutes. The fourth post gets an HTTP 403 that names the rule, so the agent knows to wait.
- [8]
All four checkpoints write to one shared event history, so a rule can link actions across tools.
- [9]
A rule can block outbound HTTP requests after the agent reads a file from a customer-data directory, whether a shell command or a Python script did the reading.
- [10]
Strands Box is available for free on GitHub.
- [11]
Files granted to the agent directly in box.toml are fenced by the operating system, and reads and writes to them do not reach the policy engine or its history.
- [12]
If you want a rule to govern a file, leave it off the direct grant list and have the agent reach it through the interpreters.
- [13]
Marc Brooker, who wrote AWS's companion post on the design, says the sandbox is there to guarantee that "the policy layer is the only way out of the box."
- [14]
"While we believe our approach is the right one to address the real-world agent isolation challenges we hear from our customers, none of the options in this space come without trade-offs. In particular, Strands Box has more code it needs to trust (security folks would call this the trusted computing base), including complex code like interpreters and protocol interceptors. We have built that code in Rust, and invested in testing, fuzzing, and validation, to improve security. But the reality is that more code means more opportunity for bugs, and in this space, bugs could mean bypassed policy," Brooker explained.
- [15]
Containers and microVMs can wall off what an agent reaches, but once a tool is inside that wall, isolation has nothing to say about how the agent uses it.
- [16]
Many agents now run in what AWS calls "YOLO mode," approving each action with no human review; an agent in that state can leave its working directory, run a destructive command or pick up a credential meant for something else.
- [17]
Brooker acknowledges that Dogwood policies can look hard to read and write, and says frontier coding agents already write them well; AWS ships a policy-authoring skill for that job.
- [18]
A CLI that detects installed harnesses and generates a starter box.toml and baseline policy is on the roadmap.
- [19]
For configured API keys, the agent holds a placeholder token and the network gateway swaps in the real value on the way out; for AWS calls, the gateway signs requests. An agent that dumps its environment variables turns up placeholders for those keys.
Sources
3 independent publishers whose own reporting we read for this story.
- aws.amazon.comIntroducing Strands Box: AI agent sandboxes powered by Dogwood | AWS Open Source Blog
1 article · October 7, 2026
- helpnetsecurity.comStrands Box: Open-source sandbox for AI agents
1 article · October 11, 2026
- Strands Box: The Big Picture | Strands Agents
strandsagents.com
1 article · October 6, 2026
Topics and entities
Topics
- Open Source Security Tools
- Agent policy enforcement
- AI Agent Sandboxing
Entities
- Marc Brooker
- Amazon Web Services
- Strands Agents
- Dogwood Local Engine