AWS has released Strands Box, an open-source sandbox designed to keep AI agents from acting recklessly. It runs in developer preview on Macs with Apple silicon, with Linux support planned. The tool combines kernel-enforced isolation via macOS Seatbelt with a policy layer that must approve every action before it happens. AWS engineer Marc Brooker describes the design as guaranteeing that "the policy layer is the only way out of the box."
All agent actions pass through four checkpoints: a shell interpreter, a Python interpreter, an MCP broker, and a network gateway. Each checkpoint asks the Dogwood Local Engine whether to allow the action, and anything not explicitly permitted is denied. Because all checkpoints share one event history, rules can span tools—for example, blocking outbound HTTP after a file is read from a customer-data directory, or allowing git push only after tests pass.
The network gateway also handles secrets. Configured API keys are presented to the agent as placeholder tokens, and the gateway swaps in real values only when traffic leaves the sandbox. For AWS calls, the gateway signs requests. This means an agent that dumps its environment variables finds only placeholders.
The source notes trade-offs. Files explicitly granted to the agent in box.toml bypass the policy engine entirely, so users must route sensitive files through interpreters if they want rules applied. Brooker also acknowledges that Strands Box has a larger trusted computing base than simpler sandboxes, including interpreters and protocol interceptors written in Rust, and that Dogwood policies can be hard to read and write. AWS ships a policy-authoring skill for frontier coding agents and plans a CLI to generate starter configurations. Strands Box is available for free on GitHub. [Note: The source contains no differing viewpoints; this summary reflects a single report.]