Strands Box: AWS Open-Source AI Agent Sandbox Debuts on macOS

What AWS shipped

Amazon Web Services has released Strands Box, an open-source sandbox for AI agents that pairs operating-system isolation with policy rules that consider what an agent has already done before allowing its next action 13. The project entered developer preview on 7 October 2026 under the Apache 2.0 licence. The code is on GitHub at strands-agents/box and is written in Rust, with a first tagged release, v0.1.0, published that day 23.

The biggest practical constraint is platform support. Box currently runs only on Macs with Apple silicon running macOS 15 or later, and Linux support is planned but not yet available 13. That fits the stated audience of developers running coding assistants on their own machines. It also means teams that standardize on Linux workstations or run agents in server environments cannot adopt it yet.

The problem it targets: "YOLO mode"

AWS frames the tool around a growing habit among agent users: letting agents approve every action without human review. The company calls this "YOLO mode" 14. Coding agents read files, run shell commands, execute code they generated and call APIs. Without oversight, an agent can leave its working directory, run something destructive or pick up a credential meant for another purpose 1.

AWS's announcement argues that a conventional sandbox only solves part of this, because "access is only part of what we want to control" 4. A sandbox decides what an agent can reach. It does not decide whether a sequence of permitted actions adds up to something unwanted.

How it works

Strands Box confines the agent in a kernel-enforced sandbox built on macOS Seatbelt 1. Shell commands, Python code, tool calls and network traffic then pass through four checkpoints:

• a shell interpreter
• a Python interpreter
• a broker for Model Context Protocol (MCP) servers
• a network gateway 13

The policy layer uses Dogwood, an AWS policy language. Its Dogwood Local Engine gives Box what The Register calls temporal awareness: a tool call is judged against both the agent's request and its recorded history 34. In practice, permissions can be rate-limited or made conditional on earlier activity 3. The network gateway can also attach credentials to approved requests so the agent never handles the secrets directly 3. That is a meaningful design choice, since credential leakage is one of the failure modes AWS highlights 1.

The launch post, written by Principal Engineer Fernando Dingler, describes the combination as "operating-system isolation with fine-grained policies for governing agent actions" 2. The Register places Box in a wider pattern. AWS has released several open-source tools for holding agents accountable, and Box bundles some of them into a full sandbox 4.

The gap security teams should notice

The most important caveat is easy to miss. Dogwood policies do not cover every agent action. When an agent reads or writes files through its harness's own built-in tools, those operations are limited only by OS-level restrictions and skip the policy engine entirely 3.

This shapes how much trust Box deserves. Its history-aware rules only work for traffic that passes through its four checkpoints. Anything that reaches the system another way gets only the coarser protection of the Seatbelt sandbox. Several points follow from that:

• The trust boundary is wider than it looks. Correct behavior depends on the kernel sandbox, the interpreters, the MCP broker, the gateway, the policy engine and the configuration of the agent harness all working together.
• Credential handling is now Box's responsibility. Moving secret injection into the gateway keeps credentials away from the agent, but it makes that component a high-value part of the setup.
• Policies can create false confidence. A team that writes careful Dogwood rules may assume all agent behavior is governed when part of it is not.

None of this undermines the approach. Layering behavioral policy on top of isolation is a reasonable answer to agents that act autonomously. The point is that Box has to be configured with a clear map of which paths it actually mediates.

Who should try it now

Strands Box is best seen as an early, opinionated experiment rather than a finished control plane. Mac-based developers who already let coding agents run unattended have the most to gain right away, as do teams experimenting with MCP servers and the risk of over-permissioned tool access. Enterprises evaluating autonomous agents more broadly will likely wait for Linux support and for clearer coverage of harness-native file operations.

The broader signal is that AWS is betting agent governance needs memory: judging an action in light of what came before it, not just in isolation. If that idea holds up, Box's limitations look like early-preview gaps rather than design flaws. Until those gaps close, the safest assumption is that only what passes through the checkpoints is governed by policy.