Strands Box: AWS's History-Aware AI Agent Sandbox Debuts on Mac

What AWS shipped

Amazon Web Services has released Strands Box, an open-source sandbox for AI agents. It enters developer preview on October 7, 2026, under the Apache 2.0 license 125. The tool restricts what an agent can do with files, the shell and the network on a developer's machine 3. Its main feature is that it can make decisions based on what the agent has already done, not only on what it is asking to do now 12.

The problem it targets has a name in AWS's own announcement. "Agents increasingly run in 'YOLO mode,' approving every action without human review," the team wrote. It added that while a sandbox is the usual answer, "access is only part of what we want to control" 5. Strands Box is AWS's latest open-source effort to make autonomous agents more accountable, adding a full sandbox to tools it has released before 5.

How it works: isolation plus memory

The design has two layers.

OS-level isolation. On macOS, Strands Box uses Apple's built-in Seatbelt sandbox to limit direct file and network access 3.

Dogwood, a policy language and engine. AWS built Dogwood to evaluate agent actions 13. Its local engine checks actions that pass through four channels [3]:

• the built-in shell interpreter
• the built-in Python interpreter
• a broker for Model Context Protocol (MCP) tool calls
• a proxy for outbound connections

The Register describes the Dogwood Local Engine as giving the system "temporal awareness." Each tool call is judged against the agent's history as well as its current request 5.

The examples from coverage show why that matters:

• An agent may post to Slack, but only three times every ten minutes 2.
• Outbound web requests can be blocked once the agent has read a file from a customer-data folder 2.
• API spending can be capped 1.
• In heise's scenario, an agent can read logs and investigate an incident but cannot change infrastructure or flood a Slack channel 3.

The second example is the most telling. Blocking network access after the agent touches sensitive data is a rule about sequence, not permission. Traditional sandboxes don't express that well.

Why history-aware rules are the real story

Across the coverage, the consistent framing is a contrast with containers and microVMs. Those technologies isolate an agent but have no memory of what it did 1. A container can tell you whether an agent may reach Slack's API. It cannot tell you the agent has already posted forty times in the last minute.

The rules are also described as deterministic 1. In practice, that means policy decisions don't rely on another model's judgment. Analysts quoted in the daily.dev summary say this fills a real gap in agent security. They also stress that Strands Box does not replace IAM, monitoring or human oversight 1. It is best read as one control layer among several, not a substitute for good permissioning.

The macOS-only catch

The biggest limitation right now is platform support. The preview runs only on Apple silicon Macs with macOS 15 or later 1.

AWS says it plans to add:

• Linux and Windows support
• deployment targets including Bedrock AgentCore, ECS and Kubernetes

It has given no timeline for any of these 1.

This has two consequences. First, Strands Box is for now a tool for individual developers running coding assistants or homegrown agents locally, which matches how AWS positions it 2. Second, it is absent from the server-side environments where most production agent workloads would run.

A crowded field, but a different angle

Strands Box arrives in a busy market. An August 2026 roundup of agent sandbox platforms highlighted [4]:

• Daytona, which offers programmatically managed sandboxes that act as full computers for agents.
• Modal, whose serverless platform includes container-based sandboxes for untrusted code.
• Vercel Sandbox, which provides Linux environments controlled through JavaScript and Python SDKs or a CLI.

Most of these products compete on execution: spinning up isolated, often remote, Linux environments and managing their lifecycles 4. Strands Box takes a different approach. It is local, Mac-first and focused on policy rather than compute.

That suggests it may complement these platforms more than it competes with them. A history-aware policy layer could in principle sit on top of any isolation primitive, and AWS's planned Kubernetes and ECS targets point in that direction 1. That is my reading, not something AWS has confirmed.

The takeaway

Strands Box's sandboxing is not new. Seatbelt has existed for years, and the market is full of isolation products. What stands out is Dogwood's ability to write rules about sequence and rate, such as "only three times every ten minutes" or "no network after reading customer data" 2. As agents gain the ability to approve their own actions, those rules address a failure mode that access controls alone miss.

Until Linux support and cloud deployment targets arrive, though, Strands Box is an interesting preview rather than a production control. Teams evaluating it should treat it the way AWS and analysts suggest: as one more guardrail alongside IAM, monitoring and human review 1.