Strands Box: AWS Sandbox for AI Agents Brings Stateful Limits

AWS has released Strands Box, an open-source sandbox that restricts what AI agents can do on a developer's machine. Its central feature is memory: the system considers what an agent has already done when it decides what the agent may do next. The tool entered developer preview on Wednesday, 7 October 2026, under the Apache 2.0 licence 15. For now it runs only on Macs with Apple silicon running macOS 15 or later 23. Analysts and AWS itself say there are gaps in what it covers.

The problem AWS is targeting

AWS frames the launch around a pattern it calls "YOLO mode." In this setup, coding assistants and custom agents approve their own actions without a human reviewing them 15. The company's announcement admits that a sandbox is the usual answer, but argues that controlling access is only part of the job 5. A conventional sandbox can tell you whether an agent is allowed to touch a resource. It cannot easily express rules that depend on sequence, frequency or context.

Strands Box tries to cover that second category. The Register places it within a broader set of open-source AI control tools AWS has released recently, with this one adding full OS-level isolation on top 5.

How it works

The design has two layers. On macOS, Strands Box uses Apple's built-in Seatbelt sandbox to limit direct file and network access 4. On top of that sits Dogwood, a policy language developed by AWS. Its local engine evaluates actions passing through four checkpoints 4[5]:

• Strands Box's own shell interpreter
• Its Python interpreter
• A Model Context Protocol (MCP) broker
• A proxy for outgoing connections

Any action caught at these checkpoints is denied by default unless a rule explicitly permits it 4.

The checkpoints share a single event history, and that is what makes the policies stateful 4. The examples used across the coverage show the idea:

• Rate limits: an agent may post to Slack, but only three times every ten minutes 13.
• Context-dependent blocks: once an agent has read a file from a customer-data folder, outbound web requests can be blocked 13.
• Role-style limits: an agent can read logs without being able to change infrastructure 4.

The network gateway also deserves attention. By default it checks outbound requests against policy. It can attach credentials to approved calls so the agent never sees the secrets 23. AWS says the design is meant to work independently of any particular agent framework 3.

The trade-offs analysts are flagging

The coverage agrees that Strands Box addresses a real security gap, and also that it is not a complete solution. Three limitations come up repeatedly.

Built-in tools can bypass the checks. Actions performed by an agent harness's own built-in tools are outside Dogwood's coverage 23. Many popular coding agents ship with native file-editing and command tools. If those don't route through Strands Box's interpreters or broker, the policy engine never sees them, and only the coarser OS-level sandbox applies.

The trusted code surface grows. Analysts note that the bundled shell and Python interpreters add to the code that must be trusted 2. One summary says these trusted interpreters run outside the sandbox 3. The accounts differ slightly in framing, but the point is the same. The components that enforce policy become high-value targets, and bugs in them carry more weight than bugs in ordinary tooling.

Performance may suffer. Evaluating every routed action against a growing event history may add processing overhead 2. How much that matters will depend on workloads that the preview has not yet been tested against at scale.

Platform support is narrow. Restricting the preview to recent Apple silicon Macs follows from its reliance on Seatbelt 34. It also leaves out Linux and Windows developers and, notably, the cloud and CI environments where many autonomous agents actually run.

Our reading

Strands Box is better understood as a useful restraint than a finished cage. One summary of the analyst view puts it the same way, noting that AWS itself presents the tool as incomplete 3.

The stateful policy model is the interesting contribution. Rules like "no network after touching customer data" resemble data-loss prevention for agents, which is hard to build with allow/deny lists alone. Its value depends on how much agent activity actually flows through the checkpoints, and the bypass for built-in tools is a significant hole for teams using off-the-shelf coding assistants.

The macOS-only release suggests this is a design proposal as much as a product. Developers experimenting with agents on their own laptops are the natural early audience. They should treat it as one layer alongside human review and scoped credentials, not as a replacement for either.

Whether Dogwood becomes a portable policy standard or remains an AWS-specific experiment will likely depend on how quickly support reaches Linux and the environments where agents run unattended.