Strands Box: AWS Sandbox Puts Stateful Limits on AI Agents

What AWS launched

AWS has released Strands Box, an open-source sandbox for AI agents. It targets a growing habit among developers: letting coding assistants and custom agents approve their own actions without a human in the loop. AWS calls that setup "YOLO mode." 1 Strands Box does not try to stop that practice. It puts a fence around it. The agent runs inside operating-system isolation, and its shell commands, Python scripts, network requests and Model Context Protocol (MCP) tool calls pass through a policy engine that can refuse them. 1

The release is a developer preview, and it runs only on Macs with Apple silicon. Linux support is described as "in development" with no committed date. 2

Why Dogwood is the interesting part

Most permission systems answer a narrow question: is this action allowed right now? The Dogwood policy language underneath Strands Box adds memory, so rules can depend on what the agent has already done. 1

Two examples show what that enables:

• Rate caps: an agent can post to Slack, but only three times in any ten-minute window. 1
• Taint rules: an agent loses outbound web access once it has read a file from a customer-data folder. 1

The second example targets a real failure mode in agent security. An agent that reads sensitive data and then makes an outbound request can exfiltrate that data, whether through a bug or a prompt-injection attack. A stateless allowlist that permits both file reads and web requests cannot catch that sequence. A stateful policy can. This is the main reason Strands Box looks like more than another container wrapper.

Statefulness also creates its own engineering burden. When a policy depends on a running count or a history of events, its correctness depends on how that history is recorded and checked. Agents increasingly fire off tool calls in parallel, so the ordering and atomicity of those checks matter. The available material does not say how Dogwood handles simultaneous requests against the same cap. Teams that rely on rate limits as a hard safety boundary should test that behavior themselves rather than assume it.

Where the design gives ground

Security analysts have pointed to trade-offs in the architecture. 2

• A larger trusted computing base. The interpreters and protocol interceptors that inspect agent activity run as trusted code outside the isolation boundary. A flaw in those components would sit on the privileged side of the wall. 2
• A blind spot in file grants. Files granted directly through the box.toml configuration skip Dogwood's policy history entirely. 2 That matters most for taint-style rules like the customer-data example. If sensitive files are exposed through configuration instead of through policy-mediated access, the engine may never record that the agent touched them, and the follow-on restriction never fires. Operators will need to be deliberate about which path they use to grant access.

Analysts conclude that Strands Box complements identity and access management (IAM) and human review but does not replace them. 2 Coverage of the launch frames Strands Box as a fix for runaway agents. 1 The analyst view places it as one layer in a defense-in-depth stack. Both readings can hold. The tool addresses a real gap, and its own documented limits keep it from being the only control.

Who should try it now

The macOS-only preview narrows the immediate audience. Enterprise teams running agents on Linux servers or in CI pipelines cannot use it in production today, and AWS has not given a timeline. 2 The current fit is individual developers and small teams who run autonomous coding agents on Apple silicon laptops. These are the people most likely to be in YOLO mode on their own machines. 12

For that group, the value is concrete. Strands Box can cap noisy integrations, block exfiltration paths after sensitive reads, and log what an agent tried to do. For platform and security teams, the preview is better treated as a chance to evaluate Dogwood's policy model. It is not yet a deployable control.

The bigger picture

Strands Box reflects a shift in how the industry thinks about agent safety. The focus is moving from asking whether an agent is permitted to do something to asking whether it should do this given everything it has already done. Policies with memory are a sensible answer to agents that chain many small actions into consequential ones.

The launch also shows how new this territory is. Stateful enforcement adds new edge cases: configuration paths that bypass history, trusted components outside the sandbox, and open questions about concurrent requests against the same limit. AWS has put a credible, open design into the community's hands. Its real test will be how well it holds up once Linux support arrives and it faces adversarial use at scale.