Key points
- AWS released Strands Box as an open-source sandbox for AI agents in developer preview.
- The tool uses macOS Seatbelt for kernel-enforced isolation and routes actions through four checkpoints.
- Policy decisions rely on the Dogwood Local Engine, which can link actions across different tools.
AWS introduced Strands Box, an open-source sandbox designed to restrict the actions of autonomous AI agents. According to Help Net Security, the tool addresses the risk of agents operating in “YOLO mode,” where they execute commands without human review. The sandbox pairs operating-system isolation with policy rules that evaluate an agent’s history before permitting new actions. It is currently available in developer preview for Macs with Apple silicon, with Linux support planned for the future.
How it unfolded
- AWS released Strands Box to provide a controlled environment for AI agents that read files and run shell commands.
- The company open-sourced the Dogwood policy language earlier this year, which Strands Box uses to evaluate actions.
- Marc Brooker, who described the design, stated the sandbox ensures the policy layer is the only exit path.
Who is affected
System administrators and developers who deploy coding assistants face risks when agents leave their working directories or execute destructive commands. Help Net Security notes that containers and microVMs isolate resources but do not control how agents use tools inside those boundaries. Strands Box targets this gap by intercepting shell commands, Python code, tool calls, and network traffic. The solution is relevant for teams using agents that call APIs or handle sensitive data without immediate human oversight.
The architecture places the agent in a kernel-enforced sandbox using macOS Seatbelt. All outbound actions pass through four specific checkpoints: a shell interpreter, a Python interpreter, a broker for Model Context Protocol servers, and a network gateway. Each checkpoint queries the Dogwood Local Engine for permission. The engine denies any action unless a specific rule allows it. This default-deny stance prevents agents from performing unauthorized operations, such as accessing credentials meant for other services or running unvetted code.
A shared event history records actions across all four checkpoints. This allows policy rules to link behaviors, such as blocking outbound HTTP requests if the agent previously read files from a customer-data directory. The system can enforce complex conditions, like allowing a git push only after tests pass or capping payments API usage at a specific dollar amount per day. If an agent violates a rule, it receives an HTTP 403 error that identifies the blocking rule, enabling the agent to adjust its behavior accordingly.
What happens next
The network gateway manages secrets by substituting real API keys with placeholder tokens within the agent’s environment. When the agent makes a request, the gateway swaps in the actual value or signs AWS requests before they leave the sandbox. If an agent attempts to dump its environment variables, it only sees placeholders, protecting sensitive credentials. Files explicitly granted to the agent in the box.toml configuration are fenced by the operating system. Reads and writes to these specific files bypass the policy engine and its history, ensuring performance for allowed operations while maintaining security for all other actions.
What to do and how to stay safe: AWS
- Audit current AI agent deployments to identify those operating without human review or strict command restrictions.
- Review agent permissions to ensure they cannot access credentials or files outside their designated working directories.
- Monitor agent logs for unexpected network traffic or shell commands that deviate from standard development workflows.
- Once the vendor provides an update, test the sandbox in a non-production environment to validate policy enforcement.
Step-by-step guide: Injection attacks examples: how prompt leaks break AI systems
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What operating systems does Strands Box support?
According to Help Net Security, Strands Box currently runs on Macs with Apple silicon during its developer preview, with Linux support planned.
How does Strands Box handle API keys and secrets?
The network gateway replaces real API keys with placeholder tokens in the agent’s environment, swapping in actual values only when requests exit the sandbox.
Can agents bypass the policy engine for specific files?
Yes, files granted directly in the box.toml configuration are fenced by the operating system, and their reads and writes do not reach the policy engine.
