AWS Strands Box: open source policy sandbox for AI agents

On 7 October 2026 Amazon Web Services released Strands Box, an open source sandbox for artificial intelligence agents. It combines operating system-level isolation with a policy engine that decides, action by action, what the agent may do, also taking into account what it has already done. It is a developer preview under the Apache 2.0 licence and, for now, it only runs on Macs.

The problem AWS is addressing is familiar to anyone using agents to write code or automate tasks: agents increasingly run in “YOLO mode”, approving every action themselves without human review. Containers and microVMs isolate the agent well, but they do not enforce context-aware rules: once the agent has a tool, nothing stops it from using it however it likes, for example by deleting a production database or reaching out to the internet.

How it works

According to AWS’s announcement and to reporting by The Register and CSO Online, Strands Box brings together several of the company’s open source components:

• Dogwood, a policy language developed by AWS, with its evaluation engine. The local version of the engine (Dogwood Local Engine) keeps an event history: each tool call is checked not only against what the agent wants to do, but against what it did before, including with other tools.
• Strands Shell and Monty for Python, shell and Python interpreters that expose individual operations, such as a file deletion, to the policy engine. Policies can therefore refer to the concrete action rather than to a generic command.
• A Model Context Protocol (MCP) broker, through which calls to external tools pass.
• A network gateway that, by default, evaluates every outbound request against the policies and can attach credentials to approved requests without ever exposing them to the agent.

The examples given by the sources show the kind of control on offer:

• an agent investigating an incident may post updates to the Slack channel, but no more than three times every ten minutes, so it does not bury messages from people;
• you can decide when the agent is allowed to run a git push;
• you can cap API calls, to avoid runaway costs;
• according to CSO Online, reading a file through the shell can trigger restrictions on subsequent network requests. This is the pattern needed against exfiltration: the agent first reads confidential data, then tries to send it out.

Marc Brooker, AWS vice president and distinguished engineer, told The Register that Box enforces policies deterministically, without relying on the agent to follow instructions: the agent cannot talk the system into making an exception. Brooker also noted, however, that even with well-configured permissions an allowed action can still have unwanted effects, and that developers remain responsible for deciding what access to grant and where human review is needed.

AWS presents the controls as independent of the agent framework: Strands Box accepts any agent or harness and reduces reliance on the permission mechanisms built into individual agents.

Acknowledged limits

CSO Online reports some limits that AWS itself acknowledges:

• partial coverage: files read or written directly through the agent harness’s built-in tools remain subject to operating system restrictions, but are not evaluated by the Dogwood policy engine;
• more trusted components: the shell and Python interpreters run outside the sandbox, in a process treated as trusted. The security of the whole system therefore also depends on them.

Analysts interviewed by CSO Online add that the controls may introduce processing overhead and new components with vulnerabilities of their own; that badly written policies can block legitimate actions or leave gaps; and that no sandbox prevents a harmful decision made within the permissions granted. Identity and access management, monitoring and human oversight are still required.

Platforms and availability

The code is on GitHub. According to CSO Online, it currently requires Macs with Apple silicon processors and macOS 15 or later. Linux support is in development and a Windows client is “on the radar” at AWS, with no dates. AWS also wants to let developers deploy agents with their policies to Amazon Bedrock AgentCore, Amazon ECS and Kubernetes, but has given no timeline.

Impact for European and Italian organisations

Strands Box does not fix a vulnerability: it is a preview tool to be evaluated. It is useful above all as a control model for organisations bringing AI agents into their business processes. Today it applies in practice to developers’ Macs running coding agents; for servers and production pipelines you will have to wait for Linux and the announced integrations.

For NIS2 entities, agents acting with the organisation’s credentials and network fall within the risk management measures of Article 21: access control, supply chain and development security, activity logging. An agent that approves every action on its own is, in effect, a privileged account without supervision.

What to do now

1. Take stock of the agents in use: which coding and automation agents run on workstations and servers, with which credentials, and whether any of them runs with automatic approval.
2. If you try Strands Box, do it on development Macs, not on production systems: it is a preview. Start with a few clear policies: allowed network destinations, rate limits, git push and deletions only with confirmation, credentials injected by the gateway and never left in the agent’s environment variables.
3. Close the known gaps: disable or restrict the harness’s built-in file tools, which bypass the policy engine, and keep the interpreters running outside the sandbox up to date.
4. With or without Strands Box: dedicated, minimal credentials for each agent, internet egress only to allowed destinations, human review for irreversible actions (deletions, production releases, payments) and a way to stop the agent immediately.
5. Log agent actions and send the logs to a central archive, so you can reconstruct what happened if an allowed action causes damage.

How ARXDOME helps

The ARX Sentry agent, macOS included, collects logs, events and the software and process inventory, and checks file integrity in the chosen folders: it helps you see which AI tools are actually running on workstations and spot unexpected changes. ARX Shield checks machine hardening against the CIS benchmarks, shows open vulnerabilities by package, including those in newly installed components, and lets you isolate a suspicious machine from the network.

Last updated: 9 October 2026