Strands Box: How AWS's Open Sandbox Reins In AI Agents

Strands Box is a new open source sandbox from AWS that decides what an AI agent may do based on what it has already done. Announced on October 7, 2026 in a post by AWS engineer Marc Brooker, it combines operating system isolation with a policy engine that sits on every route out of the sandbox. For teams letting coding agents run commands on real machines, that is a meaningful step toward enforceable guardrails.

• Status: developer preview, released October 7, 2026.
• License: Apache 2.0, according to CSO Online.
• Platform: Macs with Apple silicon running macOS 15 or later, per CSO Online.
• Policy language: Dogwood, AWS's open source policy language.

What Is Strands Box?

Strands Box is a local sandbox for AI agents. The agent runs inside a kernel-enforced boundary, and the only way to reach the outside world is through a policy layer. Brooker's post describes four checkpoints in that layer:

• Strands Shell for shell commands.
• A Python interpreter for scripts.
• An MCP broker for tool calls made over the Model Context Protocol.
• A network gateway for outbound requests.

Each checkpoint asks the Dogwood engine whether an action is allowed before it runs. According to the post, Box works with any model and any agent framework, not only AWS's own Strands toolkit, and the trusted code is written in Rust.

How Do History-Aware Policies Work?

Most permission systems answer a simple question: is this action allowed? Strands Box asks a better one: is this action allowed given what came before? Because the checkpoints share one record of events, a rule can connect activity across different tools.

The examples in AWS's post make it concrete.

• Allow a git push only if the test suite passed since the last change was staged, within 15 minutes.
• Limit an agent to 60 calls per hour to a given MCP server.
• Cap spending through a payments API at $100 per day.

CSO Online adds another: reading a sensitive file through the shell can restrict later network requests. That directly addresses the pattern where an agent is tricked into reading private data and then sending it somewhere. The important property is that the sandbox enforces the rule, not the agent, so a confused or manipulated model cannot talk its way past it.

The network gateway can also attach credentials to approved requests without exposing the secrets to the agent itself, CSO Online reports. An agent that never holds a real key cannot leak one.

This builds on ideas we covered in our look at AI agent sandbox design lessons, and it comes from the same team behind the Strands Decider model.

What Are the Limits Today?

AWS is direct about where the preview stands, which is useful for anyone evaluating it.

• Mac only for now: other platforms are intended, with no timeline given.
• A larger trusted base: the interpreters and protocol brokers are part of what must be correct, and Brooker's post acknowledges that more code means more places for bugs.
• Policies take work: the post says writing Dogwood rules is currently difficult and calls it a major area of investment.
• Harness tools: per CSO Online, files accessed directly through an agent harness's built-in tools are covered by OS-level restrictions, not by Dogwood.

For multi-tenant cloud deployments, Brooker recommends pairing Box with a dedicated per-session MicroVM. Analysts quoted by CSO Online make the complementary point that identity controls, monitoring and human oversight still matter.

Why Does This Matter for Agent Security?

The lesson of the past year is that asking a model nicely to behave is not a security control. Deterministic checks outside the model are. Strands Box packages that principle in a form developers can run on a laptop, with rules that read like the intent behind them.

If you run coding agents locally, the practical next step is to try the preview with one conservative policy, such as a rate limit or a network restriction after sensitive reads, and see how it fits your workflow. More defensive tooling is in our AI security coverage.

Sources: Strands Agents blog — October 7, 2026; CSO Online — October 8, 2026; Strands Box on GitHub — accessed October 12, 2026.