SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
AWS open-sources Strands Box, a Mac sandbox whose rules weigh what an agent already did
AWS released Strands Box, an open-source sandbox for AI agents whose rules weigh what an agent has already done before allowing its next action. Operators gain rules that can cap or sequence actions. They also take on more code to trust, by AWS's own account.
The Watch · Security desk
In AWS's walkthrough, an incident-response agent may post to Slack three times in 10 minutes; the fourth post gets an HTTP 403 naming the rule. Brooker's example caps a payments API at $100 a day. Four checkpoints ask the Dogwood engine: shell, Python, MCP broker, network gateway.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Slack posts allowed (AWS example) | 3 posts per 10 min | Fourth post gets an HTTP 403 | 14 |
| Payments API cap (Brooker example) | 100 USD a day | 13 | |
| Checkpoints asking Dogwood | 4 checkpoints | Shell, Python, MCP broker, network gateway | 4 |
What happened
- The release is a developer preview that runs only on Macs with Apple silicon, with Linux support planned.
- Four checkpoints handle the agent's calls: a shell interpreter, a Python interpreter, an MCP broker and a network gateway, each of which asks the Dogwood Local Engine for a decision.
- The network gateway holds the real API keys and gives the agent placeholder tokens, so an agent that dumps its environment variables sees only placeholders.
- Files granted directly in box.toml are fenced by the operating system, and their reads and writes never reach the policy engine or its history.
Why it matters
- capability One rule can cover a read-then-send sequence whichever tool did the read, so operators do not need a separate rule for the shell and another for Python.
- exposure A flaw in an interpreter or protocol interceptor is a route around the rules, so we'd expect researchers to probe those components first.
- cost The cost lands on whoever deploys it: under default-deny, every action the agent needs requires a rule someone writes, and Brooker concedes the policy language can look hard to read and write.
Container and microVM isolation limits what an agent can reach. Once a tool is inside the wall, isolation does not govern how the agent uses it, according to Help Net Security's account [18]. The gap matters most in what AWS calls "YOLO mode," where each action is approved with no human review [19].
Strands Box keeps the operating-system layer. The agent runs in a kernel-enforced sandbox built on macOS Seatbelt [3]. The sandbox's job, says Marc Brooker, author of AWS's companion post on the design, is to make sure "the policy layer is the only way out of the box" [11].
The rules AWS shows all need a record of earlier actions. Among Brooker's examples: an agent may git push once tests have passed, and a payments API can be held to $100 a day [13]. AWS's walkthrough allows an incident-response agent three Slack posts in 10 minutes. A fourth draws an HTTP 403 identifying the rule, signalling the agent to hold off [14]. In our view, a check that sees one call at a time cannot express any of these.
The history has a gap by design. Reads and writes of a directly granted file never reach it, so a rule keyed to earlier file reads will not see them [9]. AWS's instruction is to leave the file off the direct list and have the agent reach it through the interpreters [10].
Those interpreters are the code Brooker flags. He said Strands Box "has more code it needs to trust," including "complex code like interpreters and protocol interceptors" [12]. AWS built that code in Rust and invested in testing, fuzzing and validation, he said [12]. He also said "the reality is that more code means more opportunity for bugs, and in this space, bugs could mean bypassed policy" [12].
Everything above is AWS's description of its own design, relayed by Help Net Security. The account does not report independent testing or a bypass. Strands Box is free on GitHub [17].
What to watch
- Whether the Linux build ships, since the developer preview runs only on Apple-silicon Macs.
- Whether the roadmap CLI that generates a starter box.toml and baseline policy arrives, which would cut the rule-writing burden.
- Any independent test or bug report showing policy bypass in the interpreters or protocol interceptors.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap−10
- Incentives45
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again.
- [2]
Strands Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned.
- [3]
Strands Box puts the agent in a kernel-enforced sandbox, using macOS Seatbelt.
- [4]
Strands Box routes the agent's shell commands, Python code, tool calls and network traffic through four checkpoints: a shell interpreter, a Python interpreter, a broker for MCP servers, and a gateway for network traffic. Each checkpoint asks the Dogwood Local Engine whether to allow the action.
- [5]
Dogwood is a policy language AWS open sourced this year, and anything the engine checks is denied unless a rule permits it.
- [6]
All four checkpoints write to one shared event history, so a rule can link actions across tools.
- [7]
A rule can block outbound HTTP requests after the agent reads a file from a customer-data directory, whether a shell command or a Python script did the reading.
- [8]
For configured API keys, the agent holds a placeholder token and the network gateway swaps in the real value on the way out; for AWS calls, the gateway signs requests. An agent that dumps its environment variables turns up placeholders for those keys.
- [9]
Files granted to the agent directly in box.toml are fenced by the operating system, and reads and writes to them do not reach the policy engine or its history.
- [10]
If you want a rule to govern a file, leave it off the direct grant list and have the agent reach it through the interpreters.
- [11]
Marc Brooker, who wrote AWS's companion post on the design, says the sandbox is there to guarantee that "the policy layer is the only way out of the box."
- [12]
"While we believe our approach is the right one to address the real-world agent isolation challenges we hear from our customers, none of the options in this space come without trade-offs. In particular, Strands Box has more code it needs to trust (security folks would call this the trusted computing base), including complex code like interpreters and protocol interceptors. We have built that code in Rust, and invested in testing, fuzzing, and validation, to improve security. But the reality is that more code means more opportunity for bugs, and in this space, bugs could mean bypassed policy," Brooker explained.
- [13]
Brooker's examples include letting an agent run git push only after tests pass, or capping a payments API at $100 a day.
- [14]
In AWS's walkthrough, an incident-response agent may post to Slack three times in 10 minutes. The fourth post gets an HTTP 403 that names the rule, so the agent knows to wait.
- [15]
Brooker acknowledges that Dogwood policies can look hard to read and write, and says frontier coding agents already write them well; AWS ships a policy-authoring skill for that job.
- [16]
A CLI that detects installed harnesses and generates a starter box.toml and baseline policy is on the roadmap.
- [18]
Containers and microVMs can wall off what an agent reaches, but once a tool is inside that wall, isolation has nothing to say about how the agent uses it.
- [19]
Many agents now run in what AWS calls "YOLO mode," approving each action with no human review; an agent in that state can leave its working directory, run a destructive command or pick up a credential meant for something else.
Sources
1 independent publisher whose own reporting we read for this story.
- helpnetsecurity.comStrands Box: Open-source sandbox for AI agents
1 article · October 11, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Open Source Security ToolsFollow
- Agent security policyFollow
- AI Agent SandboxingFollow
Entities
- Amazon Web ServicesFollow
- Strands BoxFollow
- DogwoodFollow
- Marc BrookerFollow
- macOS SeatbeltFollow
- Help Net SecurityFollow