AWS open-sources Strands Box, a local sandbox that enforces policy on every AI agent action

AWS announced Strands Box as an open source local sandbox for AI agents, released in developer preview. It works with any model and any agent framework, not just AWS's own Strands harness, and builds on Dogwood, the policy language AWS open-sourced this year. AWS's Marc Brooker says the goal is "semantic policy": rules set per tool and deterministically enforced, such as allowing an agent to git push only when tests pass, or to use a payments API only up to $100 a day.

Box confines the agent in a kernel-enforced sandbox built on the operating system's own isolation mechanisms (the preview runs locally on macOS with Apple silicon) and routes shell commands, Python code, MCP tool calls and network traffic through four checkpoints that ask Dogwood's local engine for permission, denying anything not explicitly allowed. Because all checkpoints write to one shared history, a rule can link actions across tools, for instance blocking outbound HTTP after the agent reads a file from a customer-data directory. The network gateway also keeps secrets out of the agent: it holds placeholder tokens and swaps in real API keys, or signs AWS requests, on the way out.

AWS acknowledges the trade-offs: Box has a larger trusted computing base than a microVM, including interpreters and protocol interceptors, which it built in Rust and has fuzzed and tested, but more code means more chances for bugs that could bypass policy. Files granted to the agent directly are protected only by the OS and are not seen by the policy engine. Strands Box is free on GitHub.