AWS introduces Strands Box open source AI agent sandbox

AWS has launched the developer preview of Strands Box, an open source sandbox designed to secure autonomous AI agents. Licensed under Apache 2.0, the tool uses OS-level containment and the Dogwood policy language to enforce fine-grained rules based on an agent's action history. It intercepts operations across network egress, Python, Shell, and Model Context Protocol (MCP) servers to prevent unauthorized file access or network requests.

Technical architecture of Strands Box

• Uses a two-layer approach: containment (OS-level isolation like macOS Seatbelt) and policy (governance via Dogwood).
• Employs the Dogwood Local Engine to evaluate permissions based on current requests and historical event logs.
• Enforcement points include a network egress proxy, a Python interpreter (using Monty), a Shell interpreter (using Strands Shell), and an MCP broker.
• Provides contextual security, such as limiting the frequency of specific actions (e.g., Slack posts) or blocking network requests after specific file reads.
• Operates via local sockets, allowing interpreters to run outside the sandbox while enforcing decisions from the host process.

Why it matters

By providing a standardized, history-aware policy language for AI agents, Strands Box aims to move agent security beyond simple container isolation toward granular, context-dependent governance.