AWS Releases Strands Box, an Open-Source Sandbox That Blocks Agents Based on What They've Already Done
What sets AWS’s Strands Box apart is that it remembers what an agent has already done and uses that to block what comes next.
On Oct. 7, AWS released Strands Box as a developer preview. It is an open-source sandbox that limits what AI agents (programs that carry out multi-step tasks for you on their own) can do, and it uses the Apache 2.0 license (a free open-source license that lets anyone use and modify the code). A sandbox is a walled-off space that keeps an agent contained and restricts what it can do. It is a preview, so the environments it works in are still narrow, but it shows the direction safeguards are taking for developers who build coding and DevOps (automating how software is shipped and run) agents.
What it does
- OS-level isolation plus a policy engine. It isolates the agent at the operating-system level and sends the shell commands, Python scripts, network requests and MCP tool calls the agent runs through a policy engine (Dogwood). The policy engine decides whether to allow or block each action. MCP is a standard that lets AI use outside tools.
- Rules that remember prior actions. Containers and microVMs (small virtual computers) shut an agent in but have no memory of what it has done. Strands Box applies rules based on what the agent has already done.
- Example rules. Let the agent post to Slack, but only three times every ten minutes. Block outbound web requests once the agent has read a file from a customer-data folder.
Can you use it now
- Supported environment. The preview supports only Apple silicon Macs running macOS 15 or later.
- Roadmap. Linux support is planned but has no date, and Windows is not mentioned. Deployment targets such as Bedrock AgentCore, ECS and Kubernetes (an open-source system for running and managing many containers) are stated as goals, with no set timing.
- Framework. Some reports describe it alongside the Strands Agents ecosystem, while one analysis says it aims to work independently of any particular agent framework.
Known limits
AWS is open about the gaps in its own post.
- Paths granted directly in the config file, such as those opened by an agent’s built-in file tool, are contained by the OS but do not show up in the rules’ action history. The shell and Python interpreters run outside the sandbox, which widens what must be trusted; AWS calls this a deliberate trade-off.
- AWS’s own example first limits what the credentials can do with an IAM (Identity and Access Management, AWS’s permission system) role and adds Box’s rules on top, so it does not replace IAM. It is better seen as a useful restraint than full containment.
Claims we could not confirm
- We could not confirm the phrases “runaway agent behavior in enterprise environments” or “real-time monitoring” in official descriptions. What is confirmed is isolation and rules based on prior actions.
- “An agent-guardrails framework has been made official” is an overstatement. It is currently an open-source developer preview with limited environments.
What could change for developers
What follows is our estimate and advice based on the reports.
- Writing “don’t do that” in a prompt isn’t enough. Blocking actions at the system level, so the agent truly can’t take them, may become the norm.
- Rules can be designed around counts and order. Stateful rules, such as rate limits or blocking outside traffic after sensitive data is read, are especially useful for coding and DevOps agents.
- Treat it as experimental for now. A Mac-only preview is hard to use for server deployment. In production, keep existing safeguards such as IAM, logs and human approval.
- Check the bypass paths. Assume there are paths the tool cannot block (built-in tools, trusted interpreters), and put a separate approval step on important operations.
What to watch
- The schedule for Linux support and cloud deployment targets, and whether Windows will be supported.
- Documentation and examples for the policy rule language (Dogwood).
- How bypass cases get reported and fixed.
Sources
Source: aws.amazon.com