AWS Open Source Blog title card reading Introducing Strands Box: AI agent sandboxes powered by Dogwood — AWS announced Strands Box on its Open Source Blog on October 7, 2026. Image: Amazon Web Services.

If your team lets coding agents run with auto-approve switched on, this news is for you. On October 7, 2026, AWS released Strands Box, an open source AI agent sandbox. It controls what an agent can touch and what it can do with it.

Most sandboxes only draw a wall around the agent. Box adds rules that can look at what the agent has already done. That means you can say things like "post to Slack, but only three times in ten minutes."

I'm Nitin from the Debugged Pro team. We build web apps, mobile apps and AI tools for clients in India and the USA, and we use coding agents every day. Here is a plain guide to what AWS shipped, where it falls short and how a small team can try it.

What Is Strands Box, the New AI Agent Sandbox From AWS?

Strands Box is a local sandbox for AI agents. It is in developer preview and licensed under Apache 2.0, so anyone can read, test and change the code. AWS explained the design in its Strands Box announcement on the AWS Open Source Blog.

The problem it targets is simple. AWS says coding assistants and other agents "increasingly run in 'YOLO mode,' approving every action without human review." In that mode, an agent can wander out of its folder, run a risky command or find a credential it should never see.

Box is built on two earlier AWS releases:

Dogwood, an open source policy language for agent rules. It uses the syntax of Cedar, a policy language AWS created.
Dogwood Local Engine, which checks each request against your rules and the agent's recorded history.

Box embeds that engine and enforces its allow or deny decisions around the running agent. It is not tied to AWS's own agent tools. AWS says it works with any harness and any model, on a laptop or in any cloud.

How the Strands Box AI Agent Sandbox Works

Box uses two layers. The first is containment. It uses OS-level isolation, such as macOS Seatbelt, to set a hard wall around the files and network the agent can reach.

The second layer is policy. Inside that wall, Dogwood rules decide which actions the agent may take.

Strands Box architecture diagram showing box.toml and policy.dw feeding a trusted boundary with policy engine, code interpreters, credentials, telemetry, MCP broker and egress gateway above the contained agent and tool boxes — How Strands Box is put together: config files on top, a trusted layer in the middle and the contained agent below. Image: Amazon Web Services.

Four Places Where Rules Apply

AWS checks policy at four enforcement points:

Network egress. All outbound traffic goes through a gateway that sees the host, method and path of each request.
A Shell interpreter. Box ships Strands Shell, so shell commands become clear events like file reads or deletes.
A Python interpreter. It uses Monty, from the Pydantic team, to do the same for Python scripts.
An MCP broker. Calls to Model Context Protocol servers pass through Box, and each local MCP server runs in its own sandbox.

Here is a good example from AWS. If an agent runs rm -rf build/, the shell raises a delete decision for each file. A rule that forbids deletes stops it before anything is removed. Normal edits in the project folder still go through.

Rules That Remember

This is the part we find most useful. Dogwood rules can depend on earlier actions, their order and limits over time. AWS calls these temporal policies.

Marc Brooker, an AWS VP and distinguished engineer, gave a few examples in his post on the thinking behind Box:

Allow git push only if tests passed since the last git add.
Allow a payments API, but only up to $100 per day.
Cap calls to an AWS MCP server at 60 per hour.

When Box blocks an action, the agent does not get a silent failure. The gateway returns an HTTP 403 that names the rule and shows its description. A clear message lets the agent adjust, for example by waiting instead of retrying.

Secrets Stay Outside the Agent

Box also changes how API keys work. The agent only ever holds a placeholder. The gateway swaps in the real secret on the way out, and only for requests your policy allows.

AWS lists five ways the gateway can attach credentials today: bearer tokens, custom headers such as x-api-key, HTTP Basic, query parameters and AWS SigV4 signing. For AWS calls, the agent never sees real AWS keys at all.

Why Harness Permissions Are Not Enough

Most coding tools already ask before running commands. So why add a sandbox? AWS gives two reasons.

First, those prompts run inside the agent's own process. Second, they judge the tool call, not its effect. A harness sees "run this shell command." It does not see which files the command will touch or which hosts it will reach.

There is a team angle too. Every harness has its own rule format, so rules written for one tool may not carry over. With Box, the same two files can apply across your agents.

This matches a risk the security community already tracks. The OWASP Top 10 for LLM applications lists Excessive Agency as a key risk. It covers agents with too much functionality, too many permissions or too much autonomy.

Control	What it handles well	Where it falls short
Harness approval prompts	Quick yes or no on each tool call	Runs inside the agent; sees the call, not the effect
Containers and microVMs	Strong isolation from the host	No built-in rules about what the agent does with a tool
Strands Box	OS isolation plus rules that track history	macOS only for now; more trusted code to get right

The Honest Limits of This AI Agent Sandbox

AWS is open about the trade-offs, and so should we be. Keep these in mind before you roll it out:

macOS only. Linux support is in development. AWS told The Register a Windows client is "on our radar," with no release date for either.
Bigger trusted code base. The shell and Python interpreters run outside the sandbox. Brooker notes that more trusted code means more room for bugs, and bugs here could mean bypassed policy. AWS says it wrote that code in Rust and fuzz tests it.
Not a full cloud boundary. For multi-tenant cloud use, AWS recommends pairing Box with a dedicated microVM per session, such as AgentCore Runtime.
Rules take effort. Dogwood policies are hard to read at first. AWS ships a policy authoring skill so your coding agent can help write them.
Allowed does not mean sensible. A permitted action can still go wrong.

Status chart for Strands Box showing macOS available now, Linux in development, Windows on the radar, and AgentCore, ECS and Kubernetes deployment planned — Where Strands Box runs today and what AWS has said is planned. Graphic: Debugged Pro, based on AWS and The Register.

Brooker put the main point plainly in his comments to The Register: "Box enforces the policies developers configure, deterministically, and the agent can't talk its way around these rules." He also said, "Developers remain responsible for deciding what access to grant and where human review is needed."

What This Means for Agencies in India and the USA

Agencies carry a special kind of risk. Our agents work inside client repos, with client API keys and sometimes client data. One bad command can hurt a client relationship, not just a build.

Think of a Bengaluru team building a Shopify app for a store in Ohio. The developer asks an agent to fix a failing checkout test. Without limits, that agent could read the .env file, call the live payment API or push untested code at 2 AM. With Box, you can block network calls to anything but the model API and the test server. You can also stop pushes until tests pass.

This is not only an AWS story. Microsoft has a similar idea for Windows, which we covered in our post on Microsoft Execution Containers and local AI PCs. And sandboxes can fail, as we saw in Meta's Muse VM escape bugs and other AI agent security lessons. Layers matter.

How to Trial an AI Agent Sandbox on Your Team

You do not need a big security project to start. Here is a simple plan we would follow:

Pick one Mac and one agent. Choose a developer who already uses a coding agent daily on a non-client repo.
Write the box.toml file. List the agent command, the project folder it may read and write, the tools it can run and the hosts it may reach.
Start with deny-by-default rules. In policy.dw, allow only the model API, your package registry and the tools you need.
Add two time-based rules. Block git push unless tests passed, and cap calls to any paid API.
Move secrets to the gateway. Bind keys in box.toml so the agent only sees placeholders.
Run it for two weeks. Use box run --config box.toml and note every block. Each one shows you a rule that was too tight or a risk you missed.
Write a one-page team policy. Decide which repos need a sandbox, who approves new access and which steps always need a human.

If you work on Windows or Linux, you can still do steps 3 to 7 with your current tools while you wait. If you want help setting rules for client projects, our software development consulting team can review your agent setup.

Key Takeaways

AWS released Strands Box on October 7, 2026, as a free, open source AI agent sandbox in developer preview.
It pairs OS-level isolation with Dogwood rules that can track what an agent did before.
Rules apply to network calls, shell, Python and MCP tools, and secrets stay outside the agent.
It runs on macOS only today, with Linux in development and no Windows date.
A sandbox reduces risk but does not replace human review on merges, deploys and client data.

Frequently Asked Questions

What is an AI agent sandbox?

An AI agent sandbox is a walled-off space where an AI agent can run commands, edit files and call APIs without reaching the rest of your system. Good sandboxes also limit network access and keep secrets out of the agent's reach, so a mistake stays small.

Is AWS Strands Box free to use?

Yes. Strands Box is open source under the Apache 2.0 license and the code is on GitHub. It is in developer preview, so expect rough edges. You pay only for the models and services your agent calls, not for Box itself.

Does Strands Box work with Claude Code, Codex or Cursor?

AWS says Box works with any agent or harness and any model, local or cloud. You point box.toml at the agent's command and Box wraps it. AWS has not published a tested list of every tool, so trial your own setup first.

Can I use Strands Box on Windows or Linux?

Not yet. It runs on macOS only today. AWS says Linux support is in development and Windows is on its radar, with no dates for either. Windows teams can look at Microsoft's own agent containment features in the meantime.

Do I still need human review if I use an AI agent sandbox?

Yes. AWS says developers remain responsible for what access they grant and where human review is needed. A sandbox stops actions you forbid. It cannot judge whether an allowed action is a good idea, so keep reviews on merges, deploys and client data.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He works with clients in India and the USA on web, mobile and AI projects, and helps teams adopt coding agents without putting client code or data at risk. He tests new developer tools so clients get plain advice on what is worth using.