AWS releases Strands Box to restrict AI agent actions with OS isolation and Dogwood policies

AWS released Strands Box, an open-source sandbox for AI agents, on October 7, 2026. The tool combines operating-system isolation with the Dogwood policy language to evaluate agent actions based on their prior behavior, giving security teams a way to control what agents can execute, read, write, or access on a network.

Operations from the shell interpreter, Python interpreter, MCP broker, and network gateway are sent to a shared Dogwood Local Engine for policy evaluation. The engine blocks any operation by default unless a matching permit rule allows it, and a forbid rule overrides any permit. Because the checkpoints share an event history, a rule can block actions—such as an outbound HTTP request—after the agent reads a file from a protected directory, regardless of whether the read came from a shell command or a Python script.

The network gateway provides placeholder tokens to the agent for configured API keys, substituting real keys or signing AWS requests when forwarding traffic. This ensures the agent never sees the underlying secrets. Files the agent can open directly via box.toml are enforced only by the operating system sandbox and are not recorded in the Dogwood event history. To apply policy controls to file access, those files must be reached through the interpreters.

Strands Box currently runs only on Macs with Apple silicon and macOS 15 or later, a limitation that may frustrate developers working on other platforms. AWS has promised Linux support in a future release, but the delay raises questions about whether the sandbox will remain a niche tool or expand to meet broader demand. Example policies include limiting an agent to three Slack posts every ten minutes or capping a payments API at one hundred dollars per day.

The sandbox’s Rust-based codebase has undergone rigorous testing, fuzzing, and validation, though AWS’s Marc Brooker acknowledges that more code increases the trusted computing base and raises the risk of bugs that could bypass policy. AWS also plans to release a command-line interface that detects installed agent harnesses and generates a starter box.toml file with a baseline policy.

Strands Box is distributed under the Apache 2.0 license, with its source code available for free on GitHub. While the tool addresses a clear need—controlling AI agent behavior before deployment—its current platform restrictions and the inherent risks of expanding the trusted computing base suggest this is just the first step in a longer evolution.