Organisations gain open-source sandbox to enforce strict policy isolation for autonomous AI agents

AWS has released Strands Box, an open-source sandbox designed to restrict the actions of autonomous AI agents. The tool pairs operating-system isolation with a policy layer that evaluates an agent’s previous behaviour before permitting further actions. According to Help Net Security, the software is currently in developer preview and runs on Macs with Apple silicon, with Linux support planned for the future. This release addresses the risks associated with coding assistants that operate without human review.

Many AI agents currently run in what AWS describes as “YOLO mode,” approving each action automatically. In this state, an agent can leave its working directory, execute destructive commands or access credentials intended for other purposes. While containers and microVMs provide isolation, they do not control how an agent uses tools once inside. Strands Box aims to fill this gap by enforcing policies on every action the agent attempts to perform within its environment.

What we know

Strands Box places the agent in a kernel-enforced sandbox using macOS Seatbelt. It routes shell commands, Python code, tool calls and network traffic through four distinct checkpoints: a shell interpreter, a Python interpreter, a broker for Model Context Protocol (MCP) servers and a network gateway. Marc Brooker, who authored AWS’s companion post on the design, stated that the sandbox ensures the policy layer is the only way out of the box. This architecture prevents agents from bypassing security controls through direct system access.

Each checkpoint queries the Dogwood Local Engine to determine whether to allow an action. AWS open-sourced the Dogwood policy language earlier this year. The engine operates on a deny-by-default basis, meaning any action is blocked unless a rule explicitly permits it. All four checkpoints write to a shared event history, allowing rules to link actions across different tools. For example, a rule can block outbound HTTP requests if the agent previously read a file from a customer-data directory, regardless of whether a shell command or Python script performed the read.

Brooker provided examples of how these rules function in practice. An agent might be allowed to run a git push command only after tests pass, or a payments API call might be capped at $100 a day. In an incident-response scenario, an agent could post to Slack three times in ten minutes, with the fourth attempt receiving an HTTP 403 error that names the rule. This feedback helps the agent understand it must wait. The network gateway also manages secrets by swapping placeholder tokens for real API keys on the way out, preventing agents from exposing credentials if they dump environment variables.

Defender's checklist

• Verify that AI agents operate in restricted environments rather than full “YOLO mode” with automatic approvals.
• Implement policy engines that deny actions by default and require explicit rules for permissions.
• Use shared event histories to link actions across tools and prevent context-switching attacks.
• Ensure network gateways handle secret management by swapping placeholders for real credentials externally.

Background: AI agents

AI agents are the software entities that perform specific tasks using instructions from large language models. Agentic AI is the architectural approach that grants these agents autonomy to plan, reason and act. You use agents as tools within agentic AI systems to achieve complex, multi-step outcomes without manual oversight at every stage.

Read the full guide: AI Agents vs Agentic AI: The Distinction That Matters

What to do and how to stay safe: AWS

• Audit existing AI agent configurations to identify those running with unrestricted access to shell commands or APIs.
• Review how agents handle credentials and ensure keys are not stored in accessible environment variables.
• Test policy enforcement mechanisms to verify that agents cannot bypass checkpoints or access files outside their sandbox.
• Monitor agent activity logs for attempts to execute destructive commands or access sensitive directories, once the vendor provides an update.

Step-by-step guide: AI Governance for Small Teams: Practical Controls and Cost

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What platforms does Strands Box currently support?

Strands Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned.

How does Strands Box handle secrets and API keys?

The network gateway swaps placeholder tokens for real API keys on the way out, so agents only see placeholders.

What happens if an agent tries an action not covered by a rule?

The Dogwood Local Engine denies the action by default unless a specific rule permits it.