AWS Releases Open-Source Strands Box to Contain Autonomous AI Agents

AWS has released Strands Box, an open-source sandbox designed to isolate autonomous AI agents and restrict their execution environment through stateful policy controls. Currently in developer preview for macOS on Apple silicon with Linux support planned, the tool addresses the security risks introduced by coding assistants and agentic workflows operating without step-by-step human intervention.

As organizations deploy agents to inspect repositories, execute shell commands, run generated code, and interact with external APIs, many operate in fully automated execution modes—frequently dubbed “YOLO mode.” While traditional containerization and microVM isolation erect perimeter walls around an execution space, they fail to regulate internal tool usage once an agent is inside those boundaries. Strands Box combines kernel-level operating system isolation with dynamic policy enforcement to govern how agents interact with system resources over time.

The Threat Landscape of Unconstrained Agency

The primary threat vector targeting autonomous AI workflows revolves around excessive agency and indirect prompt injection. When an agent processes untrusted inputs—such as a third-party GitHub repository, an external file, or an API response containing malicious instructions—it can be hijacked to perform actions unintended by the user.

In an uncontained or statically containerized environment, an agent compromised via prompt injection possesses the full permissions of its environment. It can read local configuration files, dump environment variables containing API keys, perform destructive shell commands, or initiate exfiltration requests to actor-controlled infrastructure. Traditional boundary isolation models cannot prevent this because the agent is using legitimately provisioned tools—such as a terminal shell or network client—in an unauthorized sequence.

Strands Box addresses this risk by assuming that tool access must be governed by dynamic context rather than static permission grants.

Four-Checkpoint Architecture and Stateful Enforcement

Strands Box implements isolation at the OS level using macOS Seatbelt, placing the agent inside a kernel-enforced sandbox. To prevent the agent from bypassing policy checks, all egress and tool interactions are funneled through four mandatory checkpoints:

• Shell Interpreter: Intercepts and validates command-line invocations before execution.
• Python Interpreter: Evaluates dynamically generated or executed scripts.
• MCP Broker: Manages and inspects interactions with Model Context Protocol (MCP) servers.
• Network Gateway: Filters and rewrites outbound HTTP traffic and network requests.

Each checkpoint evaluates proposed actions against the Dogwood Local Engine, an open-source, deny-by-default policy language released by AWS. Crucially, all four checkpoints record actions to a single shared event history. This enables stateful policy evaluation, allowing rules to weigh an agent’s prior behavior before authorizing its next action.

For example, a static firewall rule might allow an agent to access both internal repositories and external endpoints. Under Strands Box, a stateful Dogwood policy can allow the agent to read internal customer data directories, but automatically block any subsequent outbound network requests across all interpreters once that read event appears in the history. The framework can also enforce behavioral rate limits, such as restricting API calls (e.g., blocking a fourth consecutive Slack message within ten minutes) or capping financial transaction thresholds on payment APIs. When an action is blocked, the engine returns an HTTP 403 error explicitly identifying the violated policy, allowing the agent to adjust its execution path.

Credential Protection and Secret Masking

Managing credentials within autonomous agent environments presents severe security challenges, as agents frequently output environment variables during debugging or error logging. Strands Box offloads secret management to its network gateway.

Instead of passing live API keys directly into the agent’s environment, configuration files store placeholder tokens. When the agent issues an outbound request, the network gateway intercepts the payload and swaps the placeholder token for the actual secret in transit. For AWS service calls, the gateway handles request signing automatically. If an agent is compromised or attempts to print its local environment variables, it only exposes non-functional placeholder values.

Architectural Trade-offs and TCB Expansion

While Strands Box offers substantial improvements in behavioral governance, it introduces specific design trade-offs that security teams must evaluate:

• Bypassing History via Direct Grants: Files explicitly granted to the agent in the box.toml configuration file are fenced directly by the operating system. Because reads and writes to these files bypass the policy engine and shared event log, they cannot trigger stateful rules. Governance over specific files requires forcing the agent to access them through policy-monitored interpreters rather than direct file grants.
• Expanded Trusted Computing Base (TCB): To enforce checkpoint monitoring, Strands Box relies on complex software components, including custom interpreters and protocol interceptors. Although written in Rust and subjected to fuzzing and automated validation, this larger TCB increases the attack surface for potential parser flaws or isolation bypass vulnerabilities.
• Policy Complexity: Crafting granular Dogwood policies requires significant effort. AWS is addressing this barrier by supplying policy-authoring skills for frontier coding models and planning CLI tooling to automatically generate baseline box.toml files based on installed developer harnesses.

Security teams evaluating Strands Box for development environments should begin testing the developer preview on macOS host systems, mapping out agent tool dependencies, and establishing baseline Dogwood policies before integrating autonomous workflows into build pipelines or production repositories.