AI agent sandboxing: AWS releases open-source Strands Box

What happened

Amazon Web Services (AWS) has released Strands Box, an open-source sandbox for AI agents that can restrict what an agent does based on its previous behaviour. The company is positioning it as a response to security risks that arise as enterprises give autonomous systems wider access to applications and data.

Strands Box combines operating system-level isolation with policies that govern agent actions. It entered developer preview on 7 October under the Apache 2.0 licence and currently runs only on Macs with Apple silicon processors running macOS 15 or later. Coverage by InfoWorld notes that the tool is aimed at developers working with agents that act autonomously.

Decisions about whether an agent may carry out an action are made by Dogwood, an open-source policy language developed by AWS, together with its accompanying evaluation engine. Crucially, the engine can account for an agent's recorded activity across different tools. In the example AWS gives, a file read carried out through a shell command could subsequently trigger restrictions on network requests.

Why it matters

The significance lies less in the sandbox itself than in what it implies about how agentic AI is being governed. Agents that can read files, call tools and reach external services are only as safe as the controls around them, and static permissions struggle to capture how an agent's earlier actions should shape what it is allowed to do next. A policy engine that reasons over behaviour across tools suggests that governance is moving from a one-time access decision towards continuous, context-aware control.

For leaders in digital transformation, this points to a practical shift in operating model. Teams deploying agents into production workflows, such as incident response, will need clear boundaries on autonomy, along with ways to audit and explain agent decisions. Organisations might treat agent sandboxing and policy design as part of their core engineering and risk functions rather than as an afterthought once a pilot is running.

By the numbers

• 7 October: date on which Strands Box entered developer preview.
• Apache 2.0: open-source licence under which the tool was released.
• macOS 15 or later: minimum operating system version currently supported, on Macs with Apple silicon.

The Renascence take

Most readers will focus on the security headline, but the more useful signal is that the hard problem with agents is memory of behaviour, not just permission to act. Our experience with service design shows that people trust a system when its rules are legible and proportionate, and an agent that can explain why a network call was blocked after a file read is far easier to govern than one with a flat allow list.

The real risk is an agent that behaves reasonably at each step and unreasonably in sequence, and that is a service-design failure as much as a security one. Treat agent permissions the way you would design an escalation journey: define the thresholds, make the reasoning visible to the people who own the outcome, and test the handoffs before customers or staff depend on them. Customer-obsessed operators should pilot agents in narrow, observable workflows, instrument every tool call, and expand autonomy only when the logs show the experience is predictable.