Strands Box: Open-source sandbox for AI agents

AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned.

If you run coding assistants, you’re familiar with the problem Strands Box targets. Agents read files, run shell commands, execute code they wrote and call APIs, and many now run in what AWS calls “YOLO mode,” approving each action with no human review. An agent in that state can leave its working directory, run a destructive command or pick up a credential meant for something else.

Containers and microVMs can wall off what an agent reaches, but once a tool is inside that wall, isolation has nothing to say about how the agent uses it.

One exit, and it runs through policy

Strands Box puts the agent in a kernel-enforced sandbox, using macOS Seatbelt, and routes its shell commands, Python code, tool calls and network traffic through four checkpoints: a shell interpreter, a Python interpreter, a broker for MCP servers, and a gateway for network traffic. Marc Brooker, who wrote AWS’s companion post on the design, says the sandbox is there to guarantee that “the policy layer is the only way out of the box.”