Strands Box: Open-source sandbox for AI agents
AWS open-sourced Strands Box, a developer-preview sandbox confining AI agents on Apple-silicon Macs with policy-enforced shell, Python, MCP, and network checkpoints.
Strands Box, in developer preview, places agents in a kernel-enforced macOS Seatbelt sandbox and routes shell commands, Python code, MCP server calls, and network traffic through four checkpoints that query the open-source Dogwood Local Engine policy language on a default-deny basis. A shared event history lets rules span tools, for example blocking outbound HTTP after an agent reads customer-data files. The network gateway holds real secrets, swapping placeholder tokens on egress and signing AWS requests, so agents that dump environment variables find only placeholders. Marc Brooker acknowledges a larger trusted computing base (interpreters, protocol interceptors, written in Rust) and hard-to-author Dogwood policies; the tool is free on GitHub with Linux support planned.
- Kernel-enforced sandbox uses macOS Seatbelt; Linux support is planned.
- Four checkpoints (shell, Python, MCP broker, network gateway) enforce default-deny Dogwood policies.
- Shared event history enables cross-tool rules like blocking HTTP after sensitive file reads.
- Network gateway swaps placeholder tokens for real secrets and signs AWS requests.
- Brooker flags larger trusted computing base and policy-authoring difficulty as trade-offs.
- Organizations
- AWSMarc Brooker
From the original article
3 min read at helpnetsecurity.com
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned. If you run coding assistants, you’re familiar with the problem Strands Box targets.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.