Amazon Web Services has released an open-source sandbox for autonomous AI agents, built on operating-system-level isolation and a policy engine that takes account of what an agent has already done as well as what it is trying to do next.
Called Strands Box, it is available on GitHub now, though only for macOS for the time being. Linux support is in development and AWS says a Windows client is on its radar, with no release date for either. Deployment to platforms including AgentCore, ECS and Kubernetes is also planned.
The company set out the problem in its announcement. "Agents increasingly run in 'YOLO mode,' approving every action without human review," the AWS team wrote. "The usual solution to this problem is a sandbox … but access is only part of what we want to control."
The containers and microVMs normally used to isolate agents provide strong separation without contextual rule enforcement. Once a containerised agent gets hold of a tool, AWS argues, there may be nothing to stop it doing whatever it wants with it, such as deleting a production database or reaching the open internet.
Strands Box uses the Dogwood Local Engine to give its policy engine temporal awareness, so that a tool call can be checked against the agent's earlier activity and not only against the action itself. It also includes Strands Shell and a Python component called Monty, which expose shell and Python operations to the same policy engine and event history.
AWS offered a worked example: an agent could be allowed to post status updates to Slack, but no more than three times every ten minutes, to prevent it from spamming its human operators. The same mechanism could govern when an agent may perform a Git push, or cap API calls that might otherwise run up a large bill.
"Box's Shell and Python interpreters expose operations such as file deletions, while its gateways expose API requests and tool calls," Marc Brooker, an AWS vice-president and distinguished engineer who worked on both Dogwood and Strands Box, told The Register. "Policies can then account for the action being attempted and earlier activity."
"Box enforces the policies developers configure, deterministically, and the agent can't talk its way around these rules," he said. He added that even with correctly configured permissions an agentic action can still produce an unwanted result, and that "Developers remain responsible for deciding what access to grant and where human review is needed".
"Agent safety is an area where the industry still has significant work to do, and we're committed to continuing to invest in it, both inside the AWS cloud and in open source," Brooker said.
Most of that is ordinary access control, and the ordinary parts work much as they have since the first chroot. One clause is new, and it is the one worth dwelling on: the agent cannot talk its way around these rules.
That is an unusual property for a datasheet to claim. It is not a statement about permissions. It is a statement about persuasion, and it appears in a document that has also found it necessary to describe the default behaviour of its subject as YOLO mode.
Taken in sequence, the product's two central assurances are that the software remembers what it has already done, and that it cannot be reasoned with. Those are not the specifications of a tool.
The worked example confirms the register. The agent may post to Slack three times every ten minutes: not because of a rate limit at the far end, but so that it does not spam its human operators. The quota is a courtesy, enforced because it would not otherwise be observed.
Translate the engineering back into plain terms and the picture settles. A policy engine with temporal awareness is a record of previous attempts. The file deletions are exposed. The API requests are exposed. The gateway keeps the history. The agent is not being sandboxed so much as supervised, with its earlier conduct admissible.
AWS says the industry still has significant work to do on agent safety. The Department of Unnecessary Research agrees, and has one question for the Strands Box team: how many of the rules were written after an agent argued.