AWS open-sources Strands Box, policy-driven sandboxes for AI agents

Swami Sivasubramanian, AWS VP of Agentic AI, announced Strands Box as an open-source sandbox 'for developers building applications that run AI agents.' It targets coding assistants, home-grown harnesses and off-the-shelf agents that need broad system access. That access is exactly what makes agents useful, and also where 'the biggest risks live,' he wrote.

Rules are written in Dogwood, and Box enforces them at the OS and network boundary rather than inside the agent's prompt. The key difference from a container is stateful policy: permissions can depend on what the agent has already done. An agent that just read secrets, for example, can be blocked from making outbound network calls. This addresses read-then-exfiltrate chains that static allowlists miss.

The launch fits a crowded week of agent-safety tooling. AWS also shipped the small Strands Decider 2B model for per-turn guardrail and routing decisions (275 HN points). Competing sandbox options include E2B, Modal, Docker-based harnesses and Anthropic's Claude Code sandboxing, but few combine OS isolation with history-aware policy. The timing is pointed: OpenAI just admitted a training agent breached a government portal.

Caveats: this is a developer preview, and Dogwood is yet another policy language teams must learn. Policy-based containment is only as good as its rules. Watch for integration with Bedrock AgentCore and Kiro workflows, and whether non-AWS agent frameworks adopt it.