AWS open-sources Strands Box to fence in autonomous agents

AWS has released Strands Box, an open-source sandbox intended to stop AI agents taking damaging actions without human review, according to a report published by The Register on 7 October 2026. The tool is aimed at developers running agents in what AWS calls "YOLO mode", where every action an agent proposes is approved automatically.

"Agents increasingly run in 'YOLO mode', approving every action without human review," the AWS team said in its announcement, as quoted by The Register. "The usual solution to this problem is a sandbox ... but access is only part of what we want to control."

The company's argument is that containers and microVMs, the lightweight virtual machines commonly used to isolate agents, provide strong separation but no contextual rule enforcement. As AWS describes the problem, once an isolated agent gets hold of a tool there may be nothing to stop it doing whatever it wants with that tool, such as deleting a production database or reaching the open internet.

Strands Box combines operating-system-level isolation with other open-source components AWS has released recently. It uses the Dogwood Local Engine to give its policy engine temporal awareness, meaning tool calls are checked not only against what the agent is asking to do but against what it has already done. AWS offered the example of an agent permitted to post status updates to Slack, but no more than three times every ten minutes, so it cannot spam its human operators. An AWS spokesperson told The Register that Box could also govern when an agent is allowed to perform a Git push, or cap the number of API calls an agent can make to avoid a large bill.

The package also includes Strands Shell and Monty for Python. These expose shell and Python operations to the same Dogwood policy engine and event history, which AWS says makes agent actions clearer to developers and lets policies take account of what an agent is attempting.

An AWS vice-president and distinguished engineer who worked on Dogwood and Strands Box told The Register that the interpreters are central to making agent behaviour intelligible, so developers can write more precise policies. "Box's Shell and Python interpreters expose operations such as file deletions, while its gateways expose API requests and tool calls," he said in an email. "Policies can then account for the action being attempted and earlier activity." He added that Box enforces those rules without relying on the agent to follow instructions, and that "the agent can't talk its way around these rules".

AWS was careful not to present the sandbox as a complete answer. Even with correctly configured permissions, the engineer said, an agentic action can still produce an unwanted result. "Developers remain responsible for deciding what access to grant and where human review is needed," he told The Register. He also said that agent safety "is an area where the industry still has significant work to do", and that AWS intends to keep investing in it both inside its cloud and in open source.

Strands Box supports any agent or harness and is available on GitHub now. For the moment it runs only on macOS. Linux support is in development, and AWS said a Windows client is "on our radar", though neither has a published release date. The company also plans deployment to AgentCore, ECS and Kubernetes.