Strands Box: Open Source AI Agent Sandbox

What changed

Strands Box has been released as an open-source sandbox engine designed to run AI agents with restricted permissions. Written in Rust, Box combines operating-system-level isolation with a policy language called Dogwood to control what agents can execute, read, write, and access on the network. The system enforces a default-deny stance, requiring explicit permit rules for any operation, with forbid rules overriding permissions. Box supports local execution on Linux ARM64 and macOS with Apple silicon, while Linux x86-64 support is currently experimental and requires specific environment variables to be set. The latest release is v0.2.2.

Key capabilities include file, program, and network restrictions enforced by the OS and the Dogwood policy engine. Policies can be semantic and temporal, considering previous actions and elapsed time. This allows for complex rule-setting, such as denying a network request based on a prior file read operation. Box also supports request and tool-call checks through its egress gateway and MCP integration, respectively. A notable feature is credential injection, which allows permitted requests to be authenticated using API credentials or AWS SigV4 signing without exposing the underlying secrets to the agent. Policy decisions are recorded in OTLP JSON format.

Box can be used as a Rust library by linking the strands-box package. It allows for programmatic execution of Box within a calling process, with options to supply the workload's terminal and start host threads after hardening. Policies can also be reloaded dynamically using the strands_box::reload function, enabling updates without restarting the agent. The system includes functionality to generate policy schemas.

Why it matters for builders

For AI builders, Strands Box offers a robust framework for deploying AI agents more safely and predictably. The granular control over agent actions, from file system access to network communication, is crucial for mitigating security risks and preventing unintended consequences. By enforcing policies at multiple levels, developers can ensure that agents adhere to operational constraints, making them more reliable for integration into complex systems. The ability to dynamically reload policies also provides flexibility in managing agent behavior post-deployment.

Practical impact

Developers can begin by downloading Box for macOS or Linux ARM64 and exploring the provided getting-started guide. The Strands CLI walkthrough offers a practical example for macOS users, requiring Node.js and access to Claude Opus 5 on Amazon Bedrock. Builders can configure agent environments and direct access grants by editing box.toml and define operational rules in policy.dw. For assistance with Dogwood syntax and supported actions, a policy-authoring skill is available via a GitHub link. The project welcomes feedback through GitHub issues, encouraging community contribution to its development.

Caveats and source limits

Linux x86-64 support is explicitly marked as experimental and requires manual opt-in, with release downloads currently limited to ARM64. The source does not provide independent benchmark results for the sandbox's performance overhead or specific security testing outcomes. Pricing information is not applicable as it is an open-source project. The exact scope of supported AI models or agent frameworks is not detailed, beyond general mentions of running agent programs or binaries. Further details on the Dogwood policy language's full capabilities and limitations are not elaborated upon in the provided excerpts.