AWS Strands Box Is Open Source: Sandbox AI Agents With Dogwood

AWS just open-sourced Strands Box, a local AI agent sandbox that combines kernel-level OS isolation with a policy engine that can deny actions based on what the agent already did. Released October 7 as v0.1.0, Box is the first open-source tool to put containment and behavioral policies in the same package — and it runs entirely on your machine, no cloud account required.

If you are running AI agents with file access, shell access, and API credentials, you need something like this. Most developers are not using anything.

Default-Deny, Not Block-List

The core security design is worth understanding before you look at the setup. Box starts with everything denied. You explicitly permit what the agent can do. This is the right model — Docker and most cloud sandboxes (E2B, Modal, Daytona) work the other way: they try to block known-bad actions while allowing everything else. That is how you end up with an agent that cannot delete /etc/passwd but can still exfiltrate data to any domain you forgot to block.

Box routes every agent action through four checkpoints before it executes: a shell interpreter, a Python interpreter, an MCP broker for tool calls, and an egress gateway for network traffic. If no policy explicitly permits the action, it does not happen.

Dogwood: Policies That Remember

This is where Strands Box gets genuinely interesting. The Dogwood policy language is Cedar-compatible with added temporal operators — rules that depend on what the agent has already done in the current session.

Some examples from the documentation:

# Allow git push only after tests pass
permit (principal, action == Box::Action::"git:push", resource)
  when { context.last_test_run.passed && context.elapsed_since_last_test < 900 };

# Block uploads after agent reads customer data
forbid (principal, action == Box::Action::"http:post", resource)
  when { context.agent_read_customer_file };

# Rate-limit: no more than 3 posts per 10 minutes
permit (principal, action == Box::Action::"http:post", resource)
  when { context.action_count("http:post", 600) < 3 };

The policy engine runs outside the agent’s process, in Box’s own process. The agent cannot argue or prompt-inject its way around these rules — there is no LLM evaluating the policy, it is deterministic code. That is the point.

Credentials Stay Outside the Box

Box’s egress gateway handles credential injection: your API keys and secrets live outside the sandbox, and the gateway swaps in real values when making authorized requests. The agent sees placeholder tokens, not actual secrets. An agent that gets jailbroken into leaking its environment variables gets nothing useful.

Getting Started

Box requires macOS 15 or later on Apple silicon plus Node.js 22.21+. Installation is a single curl command:

curl -fsSL https://raw.githubusercontent.com/strands-agents/box/main/download.sh | sh
./box-core/box --version

Box is configured through two files in your project directory. box.toml defines the environment — paths the agent can access, environment variables, and credential mappings:

[box]
name = "my-agent"
box_dir = "~/.box/my-agent/state"
policy = "policy.dw"

[env]
WORKSPACE = "/Users/me/projects/my-app"

policy.dw is where you write Dogwood rules. The official getting started guide walks through a complete example with the Strands harness, but Box is harness-agnostic — it works with Claude Code, Codex, or any agent you can invoke from a command line.

What It Does Not Do Yet

Box is a v0.1.x developer preview on one platform. The limitations are real:

• macOS Apple silicon only. Linux support is in development with no release date. Windows is “on the radar.”
• Not deployable to ECS, Kubernetes, or AgentCore yet — those are on the roadmap.
• Some credential source types (OAuth2, token exchange) have open GitHub issues with no maintainer response yet.
• The Dogwood language and box.toml keys can change between releases while in v0.1.x. Pin your release.

The Verdict

Strands Box is not production-ready for most teams today — macOS-only and v0.1 are legitimate blockers. But the architecture is correct. Default-deny plus temporal policies plus out-of-band enforcement is the right model for agent containment, and the fact that AWS open-sourced both Box and the Dogwood engine under Apache 2.0 means the community can build on it.

If you are on Apple silicon and running agents that touch anything sensitive, it is worth integrating now. For everyone else: watch the Linux release. The InfoQ writeup and the AWS announcement post have additional architectural detail if you want to go deeper before the Linux build lands.