Open Source AI Agent Sandbox: Strands Box for Developers

Post Views: 4

Strands Box is an open-source environment by AWS designed to isolate AI agents using operating-system-level containment and policy-driven constraints.

Strands Box: Open-source sandbox for AI agents

AWS introduced Strands Box, an open-source environment designed to isolate AI agents by combining operating-system-level containment with policy-driven constraints that evaluate an agent’s prior actions before authorizing subsequent operations. The tool is currently in developer preview and is compatible with Macs equipped with Apple silicon, with Linux support under development.

Key Features

Policy Enforcement

The solution addresses challenges associated with AI coding assistants, which often operate in a mode where each action is approved without human oversight. Such agents can navigate file systems, execute shell commands, run self-generated code, and interact with APIs, potentially exposing sensitive data or executing harmful operations.

Security Measures

While containerization and microVMs limit an agent’s access to system resources, they do not regulate how the agent utilizes tools within those boundaries. Strands Box mitigates this by enforcing kernel-level isolation using macOS Seatbelt, channeling all agent activities—shell commands, Python scripts, tool interactions, and network requests—through four distinct verification stages.

Verification Stages

These checkpoints include a shell interpreter, a Python interpreter, a mediator for MCP server communications, and a network traffic gateway. Each stage consults the Dogwood Local Engine, a policy engine developed by AWS and open-sourced this year, to determine whether an action is permitted.

Limitations and Considerations

Policy Creation Complexity

Rules defined in the Dogwood policy language govern these decisions, with all four checkpoints referencing a unified policy state. Examples of implemented policies include restricting a git push operation to occur only after passing automated tests or limiting a payments API to a daily transaction cap of $100.

File Access Constraints

In a demonstration, an incident-response agent attempting to post to Slack more than three times within 10 minutes is blocked on the fourth attempt, receiving an HTTP 403 error that identifies the specific rule. The network gateway also manages secrets by substituting placeholder tokens with actual API keys during outbound requests and signing AWS service calls.

Trusted Computing Base

Agents that attempt to expose environment variables encounter masked credentials, ensuring sensitive information remains protected. Files explicitly granted to the agent via the box.toml configuration file are confined by the operating system, with direct access to these files bypassing the policy engine’s historical tracking.

Availability

Strands Box is available at no cost on GitHub, offering developers a framework to enhance the security of AI agents through structured isolation and policy enforcement. The tool introduces a larger trusted computing base compared to alternative solutions, incorporating complex components like interpreters and protocol interceptors.

Agents that attempt to expose environment variables encounter masked credentials, ensuring sensitive information remains protected.

Future Development

AWS acknowledges the complexity of policy creation and provides a policy-authoring tool to assist with configuration. A command-line interface for generating initial box.toml files and baseline policies is planned.