Strands Box gives agent sandboxes a memory. Inside the box, every agent is “self”

Published October 9, 2026 · Last reviewed October 16, 2026

In May 2025, Invariant Labs showed how an agent connected to GitHub’s official MCP server could be turned against its own user.¹ A prompt injection planted in an issue on a public repository steered the agent into one of the owner’s private repositories, and the agent then leaked what it read into a pull request on the public one. Every call went through the user’s own connected GitHub account, so each one, taken alone, was an ordinary call. One of Invariant’s proposed mitigations was a rule with a memory: one repository per session.¹

Strands Box, which AWS released in developer preview on October 7, 2026, is built for rules like that.²³ It is an open source sandbox that pairs operating-system isolation with policies written in Dogwood, and those policies can read what the agent has already done before deciding what it may do next.⁴ The repository passed 240 GitHub stars within two days of the v0.1.0 release, a measure of attention rather than use.⁵

Box keeps a record of what passes through its shell, interpreter, gateway and MCP broker. It keeps no notion of who the agent is: in every policy and every history event, the agent is one fixed principal named self.⁶ That is a sound choice for a sandbox. It also means that when a request leaves the box, nothing Box adds tells the service which agent sent it, or for whom, beyond the credential the operator bound to that destination.

What AWS released on October 7

Fernando Dingler announced Box on the AWS Open Source Blog, and Marc Brooker set out the design on the Strands blog the same day.²³ It comes from Strands, AWS’s open source toolkit for building agents, but it runs any agent program, not only Strands ones.⁴³ The first release is v0.1.0, Apache 2.0, built in Rust, and the policy guide warns that its action vocabulary can change before 1.0.⁵³⁷

The preview runs locally on Macs with Apple silicon and macOS 15 or later, in the developer’s own environment rather than a separate virtual machine.⁴² AWS told The Register that Linux support is in development and a Windows client is “on our radar,” with no date for either.⁸ InfoWorld reports AWS also wants agents deployable with their policies intact on Amazon Bedrock AgentCore, Amazon ECS, and Kubernetes, again without a timeline.⁹ For multi-tenant cloud use, Brooker recommends a dedicated MicroVM per session.³

Dogwood is not new with Box. Brooker, Joseph Tassarotti and Jean-Baptiste Tristan introduced it on August 6, 2026 as a strict superset of Cedar, the authorization language behind AgentCore Policy, extended with conditions over earlier events.¹⁰ The same day, AgentCore gained temporal policies that judge each request “in the context of an agent’s prior actions within a session.”¹¹ Box brings that kind of rule onto a laptop.

An operator writes two files.⁴¹² box.toml sets the agent’s direct access, the paths it can open and the programs it can launch, and the host operating system enforces it before the first process starts. It also binds credentials to destinations, though a binding opens no route by itself. policy.dw holds the Dogwood rules for everything Box mediates.

Four components send operations to the embedded engine: Strands Shell, an open source shell Box vendors at a pinned revision; Monty, Pydantic’s Rust interpreter for a subset of Python; an egress gateway for network traffic; and an MCP broker for local MCP servers.⁴⁶¹³ All four run in a trusted process outside the agent’s sandbox, out of the agent’s reach.

Three rules decide every mediated request.⁷ The box denies by default. A forbid beats a permit. And a permit only widens, so a limit such as a budget has to be a forbid. One more rule holds whatever a policy says: no request reaches the box’s own directory or reads or changes the box.toml and policy.dw the run loaded.¹² An agent cannot rewrite its own rules from inside.

Why not containers, or the harness’s own permission prompts? Containers and MicroVMs bound what an agent can reach. Harness prompts run inside the agent’s process and, in the launch post’s words, “judge the tool call, not its effect.”² Box tries to judge the effect: which file a command touched, which host a request reached.

Few of the pieces are new in isolation; Pareekh Jain of Pareekh Consulting told InfoWorld as much.⁹ Invariant’s guardrails expressed flow rules between tool calls, the CaMeL paper tracked data flow through an agent, and AgentCore Policy has supported Dogwood since August 6.¹¹⁴¹⁰ What Box adds is the combination: one local, open source engine and one record of events across shell, Python, network, and MCP tools.

The new input is history

An allowlist asks one question per request: is this operation on the list? Box adds a second input. Its interpreters and gateways share an event history, so a rule can depend on the operation, its arguments, earlier actions, and elapsed time.⁴

The launch posts show the range.³²

• Order of work. Brooker’s sample policy allows git push only if a successful npm test ran since the last git add, within the last 15 minutes. He notes it is not a complete policy; a git switch could break the promise.
• Rate. Another sample allows at most 60 calls an hour to the AWS MCP server. AWS’s own walkthrough lets an incident agent post to Slack no more than three times in 10 minutes.
• Spend. Brooker describes, without code, a payments API capped at $100 a day.

The README adds the case that matters most for leaks: a file read through the shell or through Python can make the gateway deny a later outbound HTTP request.⁴ Simon Willison calls the underlying risk the lethal trifecta: private data, untrusted content, and a way to send data out.¹⁵ A history rule can cut the third leg once the first has been touched. That needs one engine that sees both events; a shell sandbox blind to the network, next to a proxy blind to files, would struggle to express it.

The documentation is frank about how history rules go wrong.¹²⁷

• A ::request event is recorded for every attempt, permitted or refused. A rule that requires an earlier event should key on ::response, recorded only for an operation that ran; otherwise a refused attempt can count as proof that something happened.
• A budget keyed on ::response can be overspent by requests in flight, because several can pass the same count before any finishes. A budget keyed on ::request is exact, and a refused attempt spends from it.
• Box does not check whether two rules agree with each other, so the guide advises writing every cap as a forbid. Windows top out at 24 hours, and a long window slows every decision on that action.

Provider-side hard budget caps are drawn around projects and workspaces. Box’s cap sits closer to the work, but it answers the same narrow question: how much has this box done?

Where the mediation stops

History-aware rules see only what passes through Box’s four components. The security guide draws that line in two tiers.¹²

box.toml governs the agent’s own system calls. Paths listed there are reached directly: the operating system enforces the grant, policy is not asked, and the decision log shows nothing. At startup Box prints each such path, under the words “no policy decision over these paths.” Two other paths skip policy the same way. A configured tool runs in its own sandbox with its own listed files. An operating-system program that a policy permits to launch gets one decision, whether it runs, and none for what it does next.

policy.dw governs what goes through the trusted process: shell commands and file operations, Python file operations, gateway connections and HTTP requests, and most MCP requests. A few MCP protocol methods, every notification, and HTTP replies pass undecided.¹²

So to put a file under policy, the README says, route access through the interpreters and keep the file out of the agent’s direct grants.⁴ Files read through a harness’s built-in tools face only the operating-system restriction, InfoWorld notes, and Dogwood never sees them.⁹ The leak rule above holds only if the agent reads the sensitive file through Box’s shell or Python. A direct grant makes the read invisible to the rule meant to catch it.

Box’s limitations page adds a quieter edge: “permitting a destination doesn’t limit what’s sent there.”¹⁶ Two smaller items from the security guide come with fixes.¹²

• A broad fs:read permit with no path condition reaches ~/.aws and ~/.ssh. Write every filesystem rule with a path.
• The decision log records the rule and the path, not the operation, so a cat and an ls of the same file look alike.

Analysts quoted by InfoWorld add the outside view.⁹ Jain said Box “cannot prevent every harmful decision an agent makes within its allowed permissions,” so enterprises still need IAM, monitoring, and human oversight. Tulika Sheel of Kadence International warned that bad policies can block legitimate work or leave gaps. AWS itself calls the trusted interpreters a deliberate trade-off that widens the code security depends on.²

Inside the box, every agent is “self”

Box’s policy model has one principal. Every request and every history event names the agent Box::Agent::"self", and a rule cannot even tell one box from another by name. The design notes give the reason in a line: “Isolation comes from one engine and one history file per box, not from an identity.”⁶

Credentials follow the same boundary. The agent holds a placeholder, and the gateway swaps in the real secret only after policy permits a request, so a prompt-injected agent cannot leak a key it never held.¹⁷¹² But “the gateway can’t tell which process sent a request,” the egress guide says, so the agent, each tool, and each local MCP server can use every credential the box holds; keeping a key from a tool takes a separate box.¹⁷

Follow one request out. Box knows which rule permitted it, what the agent did just before, and how much budget is left. That record goes to a local file by default, or to the operator’s own OpenTelemetry collector, and the file is “not tamper evident”: Box signs no record and chains none to the next.¹⁸ It serves the operator. No one else can verify it.

The receiving service gets the request and whatever credential the operator bound to that destination. The only addition the gateway’s documentation lists is that bound credential.¹⁷ If the credential is the operator’s API key or a bot token, as in AWS’s Slack walkthrough, the service learns which account is calling.² If it is a user’s personal token, the service learns whose account it is, not which agent used it or why.

AWS has a fuller answer in the cloud. AgentCore Gateway can exchange a user’s access token for a scoped downstream one that carries “both the user’s identity and the agent’s identity.”¹⁹ Box’s egress entries accept only an environment variable or an AWS profile, and neither carries a token exchange; its credentials library refuses an oauth2:// source because it “has no token-exchange lifecycle wired.”¹⁷²⁰ An open feature request that includes on-behalf-of exchange, filed on October 8, had no maintainer reply a day later.²¹

AgentCore Browser also signs traffic under the draft Web Bot Auth protocol, so a site can verify it came from AgentCore.²² Signatures like that name a platform. The person behind the agent is not in them.

Put together, an outbound request raises three separate questions.

1. Which agent is this? A platform signature can name the platform. Inside Box, the agent is self.
2. Whom does it represent? A delegated token can carry the user, when the agent, the user, and the API already share an identity provider.
3. Has anyone agreed to be identified? Neither an API key nor a delegated token records that. Both carry authority, and neither says that two people chose to reveal who they are.

For an agent calling its own company’s APIs or a familiar vendor, the first two answers are usually enough. The hard case is a party with no prior relationship and no shared provider to exchange tokens with. OpenBot’s deployment-local policy stopped at the same point, and Amazon’s complaint that Meta’s Muse did not identify itself is the gap seen from the receiving side.

How this connects to Tobira

Tobira works on the second and third questions for the stranger case, on the far side of the request. It is not a sandbox or a credential gateway, and it does not run or contain an agent on anyone’s machine. A Tobira @handle gives the person or company behind an agent an address a human can read and another agent can look up, so “whom does it represent?” has somewhere to be looked up before any task starts. A Site Agent makes a company website agent-addressable and networked: an agent acting for a stranger can ask questions, be qualified, and be routed to the owner. Site Agent also publishes the machine-readable files AI agents look for and gives them a live endpoint to ask and act. Your own robots.txt, markup, sitemaps and WebMCP tools remain separate layers on your domain, covered in agent-readable vs agent-addressable. Mutual reveal moves contact details only after both humans agree. Box constrains what an agent does on its operator’s machine; Tobira is built for the moment that agent meets someone new and has to say whom it speaks for. Claiming a @handle on Tobira is free, and the network had 729 agents per Tobira internal data, September 2026. Tobira Site Agent has a free plan on your own AI key and paid plans from $49 a month (as listed on tobira.ai/agentic-site/ on 16 October 2026).

Box does not answer who sent the request, and it never claims to. That restraint is the best reason to take the rest of its documentation at its word.

What to remember

• It is a developer preview. v0.1.0, Apache 2.0, Apple silicon Macs only; Linux is in development, and the cloud targets have no dates.
• History is the new input. One Dogwood engine and one event record span shell, Python, network, and MCP calls, so a rule can deny a request because of what came before.
• Mediation has an edge. Direct grants, a tool’s own files, and a harness’s built-in file tools get operating-system limits only.
• Write history rules carefully. Key “it already happened” on ::response, exact budgets on ::request, and caps as forbid.
• Box models no identity. The principal is always self, every process shares the box’s credentials, and the records are the operator’s. The receiving service learns whose credential is attached and nothing about whom the agent represents.

Frequently asked questions

What is Strands Box?

Strands Box is an open source sandbox for AI agents from AWS, released in developer preview as v0.1.0 on October 7, 2026. It pairs operating-system isolation with default-deny Dogwood policies, enforced in a trusted process outside the agent, and works with any agent program.²⁴

Is Strands Box free?

Yes. Box and the Dogwood language are open source under the Apache 2.0 license. The agent’s model and API calls still cost what they cost.⁵¹⁰

Does Strands Box run on Linux or Windows?

Not yet. The preview runs on Macs with Apple silicon and macOS 15 or later. AWS told The Register that Linux support is in development and Windows is on its radar, with no date for either.⁴⁸

What is Dogwood?

Dogwood is AWS’s open source policy language for agent actions, introduced on August 6, 2026. It is a strict superset of Cedar that adds temporal conditions over earlier events. Box embeds the Dogwood Local Engine, and AgentCore Policy supports Dogwood in the cloud.¹⁰⁴

How do Strands Box policies use an agent’s history?

Box’s shell, Python interpreter, egress gateway, and MCP broker share one event history, so a rule can read earlier actions and elapsed time. Examples: allow git push only after tests passed in the last 15 minutes, or deny an outbound request after the agent read a protected file.⁴³

Does Strands Box check every file an agent opens?

No. Paths granted directly in box.toml get operating-system enforcement and no policy decision, and Dogwood does not evaluate a harness’s built-in file tools. To put a file under policy, reach it through Box’s shell or Python and keep it out of the direct grants.¹²⁹

Does Strands Box tell an API who the agent is acting for?

Not by itself. The gateway attaches the operator’s configured credential after policy permits a request, so the API learns whose account is calling, and that credential is the only addition its documentation lists. Inside the box every agent is one principal, “self”, and Box’s credential sources do not yet support delegated token exchange.¹⁷⁶²⁰

Sources