AWS launches Strands Box, an open-source sandbox to curb 'YOLO mode' disasters in AI agents

AWS has unveiled Strands Box, the latest piece in its growing set of open-source tools for keeping autonomous AI agents under control. The company frames the problem bluntly: more and more agents are operating in what it calls "YOLO mode", approving every action without human review, and the risk of something going wrong grows in proportion to the autonomy they are granted.

As the AWS team explains in its announcement, the usual solution to this problem has been sandboxing via containers or microVMs, but that approach only solves part of the problem: it offers strong isolation at the access level, but not contextual control over the rules. In other words, once an agent isolated in a container gets hold of a tool, nothing stops it from using that tool to the full extent of its permissions, whether by deleting a production database or making uncontrolled use of internet access.

Strands Box aims to close that gap by building on other recent AWS open-source tools, in particular the Dogwood Local Engine, which gives Box's policy engine "temporal awareness": tool calls are evaluated not only on what the agent wants to do at that moment, but also on what it has already done before. The example AWS gives is an agent authorized to post status updates to Slack, but limited to a maximum of three messages every ten minutes to keep it from overwhelming human operators. An AWS spokesperson added that Box can also be used to control when an agent is allowed to run a "git push", or to impose a cap on API calls and avoid runaway bills.

The tool also includes two additional components: Strands Shell and Monty for Python, which expose shell and Python operations to the same Dogwood policy engine and its event history, making agent actions more legible to developers. Marc Brooker, AWS vice president and distinguished engineer and one of the people behind Dogwood and Strands Box, told The Register that these interpreters are key to making agentic behavior more intelligible: "Box's shell and Python interpreters expose operations such as file deletion, while its gateways expose API requests and tool calls. Policies can then take into account both the action being attempted and prior activity," he said.

Brooker stressed that Box enforces those rules without relying on the agent itself deciding to follow instructions: "Box enforces the policies developers configure, deterministically, and the agent cannot talk its way out of these rules." Even so, he noted that even with well-configured permissions an agentic action can produce an unwanted outcome, which is why "developers remain responsible for deciding what access to grant and where human review is needed." In other words: YOLO mode can be tempered, but it does not eliminate the need for human oversight entirely. Brooker was explicit about the state of the field: "Agent security is an area where the industry still has a lot of work to do, and we're committed to continuing to invest in it, both inside the AWS cloud and in open source."

The editorial context in which this news appears is telling in itself: around the same time, The Register published another article flagging security flaws in AgentCore, AWS's service for running agents, related to tokens transmitted in metadata, weak virtual machine isolation and overly broad permissions. That coincidence neatly illustrates the underlying tension: as the industry deploys increasingly autonomous agents, the control tools — including AWS's own — are still maturing and coexist with real vulnerabilities.

Strands Box works with any agent or "harness" you want to confine and is already available on GitHub, though for now only for macOS. Linux support is in development and a Windows client is "on the radar" at AWS, with no confirmed release date for either. Integration with platforms such as AgentCore, ECS and Kubernetes is also planned.

Taken together, Strands Box adds to an AWS strategy that already included Dogwood and the Dogwood Local Engine, reinforcing the idea that the company wants to position itself as the provider of the governance and security layer for agentic AI, not just the infrastructure that runs it. It is a reasonable bet given the moment: as more organizations delegate operational tasks to agents with access to production systems, tools, paid APIs and code repositories, the difference between purely technical isolation and control that understands the context and history of actions may be what separates a minor incident from an operational disaster. Even so, as Brooker himself acknowledges, no tool of this kind replaces human judgment when it comes to deciding which permissions to grant and where to draw the line for manual review.