AWS open-sources Strands Box: OS isolation plus temporal Dogwood policies to rein in agents running in YOLO mode

Strands Box is AWS's open-source sandbox engine for AI agents (v0.1.0, Oct 7 2026, Rust, Apache 2.0). It splits control into two layers: box.toml holds direct file, program and network grants enforced by the OS, while policy.dw holds Dogwood rules evaluated by the embedded Dogwood Local Engine. Strands Shell, Monty for Python, an egress gateway and an MCP broker run in a trusted process outside the agent sandbox and send every operation they handle to that engine, which denies by default and lets forbid override permit. Because they share one event history, rules can depend on earlier actions and elapsed time, e.g. deny outbound HTTP after a sensitive file read, or allow Slack status posts at most three times per ten minutes. The gateway injects API credentials or SigV4 signatures so the agent never sees secrets, and decisions are logged as OTLP JSON. AWS has published no performance or security benchmarks. The preview runs on macOS 15+ on Apple silicon only; Linux is in development and AgentCore, ECS and Kubernetes deployment is planned.