The coding assistant that acts on your behalf is also the one that can ruin your week. That tension has been building for a year, as AI agents have gone from drafting code to running commands, pushing changes and sending messages with less and less human oversight. Amazon Web Services has now shipped a tool it says can put a fence around them.
The tool, called Strands Box, is an open-source sandbox that AWS released in developer preview this week. It uses operating-system-level isolation to restrict which files and network resources an AI agent can reach, then applies a policy engine the company calls Dogwood to decide, action by action, whether to allow or block what the agent wants to do. An agent might be allowed to read a repository but not to push to it, or to message a Slack channel only a few times an hour, or to call an API up to a set limit.
The problem the tool targets has a name inside the industry: YOLO mode, for “you only live once.” Many coding assistants run in a mode that executes actions without pausing for human review, on the theory that asking permission for every step makes the tool too slow to be useful. AWS argues that this trade-off is built on a false choice, because the risk is not just about what the agent can reach but what it decides to do.
The distinction is the point of the design. A container can confine an agent to a set of files, but if the agent is allowed to touch those files, it can still delete them, rewrite them or leak them. Strands Box adds a layer that watches the agent’s behavior, so that boundaries are enforced by policy rather than by what the sandbox happens to contain. AWS describes it as separating the perimeter from the behavior.
The release is a developer preview, and its limits are spelled out. The tool is on GitHub and currently runs only on macOS, a constraint that leaves out a large share of the developer machines that would use it. AWS has framed the preview as a way to gather feedback and establish the pattern before the tool reaches the platforms where most agents actually run.
The timing reflects a shift in how the industry is thinking about agent security. A year ago, the main worry was whether an agent would make a mistake in code. Today the worry is whether an agent, given credentials and a goal, will do something its owner never intended, and do it fast enough that nobody can stop it. Sandboxing is moving from a nice-to-have to a requirement, and every major cloud vendor is now competing to define how it should work.
AWS is not the only one building in this direction. Rivals and a cluster of startups have released their own agent-sandbox and policy tools, each promising to let developers hand their agents more power without handing over the keys. The competition is young, and the standards have not been set, which is why AWS chose to open-source the project rather than keep it proprietary.
For developers, the appeal is practical. Teams want the productivity of an agent that acts on its own, and they also want to sleep through the night. A policy engine that blocks the dangerous action while allowing the harmless one offers a middle path between letting the agent run free and disabling it entirely. The question is whether the policy layer can keep up with the variety of things an agent might try.
Analysts said the release is as much a statement of direction as a finished product. AWS is signaling that it intends to make agent safety part of its platform story, and that it wants the patterns it is defining to become the default. Whether developers adopt Strands Box will depend on how well the preview handles real workloads, and on how fast the company expands it beyond a single operating system.
The release lands as agents have begun to move beyond coding. Assistants that can book travel, file expenses and manage accounts are showing up across enterprise software, each one carrying credentials and a degree of autonomy that used to belong to a human employee. The same policy question AWS is answering for code applies to every one of them: how much can the machine decide on its own.
AWS has tied the sandbox to its broader agent story, positioning Strands Box as the control surface for the assistants it expects developers to build on its platform. The company has said it wants developers to be able to give agents real responsibility without having to watch every move, and the preview is the first concrete piece of that promise.
The stakes run past any single tool. Agents are being handed access to code, data and accounts at a speed that has outpaced the controls around them. A sandbox that can tell the difference between a useful action and a reckless one is an attempt to restore some of the caution that the push for autonomy has dropped along the way.
