Strands Box is an open source Rust sandbox engine that confines AI agents with OS-level isolation plus semantic Dogwood policies, letting authorized teams control what agents execute, read, write, and reach over the network.
| Tool | strands-agents/box — open source sandbox engine for AI agents combining OS isolation with semantic Dogwood policies |
| Category | AI agent containment and policy enforcement (Rust) |
| Primary Use | Running coding or tool-using agents inside a hardened sandbox where box.toml grants and policy.dw rules govern file, program, network, and MCP tool access |
| Safe Use | Designed for authorized security teams, AI safety researchers, and engineers evaluating or deploying agents on systems they own, providing defense-in-depth against unintended agent actions |
| Telemetry Note | Box records every policy decision as OTLP JSON in <box_dir>/private/telemetry/records.jsonl, giving defenders a full audit trail of agent operations |
The rise of agentic AI has produced an awkward security gap: large language models are increasingly given shells, file systems, and API credentials, while the controls around those capabilities remain largely advisory. strands-agents/box is an open source sandbox engine written in Rust that addresses this directly. It runs an AI agent inside an operating-system sandbox and layers a semantic policy engine on top, so operators can define not just what an agent may access but under what conditions and in what sequence. For defenders and authorized teams evaluating agent safety, this is a rare example of enforcement that lives outside the process it constrains.
The design is deliberately two-tier. The first tier is classic OS containment: the agent process runs in a sandbox where direct access to files, programs, and the network is restricted by grants declared in box.toml, enforced by the host operating system itself — the README references the macOS Seatbelt-style machinery and Linux namespaces in its topic list. The second tier is semantic: operations flowing through Box's interpreters and gateways are checked against rules written in Dogwood, a policy language stored in policy.dw. The critical architectural point is that the Dogwood Local Engine and its enforcement components run outside the agent's sandbox, in the Box command's process or the embedding Rust application's process, so a compromised agent cannot simply rewrite the policy that binds it.
Dogwood's evaluation model is deny-by-default with an explicit override structure. Rules come in two flavors, permit and forbid: an operation checked by the engine is denied unless a matching permit allows it, and a matching forbid overrides any permission. This inversion matters because most agent frameworks treat capabilities as additive — once a tool is granted, it stays granted. Here, the operator writes an allowlist, and the deny rule always wins the tie, which is the correct default for a security boundary.
What separates Box from a plain container is temporal and cross-channel policy. All of Box's enforcement components — Strands Shell for shell commands, Monty for Python code, the egress gateway for network traffic, and the MCP broker for tool calls — share a single event history. Dogwood rules can reference earlier actions and elapsed time, so a policy can express something like exfiltration prevention: if the agent read a sensitive file through Shell or Python, the egress gateway can deny a later outbound HTTP request. That correlation across channels, evaluated in a trusted process, is the kind of control that per-tool permission prompts simply cannot provide.
The egress gateway is particularly thorough. It checks connections and HTTP requests including their method and path, not just destination hosts, which allows policy to distinguish, say, a read-only GET from a destructive DELETE against the same API. The gateway also handles credential injection: permitted requests are authenticated with configured API credentials or AWS SigV4 signing, and the agent itself never receives the underlying secrets. This is a zero-trust pattern applied to agents — the workload holds a token's power without holding the token — and it meaningfully shrinks the blast radius if the agent's context or memory is ever poisoned.
MCP integration follows the same discipline. The broker checks configured tool calls and their arguments against policy before execution. When the agent invokes an external program such as git or cargo, or a local MCP server, Box checks the launch against policy and runs that program in its own sandbox with per-program file grants; the external process cannot reach back into Box's interpreters, and its network traffic is routed through the gateway by default. The result is nested containment: the agent sits in one box, its subprocesses in smaller ones, all reporting to one policy engine.
There is an honest caveat in the README that operators should internalize. Direct filesystem grants in box.toml are enforced by the OS and do not produce individual Dogwood decisions — if you hand the agent a directory directly, reads and writes there happen below the policy layer. To bring file operations under semantic policy, you must route them through the interpreters and keep those paths out of the direct grants. This is a sharp edge: a misconfigured box.toml can silently exempt the most sensitive data from the temporal rules in policy.dw, so the split between OS grants and policy-checked access deserves careful review during deployment.
Observability is built in rather than bolted on. Box records policy decisions in OTLP JSON, defaulting to <box_dir>/private/telemetry/records.jsonl, giving auditors and defenders a durable record of every allow and deny the engine issued. For teams running agents in authorized environments, this log is the forensic backbone: it answers who asked for what, when, and under which rule, which is exactly the evidence trail agent incidents have historically lacked.
The library story is aimed at Rust builders embedding agents into larger applications. Linking the strands-box crate from crates/box gives you strands_box::run(), which takes an absolute box.toml path and waits for the workload to finish; the README is explicit that you should call it before starting application threads or loading secrets, and that only one Box workload per host process is supported. Live policy replacement is available via strands_box::reload(), which blocks until the new policy takes effect; invalid policy returns ReloadRefused and leaves the current policy intact, a fail-closed design. There is also strands_box::generate_policy_schema() for producing schemas from a given configuration, useful for validating policy tooling in CI.
Platform support is the main limitation at preview stage. Local execution targets Linux ARM64 and macOS on Apple silicon; Linux x86-64 is experimental and requires setting EXPERIMENTAL_X86_SUPPORT=TRUE in the Box process environment, with release downloads remaining ARM64-only on Linux. The getting-started walkthrough assumes macOS 15 or later, Node.js 22.21 or later from Homebrew, and access to Claude Opus 5 on Amazon Bedrock in us-west-2. Installation is deliberately conservative: curl -fsSL https://raw.githubusercontent.com/strands-agents/box/main/download.sh | sh unpacks into ./box-core after verifying release checksums against SHA256SUMS.txt, without touching your PATH or system directories. Building from source is a standard Cargo workspace: git clone followed by cargo build --release -p strands-box -p strands-box-containment, with rust-toolchain.toml pinning the compiler.
The engineering hygiene visible in the repository is a good signal for a security tool. The README documents a fuzzing guide covering a long libFuzzer run of the tool grammar shell parser, macOS release automation with signing and notarization gates, namespace-isolated Linux tests on Ubuntu ARM64, and a CI Gate that fails on deterministic integration failures. Common tasks run through just (just build, just test, just check), and the project ships an authoring skill (SKILL.md under .agents/skills/authoring-box-policy/) so a coding agent can help write its own confinement policy — a sensible bootstrapping convenience, though the policy still governs that agent. At 204 stars under the strands-agents organization with an Apache-2.0 license, Box is young but architecturally serious.
Where does this fit in an authorized workflow? Red teamers and security researchers running autonomous agents during sanctioned assessments get a containment layer that prevents an agent from stepping outside its brief; AI safety teams evaluating model behavior get temporal policies that simulate insider-threat controls; and platform engineers shipping agent features get credential injection and decision logs for free. The honest assessment is that Box requires real configuration discipline — the two-tier grant model rewards careful planning and punishes sloppy defaults — but as a defensive primitive for the agentic era, the combination of out-of-process enforcement, cross-channel event history, and deny-by-default semantics is exactly the shape of the tooling this space needs.
strands-agents/box.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.