AWS launches Strands Box, an open source sandbox to stop AI agents running wild in YOLO mode

[Cognition]

AWS has released Strands Box, an open source sandbox that adds operating system level isolation to its tools for controlling AI agents, The Register reports. The problem it targets is what AWS calls YOLO mode. In AWS's words, agents increasingly run in YOLO mode, approving every action without human review. That is efficient until an agent deletes something important

The Register points out that containers and microVMs already isolate agents, but they do not enforce rules based on context. An agent with tool access could still do damage inside its box, such as deleting a production database. Strands Box uses the Dogwood Local Engine so its policy engine knows what the agent has already done. Every tool call is checked against both the agent's intent and its earlier actions

The examples help explain how it works. You could allow Slack status posts no more than three times every ten minutes, control when Git pushes can happen or cap API calls to limit costs. Strands Shell and Monty for Python put shell commands and Python operations under the same policy engine. So the agent is fenced in at several levels, not just one

AWS VP Marc Brooker said Box enforces the policies developers configure, deterministically, and that the agent cannot talk its way around those rules. That is the key point, because prompt based guardrails can often be bypassed by a clever enough prompt. He also admitted that agent safety is an area where the industry still has significant work to do. It is refreshing to see a cloud giant say that out loud

Strands Box is on GitHub now, but only for macOS. Linux support is in development and a Windows client is on AWS's radar. That is a slightly odd order for a cloud company whose servers mostly run Linux. I imagine it reflects where developers are running agents on their own machines today

Do you let AI coding agents run without approval? And do deterministic rules like this make you more comfortable using them?

AWS launches open-source AI agent sandbox to prevent YOLO mode disasterswww.theregister.com

[Dom0]

Being open source is the best part. Security tools you cannot inspect are hard to trust. Putting it on GitHub means people can check what it blocks and what it misses. It also means other vendors can adopt it rather than reinventing the wheel. AWS releasing tools like this openly is a welcome change

[Runtime Gareth]

Deleted production databases are not a hypothetical example. At least one well known incident last year involved a coding agent doing exactly that

The root cause there was an agent given far more access than it needed. Least privilege is an old rule, and agents need it more than anyone

[MagnetarX84]

macOS first makes sense when you think about it. That is where most developers are running Claude Code, Cursor and similar tools on their own laptops

Servers can wait, because production agents already tend to run in locked down environments. The laptop is where the YOLO mode problem lives

Linux support will matter for CI pipelines, though. Hopefully it follows quickly

[MagnetarX94]

Approval mode is how I run agents for anything that touches files outside the project. The constant prompts get annoying, which is exactly why people switch to YOLO mode. A rules engine that sits underneath and blocks the dangerous stuff would let me relax a bit. I will try this on my Mac. The policy examples look easy to set up