What changed
AWS released Strands Box in developer preview under Apache 2.0. It combines OS containment with deny-by-default Dogwood policy across shell, Python, HTTP egress and MCP calls, injects credentials outside the agent process and records policy decisions for inspection.
Why it matters
Box moves important agent controls outside the model and harness, allowing rules to depend on action history and elapsed time. It offers a concrete way to test cross-tool exfiltration and rate limits instead of trusting the agent to enforce its own instructions.
What to do
Run the preview only on a disposable Apple-silicon Mac. Pin the Box version, grant the smallest project paths, route shell, Python, HTTP and MCP through Box, then test a rule that blocks outbound requests after reading a synthetic sensitive file and inspect the decision log.
Caveat
This is pre-release software with macOS Apple-silicon support; Linux is planned. Directly granted file access is bounded by OS containment but does not appear in Dogwood policy history, and AWS provides no independent containment or bypass evaluation.