AWS Launches Strands Box, an Open-Source Sandbox for AI Agent Safety
Amazon introduced Strands Box, a preview sandbox that enforces behavioral rules for AI agents wherever they run, released together with a fix for a vulnerability in its own Strands tooling.
Amazon has introduced Strands Box, an open-source sandbox that lets developers define behavioral and access rules for AI agents and enforces them wherever the agents run — on desktops, on Amazon's AgentCore, or on other runtimes. The preview was announced on October 29 alongside Strands agent harness v0.3.3, a ready-to-use harness released under the Apache-2.0 license that Amazon says cuts cost per agent task by about 32 percent through token efficiency.
The launch came paired with a security lesson from AWS's own tooling. CVE-2026-115415, disclosed for strands-agents-tools, allowed a model itself to switch off secret masking through prompt injection, potentially returning cloud credentials in cleartext. The flaw is fixed in version 0.8.6, the affected tool has been deprecated, and AWS has advised rotating any exposed credentials.