AWS 此前已提出多种开源策略，用于对 AI 代理进行问责，如今又在这一体系中加入了一个完整的沙箱环境。这项名为 Strands Box 的新解决方案采用操作系统级别的隔离机制，并结合 AWS 近期推出的其他开源 AI 控制工具，旨在对自主 AI 代理的行为实现更精细的控制。AWS 团队在公告中解释道：“代理程序正越来越多地运行在‘YOLO 模式’下，即未经人工审核便批准所有操作。解决这一问题的常规方法是使用沙箱……但访问权限只是我们希望控制的部分内容。”
AWS has offered multiple open-source strategies for holding AI agents accountable, and now it’s adding a full-on sandbox to this stack. Dubbed Strands Box, the new solution uses OS-level isolation and some of AWS’ other recent open-source AI control tools to, ostensibly, retain greater control over autonomous AI agents’ behavior. “Agents increasingly run in ‘YOLO mode,’ approving every action without human review,” the AWS team explained in its announcement. “The usual solution to this problem is a sandbox … but access is only part of what we want to control.”
AWS 指出，通常用于隔离 AI 代理的容器和微虚拟机存在一个问题：其强隔离特性并不包含上下文规则执行功能。换言之，当容器化或虚拟化的代理获取某个工具后，可能无法阻止其随意执行任何操作——例如删除生产数据库，或访问互联网后做出不可预料的举动。这正是 Strands Box 中其他开源工具发挥作用的地方：它利用 Dogwood Local Engine 为 Box 的策略引擎提供时间维度感知能力，从而在检查工具调用时，不仅能依据代理希望执行的操作，还能参考其已执行过的操作。
The problem with containers and microVMs typically used to isolate AI agents, as AWS explains it, is that their strong isolation doesn’t come with contextual rule enforcement. In other words, when a containerized or virtualized agent gets hold of a tool, there may be no stopping it from doing whatever it wants - like deleting a production database, or gaining access to the internet and doing dog knows what. That’s where the other open-source tools inside Strands Box come in: It uses the Dogwood Local Engine to give the policy engine in Box temporal awareness, so tool calls can be checked against not only what the agent wants to do, but what it’s already done.
例如，AWS 提到，可以允许代理向 Slack 发布状态更新，但限制其每十分钟最多只能发布三次，以防止其向人工操作员发送垃圾信息。AWS 发言人进一步解释说，Box 可用于控制代理执行 Git push 操作的时间，或限制可能产生巨额费用的 API 调用次数。此外，Strands Box 还包含 Strands Shell 和 Monty for Python，它们将 Shell 和 Python 操作纳入相同的 Dogwood 策略引擎和事件历史中，使代理行为对开发者更加清晰，并让策略能够更准确地应对代理试图执行的操作。
As one example, AWS noted that an agent could be allowed to post status updates to Slack, but no more than three times every ten minutes to prevent it from spamming its human operators. An AWS spokesperson further explained that Box could be used to control when an agent can perform a Git push, or it could be used to put a cap on API calls that could end up costing a small fortune. Additionally, Strands Box includes Strands Shell and Monty for Python, which expose shell and Python operations to the same Dogwood policy engine and event history, making agentic actions clearer to developers and allowing policies to account for what an agent is trying to do.
AWS 副总裁兼杰出工程师 Marc Brooker 是 Dogwood 和 Strands Box 的幕后开发者之一。他向《The》解释说，解释器是让智能体行为更具可理解性的关键组成部分，这使得开发者能够编写更精确的策略，防止智能体采取不当行动。“Box 的 Shell 和 Python 解释器暴露了文件删除等操作，而它的网关则暴露了 API 请求和工具调用，”Brooker 在电子邮件中告诉我们，“这样，策略就可以针对正在尝试执行的操作以及之前的活动进行判断。”
AWS VP and distinguished engineer Marc Brooker, one of the folks behind Dogwood and Strands Box, explained to The that the interpreters are a key part of making agentic behavior more intelligible, which allows for devs to write more precise policies to prevent agents from taking bad actions. “Box’s Shell and Python interpreters expose operations such as file deletions, while its gateways expose API requests and tool calls,” Brooker told us in an email. “Policies can then account for the action being attempted and earlier activity.”
Brooker 补充说，Box 在执行这些规则时并不会信任或依赖智能体真正遵守指令，理想情况下，这可以防止它们肆意违背操作者的意愿。至于 AWS 推动开发 Dogwood、Dogwood Local Engine 和 Strands Box 等开源工具的原因，Brooker 表示，AWS 希望找到边界与策略之间的恰当平衡，以防止我们经常报道的那种智能体 AI 灾难。
Box, Brooker added, enforces those rules without trusting or relying on agents to actually follow instructions, which should ideally prevent them from running roughshod over their operators’ wishes. As for the reason behind AWS’ push to develop open-source tools like Dogwood, the Dogwood Local Engine, and Strands Box, Brooker said that AWS wants to find the right balance between boundaries and policies that prevent agentic AI disasters of the kind we regularly report.
“Box 会确定性地执行开发者配置的策略，智能体无法通过言语绕过这些规则，”Brooker 解释道。不过他也补充说，即使权限配置得当，智能体的操作仍可能产生意外结果。“开发者仍需负责决定授予哪些访问权限，以及哪些环节需要人工审核，”Brooker 补充道——换句话说，不要让你们的 YOLO 模式变得太“YOLO”。适当的人工监督仍然必不可少。
“Box enforces the policies developers configure, deterministically, and the agent can't talk its way around these rules,” Brooker explained, though he added that, even with properly configured permissions, an agentic action can still produce an unwanted result. “Developers remain responsible for deciding what access to grant and where human review is needed,” Brooker added - in other words, don’t let your YOLO mode go too YOLO. A bit of human oversight is still necessary.
“智能体安全仍是整个行业需要努力解决的领域，我们致力于持续投入，无论是在 AWS 云内部还是在开源项目中，”Brooker 表示。Strands Box 支持任何用户希望限制在其内部运行的智能体或执行框架，目前已在 GitHub 上开放，但暂时仅支持 macOS。Linux 支持正在开发中，AWS 表示 Windows 客户端“也在我们的计划中”，但两者都尚未确定发布日期。
“Agent safety is an area where the industry still has significant work to do, and we're committed to continuing to invest in it, both inside the AWS cloud and in open source,” Brooker said. Strands Box supports any agent or harness one wants to confine within its walls and is available on GitHub now, though only for macOS for the time being. Linux support is in development, and AWS told us a Windows client is “on our radar,” but neither has a planned release date.
还计划部署到 AgentCore、ECS 和 Kubernetes 等平台。®
Deployment to platforms like AgentCore, ECS, and Kubernetes is also planned. ®