AWS, Meta, and the race to sandbox AI browser agents

AWS launched Strands Box on Wednesday. The open-source sandbox stops autonomous agents from running in "YOLO mode," where they approve actions without human review. The system uses OS-level isolation to enforce strict behavioral rules.

Security and isolation

AWS VP Marc Brooker explains that standard containers lack contextual rule enforcement. An agent inside a container might delete a production database or spam Slack messages if it has the tools. Strands Box integrates with the Dogwood Local Engine to add temporal awareness to policy checks. It can limit an agent to three Slack posts per ten minutes or cap API calls to prevent financial loss. This allows for granular control over time-based actions, moving beyond simple permission sets to dynamic constraints that adapt to recent activity.

"Box’s Shell and Python interpreters expose operations such as file deletions, while its gateways expose API requests and tool calls," Brooker told The Register. Developers can write precise policies that account for an agent's history, not just its current intent. The tool is part of AWS's push to provide open-source strategies for holding AI agents accountable.

Standardizing web access

Meta and Sierra are tackling the external interface. On Wednesday, the two companies introduced the Personal Agent Protocol, a standard for how AI agents interact with enterprise websites. The protocol replaces the inefficient method of agents navigating websites like human users. Instead, it allows companies to choose between web access, API access via Model Context Protocol, or direct agent integration. This shift moves the focus from emulating human browsing behavior to establishing direct, structured communication channels between AI entities and business platforms.

According to heise.de, the protocol enables businesses to monitor agent activity and grant either read or write access, built on OAuth authorization. Initial partners include Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart. The specifications are expected to be released as version 0.1 later this month. This move competes directly with Visa's existing standards, with Stripe and Shopify participating in both ecosystems.

Recent security incidents show the urgency for these controls. A phishing campaign targeting advertising managers added a fake "Muse Ads" product to its lure lineup, just eight days after Meta launched its personal AI agent, Muse. The Register reported that the campaign uses "browser-in-browser" attacks to steal credentials. Oleg Zaytsev, a security researcher at Island, noted that the operators adapted their platform quickly, using the timely announcement of Muse as a credible reason for victims to act.

"The striking part is how quickly they turned a timely announcement into a credible reason for someone to act," Zaytsev told The Register. The attack vector involves a fake login window inside a legitimate browser, tricking agency staff into handing over credentials. From one frontend alone, researchers observed submissions involving roughly 200 distinct email addresses over a month, with the campaign-wide volume estimated to be substantially higher.

Consumer friction and blocking

Users frequently run into blocks when their agents, such as Meta’s Muse or OpenAI’s Dots, attempt to complete tasks, according to TechCrunch. Amazon has explicitly blocked Muse from its retail site, while other blocks appear to be accidental results of traditional anti-bot measures. Walmart told TechCrunch that its blocks were not intentional, as the company is partnered with Muse. The issue often arises when a website presents a human verification button that interrupts the agent's flow. Industry partners, including Meta, Walmart, and Stripe, are working on open standards to distinguish legitimate agents from malicious bots.

OpenAI’s Dots agent has faced its own set of issues. Wired reported that the agent, which requires a $100-a-month subscription, struggled with basic tasks like remembering user names and solving captchas. In one instance, an agent named Toolie mistakenly told a user it loved them.