Microsoft and AWS fence in AI agents as Meta, Walmart, Stripe back a standard

Everyone is suddenly building cages for AI agents, and I think that tells us more about the state of the technology than any benchmark does. In the span of a few days, Microsoft announced Execution Containers, a policy-driven way to fence in agents that work across files, networks, and applications, while AWS open-sourced Strands Box, a sandbox built on Dogwood that its own coverage describes as a cure for agents running in "YOLO mode." Two of the largest cloud vendors, same week, same problem. That is not a coincidence. It is an admission that the industry has handed agents shell access and file permissions faster than it has figured out how to supervise them.

I find this more interesting than the product details themselves. For two years the pitch has been that agents will do more for us autonomously. The unglamorous reality is that every extra capability widens the blast radius. An agent that can read your files and run commands is useful precisely because it can also do damage. Sandboxing is the boring, necessary engineering answer, and I would argue it will matter more to enterprise adoption than the next model release. If you are building with agents today, treat containment as a first-class requirement, not an afterthought you bolt on after the demo impresses your boss.

By the way, the standards story points in the same direction. Meta, Walmart, Shopify, and Stripe are backing an open standard for business AI agents, which suggests the commercial world is trying to settle the rules of the road before the traffic gets heavy. Open standards sound dull, but they decide who captures the integration, security, and commerce work that follows. Whoever shapes the plumbing shapes the market, and the presence of payment and retail giants tells me the target is agents that transact, not just chat.

Meanwhile, the safety conversation is sliding in two directions at once. Reuters reports that the mood at Singapore's forums has turned noticeably sober, with investors worried about both existential threats and a financial bubble. Emily Bender argues the existential framing is a distraction from harms already happening, while Sam Altman, in an interview this week, asked the world to accept the risks that come with AI. I have some sympathy with Bender's point, but I notice something the two camps share: the practical measures actually being shipped, such as sandboxes and containers, address neither doom nor hype. They address the plain fact that software with real permissions makes real mistakes.

That connects to a sharper argument I came across, that regulation should target the development process itself, not only finished products, after the risky experiments some companies ran this summer. Is that realistic? Oversight of how models are built is far harder to define and enforce than rules for what ships. But if agents are being caged at runtime, it is fair to ask who is watching the lab. I suspect that question becomes the next serious policy fight.