The Android docs mentioned about the migration guide here : https://developer.android.com/studio/build/gradle-plugin-3-0-0-migration.html
Element hierarchies in the Android manifest
In previous versions of AAPT, elements nested in incorrect nodes in
the Android manifest are either ignored or result in a warning. For
example, consider the following sample:
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example.myname.myapplication">
<application
...
<activity android:name=".MainActivity">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
<action android:name="android.intent.action.CUSTOM" />
</activity>
</application>
</manifest>
Note that you must check your Manifest if you really comply to the specific nesting rule they provided otherwise your app wont compile.
Manifest file structure
The code snippet below shows the general structure of the manifest
file and every element that it can contain. Each element, along with
all of its attributes, is fully documented in a separate file.
<manifest>
<uses-permission />
<permission />
<permission-tree />
<permission-group />
<instrumentation />
<uses-sdk />
<uses-configuration />
<uses-feature />
<supports-screens />
<compatible-screens />
<supports-gl-texture />
<application>
<activity>
<intent-filter>
<action />
<category />
<data />
</intent-filter>
<meta-data />
</activity>
<activity-alias>
<intent-filter> . . . </intent-filter>
<meta-data />
</activity-alias>
<service>
<intent-filter> . . . </intent-filter>
<meta-data/>
</service>
<receiver>
<intent-filter> . . . </intent-filter>
<meta-data />
</receiver>
<provider>
<grant-uri-permission />
<meta-data />
<path-permission />
</provider>
<uses-library />
</application>
</manifest>
In your case you must transfer your
<activity android:name="com.box.androidsdk.content.auth.OAuthActivity" />
inside in <application>
so that it will compile.
Disabling AAPT2 is just a workaround but not a real answer.