Benchling Runs 600+ Agent Code Sessions Daily with Zero Incidents via Bedrock AgentCore Sandboxing

AWS ML Blog · rss · 2026-09-22

An AWS ML Blog deep dive explains how life-sciences company Benchling securely executes AI agent-generated code across thousands of tenants—600+ sessions daily, 250+ tenants weekly, zero security incidents. The defense-in-depth design uses a dedicated untrusted-code AWS account, Bedrock AgentCore Code Interpreter in VPC mode with no internet/NAT gateway, a three-tier Route 53 DNS Firewall policy (denylist, minimal allowlist, deny-all), per-job STS credential injection to avoid IAM role sprawl, and a continuous validation suite simulating exfiltration attempts. A directly reusable blueprint for multi-tenant LLM code execution isolation.

Original post →

More from coding & agent

coding & agent channel →