Addressing the Challenge of Untrusted Code at Scale

Benchling recently detailed the implementation of a robust security framework designed to handle AI agent-generated scientific code for its life sciences clients. As [Benchling](https://www.benchling.com/) expanded its [Benchling AI](https://www.benchling.com/ai) capabilities, the company required a way to execute code safely across thousands of tenants without risking cross-tenant data exposure or malicious exfiltration.

Traditional sandboxing methods proved insufficient for the company's specific threat model. Security teams sought a solution that offered full control over network isolation beyond standard system defaults, ensuring that every session remained contained and that no unauthorized network connections could be established.

Architecture and Isolation Strategy

To achieve this level of security, Benchling built a defense-in-depth architecture leveraging [Amazon Bedrock AgentCore](https://aws.amazon.com/bedrock/agentcore/). The primary component is the [Code Interpreter documentation](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/code-interpreter-tool.html) implementation, which runs within a dedicated and isolated [Amazon Virtual Private Cloud (VPC)](https://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/vpc-tkv.html).

The architecture strictly adheres to a 'nothing unless explicitly allowed' philosophy. By utilizing a separate 'Untrusted Code Account' for execution, the production environment remains isolated from the compute environment. This ensures that even if an execution session encounters an issue, the primary customer data store in [Amazon Simple Storage Service (Amazon S3)](https://aws.amazon.com/s3/) remains protected.

Network Controls and DNS Exfiltration Defense

Network security within the execution environment is enforced through a combination of restrictive Security Groups and Amazon Route 53 Resolver DNS Firewall policies. The VPC configuration lacks an internet gateway or NAT gateway, effectively cutting off direct paths to the public internet.

The DNS Firewall acts as a critical line of defense, utilizing a three-priority policy. The first priority blocks known malicious domains, the second permits only explicitly approved endpoints, and the final priority denies all other queries. According to the [AWS Machine Learning Blog](https://aws.amazon.com/blogs/machine-learning/how-benchling-secured-multi-tenant-ai-agents-with-amazon-bedrock-agentcore/), this setup allows Benchling to maintain observability while proactively rejecting hostile traffic patterns.

Credential Management and Scalability

One of the significant operational hurdles Benchling faced was avoiding the administrative burden of maintaining one IAM role per tenant. Instead of creating thousands of static roles, the team implemented a dynamic credential injection process. Credentials are provided via AWS Security Token Service (STS) on a per-job basis, which ensures that each session only has access to the specific data required for that operation.

This granular scoping, combined with continuous integration testing that simulates exfiltration attempts, provides a validated security posture. By owning these controls end-to-end, Benchling reports that the system successfully processes hundreds of execution sessions daily with zero reported security incidents since deployment.

Sources

• AWS Machine Learning BlogHow Benchling secured multi-tenant AI agents with Amazon Bedrock AgentCore