Benchling built a defense-in-depth security architecture to execute untrusted, AI agent-generated scientific code across thousands of life sciences tenants. The approach uses Amazon Bedrock AgentCore Code Interpreter in VPC mode, combined with Amazon Route 53 Resolver DNS Firewall and VPC endpoint policies to prevent data exfiltration, including exfiltration attempts through DNS.
Why it matters
Running code generated by AI agents introduces security risks, particularly in multi-tenant environments where sensitive data from many customers must remain isolated. The described layered controls target both direct and DNS-based exfiltration pathways.
Who should care
Enterprises and platform teams deploying multi-tenant AI agents, especially those executing untrusted code, may find the described architecture relevant to their own security design.