How Benchling secured multi-tenant AI agents with Amazon Bedrock AgentCore

Benchling, a company specializing in scientific data management, faced a challenge when deploying AI agents across hundreds of life sciences clients. The security team realized that traditional sandboxing was insufficient to protect against unauthorized network connections and data exfiltration. To address this issue, Benchling implemented a defense-in-depth security architecture using Amazon Bedrock AgentCore and its Code Interpreter capability.

The solution involved creating a separate AWS account for untrusted code execution, isolated from the main production account. In this "Untrusted Code Account," Amazon Virtual Private Cloud (VPC) mode with AgentCore Code Interpreter was deployed, ensuring complete network isolation. The VPC had no internet gateway, preventing any outbound connections to the public internet.

All DNS queries were filtered through Amazon Route 53 Resolver DNS Firewall, which blocked malicious domains and allowed only explicitly specified endpoints. This approach blocked unauthorized network vectors, including DNS, without the need to manage per-tenant IAM roles, avoiding unsustainable role sprawl. Each execution session was scoped dynamically using AWS STS, granting only necessary data access for each specific job.

The architecture combined Benchling's pre-existing container-based execution environment with AgentCore Code Interpreter, ensuring both security and performance. By implementing this multi-layered defense strategy, Benchling successfully ran AI agent-generated scientific code across thousands of tenants without compromising security.