Benchling runs 600 daily AI code sessions with zero incidents using Amazon Bedrock AgentCore Code Interpreter

Benchling's security team found that traditional sandboxing wasn't enough when running AI agent-generated code across thousands of life sciences tenants. Standard controls block HTTP, restrict egress ports, and limit outbound connections, but DNS resolution often stays permitted. Even when system defaults restrict it, teams may not have visibility into those restrictions. Benchling needed customer-controlled network isolation and continuous validation through its own integration test suite.

The architecture separates an Untrusted Code Account from the Production Account, with no internet gateway and no NAT gateway. DNS queries pass through a three-priority Route 53 Resolver DNS Firewall policy: P10 blocks known malicious domains, P100 allows only explicitly listed endpoints, and P200 returns NODATA for everything else. VPC endpoint policies restrict S3 access to specific buckets, and per-job credentials via AWS STS scope data access without one IAM role per tenant. Benchling first proved this in a proof-of-concept VPC, then added exfiltration simulations to its continuous integration test suite so any future infrastructure change that weakens the boundary fails the pipeline.

The stakes for Benchling hinge on whether those automated tests keep pace as VPC settings change, new endpoints are added, and IAM policies are updated. Regulated life sciences customers likely care most about the reported zero cross-tenant data leakage, since a single incident could undermine trust in AI-generated scientific workflows.