What happened
Benchling has described a defense-in-depth security architecture for running untrusted, AI agent-generated scientific code across thousands of life sciences tenants, according to an AWS Machine Learning account of the work.
The setup relies on Amazon Bedrock AgentCore Code Interpreter running in VPC mode, paired with Amazon Route 53 Resolver DNS Firewall and VPC endpoint policies.
According to the source, these layers are intended to block data exfiltration, including attempts made through DNS.
Why it matters
Running code produced by AI agents on behalf of many separate customers raises an obvious containment problem: the code is not trusted, and the tenants must remain isolated from one another. The described architecture treats that as a layered security question rather than a single control.
The inclusion of DNS in the exfiltration threat model is notable in reasoning terms, since DNS is a channel that can be overlooked when teams focus on blocking outbound network traffic. Combining VPC-mode execution with resolver-level filtering and endpoint policies suggests the goal is to constrain where agent-generated code can send data at multiple points.
For life sciences customers, the value of agentic tooling depends on whether organizations can let it execute code without exposing sensitive data, so the security design is central to adoption rather than an add-on.
Key facts
Benchling built a defense-in-depth security architecture for running untrusted, AI agent-generated scientific code.
The architecture spans thousands of life sciences tenants.
It uses Amazon Bedrock AgentCore Code Interpreter in VPC mode.
It combines Amazon Route 53 Resolver DNS Firewall and VPC endpoint policies.
The stated aim is to block data exfiltration, including through DNS.
What to watch next
Whether AWS or Benchling publish further technical detail on how the layers are configured and how tenant isolation is enforced in practice.
How the approach is received by other multi-tenant platforms weighing similar controls for agent-generated code, particularly around DNS-based exfiltration paths.
