Benchling runs agent-written scientific code for 250 tenants a week behind a DNS firewall that answers NODATA by default
AWS Machine Learning Blogmedium signalAWS published Benchling's architecture for executing untrusted, agent-generated code across life-sciences tenants on Bedrock AgentCore Code Interpreter in VPC mode: no internet or NAT gateway, port 443 only, prefix-list routing confined to VPC endpoints, and a three-tier Route 53 DNS firewall whose catch-all rule returns NODATA for anything not explicitly allowed. Isolation is per-job STS credentials scoped to one tenant's S3 prefix rather than static per-tenant roles, with VPC endpoint policies enforcing bucket access at the network layer independent of IAM. They report 600+ sessions daily, 250+ distinct tenants weekly, and no security incidents since the April 2026 deployment, with integration tests that actively simulate DNS tunneling to catch config drift.
↳ Follow the thread