Benchling is running AI-generated scientific code in a separately isolated AWS account, adding controls that block internet and DNS-based data exfiltration by default. The architecture processes more than 600 code-execution sessions a day across over 250 life-science tenants each week, according to a joint AWS and Benchling account.
The system uses Amazon Bedrock AgentCore Code Interpreter in a virtual private cloud with no internet or NAT gateway. Route 53 Resolver DNS Firewall first blocks known malicious domains, then permits an explicit list and rejects everything else. VPC endpoints provide the only approved network routes, while endpoint policies and network rules restrict traffic to required services such as S3.
Benchling also placed untrusted execution in a different AWS account from its production systems. Each job receives short-lived credentials through AWS Security Token Service, granting access only to the tenant data needed for that run. This avoids maintaining a separate permanent identity for each of thousands of tenants. Automated integration tests repeatedly attempt exfiltration to check that the boundaries still work.
Benchling reports no security incidents in the described workload, but that operational record is not a guarantee against future flaws. The broader lesson is that a code sandbox alone may not satisfy sensitive multi-tenant requirements: identity, DNS, network paths and continuous validation need independent layers.