Benchling Isolates AI Agent Code with Multi-Layer AWS Defense

How a life sciences platform locked down AI-generated code

Benchling operates AI agents that generate and execute scientific code on behalf of researchers across thousands of separate life sciences organizations. The platform now processes more than 600 code execution sessions daily across over 250 tenants per week—with zero security incidents—by combining account isolation, DNS-level controls, and dynamic credential scoping.

The challenge was straightforward but difficult: AI-generated code is inherently untrusted, yet it must access sensitive tenant data to perform calculations and analyses. Standard network controls like egress port restrictions weren't enough. DNS resolution remained a potential exfiltration vector, and Benchling's security team needed full visibility and control over every network path.

According to a detailed case study published by AWS, Benchling built a defense-in-depth architecture around Amazon Bedrock AgentCore's Code Interpreter capability, deployed in VPC mode. The solution combines multiple independent security layers so that no single control failure compromises tenant data.

Three-tier DNS firewall blocks exfiltration

The centerpiece of Benchling's approach is Amazon Route 53 Resolver DNS Firewall, configured with three priority tiers. The highest-priority rule explicitly blocks known malicious domains. The second tier maintains a strict allowlist—typically limited to specific S3 bucket endpoints required for each job. The final catch-all rule returns NODATA for any query not explicitly permitted.

This configuration makes DNS tunneling—a common exfiltration technique where attackers encode stolen data in subdomain queries—impossible. Any domain not on the explicit allowlist simply cannot resolve. The DNS recursion chain breaks at the first hop.

VPC endpoints enforce bucket-level access

Benchling runs Code Interpreter in a dedicated AWS account with no internet gateway and no NAT gateway. AWS service access flows exclusively through VPC endpoints, each governed by policies that list authorized S3 buckets. Even if untrusted code somehow obtains valid credentials for another tenant's bucket, the VPC endpoint policy rejects the request at the network layer before it reaches S3.

This creates a defense independent of IAM permissions. Credential theft alone is insufficient to access unauthorized data.

Per-job credentials prevent role sprawl

Maintaining one IAM role per tenant would create thousands of static roles. Instead, Benchling injects scoped credentials into each session through AWS Security Token Service. Each job receives temporary credentials restricted to the specific tenant's data path. A compromised session can only access the single tenant it was dispatched to serve.

Continuous validation catches configuration drift

Benchling's infrastructure team incorporated exfiltration simulations into their continuous integration pipeline. Tests attempt DNS tunneling, unauthorized endpoint connections, and out-of-scope S3 access. If any test succeeds, the pipeline fails and blocks the release. This approach treats security as a testable property rather than a one-time configuration, catching any infrastructure change that weakens the boundary before it reaches production.

Why it matters

As AI agents gain the ability to generate and execute code autonomously, securing multi-tenant environments becomes critical infrastructure. Benchling's architecture demonstrates that running untrusted AI-generated code at scale requires customer-controlled network isolation, not just application-layer restrictions. The combination of account separation, DNS-level controls, VPC endpoint policies, and dynamic credential scoping creates multiple independent failure barriers—essential when a single data leak could expose regulated scientific research across hundreds of organizations.

Details of Benchling's implementation were first reported by AWS in a Machine Learning blog post co-authored by Jeremy Stashewsky, Meghana Sreenivas, and Anil Gurrala.