Benchling Secures AI Agents Across Thousands of Tenants

Benchling built a defense-in-depth security architecture to run AI agent-generated scientific code across thousands of life sciences tenants using Amazon Bedrock AgentCore. The system processes over 600 code execution sessions daily across 250-plus tenants per week with zero security incidents. The solution combines a dedicated AWS account for untrusted code execution, Route 53 Resolver DNS Firewall, VPC endpoint policies, and per-job credentials via AWS STS. This approach blocks unauthorized network connections including DNS exfiltration, enforces per-tenant data isolation, and eliminates the need for per-tenant IAM roles that would create unmanageable role sprawl at scale.