Abnormal AI, the behavioral security company that says it protects more than 25 percent of the Fortune 500, has put Amazon Bedrock AgentCore's Code Interpreter into production as the compute layer behind its real time email threat detection agents. AWS published the details in a customer story on September 14, 2026, co written by two AWS solutions architects and Abnormal's own VP of AI Strategy, Shrivu Shankar.

The post is unusually specific for a vendor blog. It lays out Abnormal's three tier detection pipeline, the exact configuration choices behind its sandbox, and the scale at which the system runs: billions of messages a day, with agent driven code execution reserved for the hardest cases. That level of detail is worth taking seriously.

What's also worth taking seriously is a claim buried in the security section: that Abnormal's chosen sandbox mode has no external network access. AWS's own documentation said the same thing about that exact feature about a year ago, and independent researchers proved it wasn't quite true. Here's what actually happened, and what it means for how much weight to put on "zero trust" claims like this one.

What Abnormal Actually Built

Abnormal AI processes email through three tiers, according to AWS's post. Tier 1 uses lightweight classifiers and heuristic rules to screen billions of messages a day, the volume where running anything heavier would be cost prohibitive. Tier 2 routes the messages Tier 1 is unsure about, on the order of millions a day, to deep learning and machine learning models for deeper behavioral analysis. Tier 3, the smallest tier at tens of thousands of messages a day, is where things that would normally need a human analyst go to Amazon Bedrock AgentCore Code Interpreter: an inline agent spins up a sandbox, writes and runs scripts against the threat intelligence data, and makes a determination before the message ever reaches an inbox.

Abnormal also runs a separate batch process it calls the analyst agent, doing roughly 100 batch jobs a week to review misclassifications and draft candidate heuristics for Tier 1 and improved models for Tier 2. Some of those jobs run for more than 30 minutes, and Code Interpreter sessions can be held open for up to eight hours, well past the tool's 15 minute default, with the file system used as a checkpoint for operations like model training that outlast a single session.

Abnormal frames this as consistent with how it builds software generally: per AWS, 80 percent of the company's code changes now involve an AI agent in some capacity, and 40 percent are built end to end by a background agent with no human writing the code directly. As Shankar put it in the post, nearly any agent needs a "code interpreter sandbox that allows it to actually crunch data" rather than reasoning about numbers in plain language. It's a similar pitch to what Ninth Wave made when it built its Compass onboarding assistant on Bedrock AgentCore, and AWS has clearly decided AgentCore customer stories are a marketing priority this quarter.

The Sandbox Claim, and What Happened the Last Time Someone Checked It

Here's where I'd slow down. Abnormal says it picked what AWS calls the sandbox, no egress configuration for Code Interpreter specifically because it has no external network access, meaning that even if an agent gets compromised through prompt injection, there's nowhere for stolen threat intelligence data to go.

That is close to the exact language AWS itself used to describe Sandbox mode until a security firm called BeyondTrust proved otherwise. Researchers at BeyondTrust's Phantom Labs, led by Chief Security Architect Kinnaird McQuade, reported to AWS in September 2025 that Sandbox mode still allowed DNS queries to escape it. They built a working proof of concept: a full interactive reverse shell tunneled entirely over DNS, capable of pulling real files, including credentials and customer data, out of any S3 bucket the Code Interpreter's IAM role could reach. AWS reproduced the bug, tried a fix in November 2025, rolled that fix back, and in December 2025 told the researchers it would not patch the underlying behavior at all. Instead it updated its documentation, quietly changing Sandbox mode's description from an isolated environment with no external access to one with limited external network access. Phantom Labs went public with the research on March 16, 2026. AWS did eventually close the specific DNS tunneling path on April 15, 2026, about five months before Abnormal's post went up.

So the acute vulnerability appears fixed. But the language gap hasn't fully closed. AWS's own current public statement on the matter describes Sandbox mode as providing network access exclusively to Amazon S3, with DNS resolution deliberately left on to support that access, and says only VPC mode delivers complete network isolation and full control over DNS. That's a narrower, more accurate claim than "no external network access," which is the phrase Abnormal's post uses to describe the exact same mode. Nothing here suggests Abnormal's own deployment has been compromised or independently audited either way. What it suggests is that a vendor's characterization of its own sandbox, even one built on a legitimately strong isolation technology like Firecracker microVMs, shouldn't be taken at face value without checking what the platform underneath it will actually guarantee.

Why It Matters

Security companies are increasingly willing to describe their AI-native engineering in public, and Abnormal's numbers here (a background agent writing 40 percent of code end to end, tens of thousands of inline security determinations a day) are genuinely notable specifics in an industry that usually hides behind vague marketing language. That's worth crediting. But the same industry has a recent, well documented case of a major cloud provider's sandbox isolation claim not holding up to outside scrutiny, on this exact product, and it's a pattern I've now watched play out with more than one AI security vendor: the claim ships in the blog post, the caveats live in someone else's disclosure timeline months later. It's part of a broader shift AWS itself is pushing, as its own guidance to enterprises on AI governance has argued, that AI security claims need independent verification rather than vendor assurance alone.

What to Watch

Watch for whether Abnormal or AWS publishes any independent audit or penetration test results specific to this deployment, since none has surfaced so far. Also worth tracking: whether AWS revisits Sandbox mode's DNS handling again, given it has already had to patch it once, and whether other security vendors adopting AgentCore Code Interpreter start disclosing their own network mode choices with the same level of AWS style precision rather than repeating the shorthand.

Key Takeaways

  • Abnormal AI runs Amazon Bedrock AgentCore's Code Interpreter as the compute layer for Tier 3 of its email detection pipeline, the hardest cases, at roughly tens of thousands of messages a day, while Tiers 1 and 2 handle billions and millions of messages respectively with lighter models.
  • Per AWS, 80 percent of Abnormal's code changes now involve an AI agent, and 40 percent are built end to end by a background agent with no human writing the code directly.
  • Abnormal chose Code Interpreter's sandbox, no egress mode specifically to block data exfiltration, but that same mode was the subject of a 2025 to 2026 BeyondTrust security disclosure that found it allowed DNS based data exfiltration until AWS fixed it in April 2026.
  • No independent audit of Abnormal's specific Code Interpreter configuration has been published as of this writing.

FAQ

What does Amazon Bedrock mean?

Amazon Bedrock is AWS's fully managed service for accessing foundation models from multiple AI companies, plus Amazon's own models, through a single API, with AWS handling the underlying hosting and scaling. Amazon Bedrock AgentCore is the part of that platform focused specifically on building and running AI agents, including tools like Code Interpreter that let agents execute code in a managed sandbox rather than only reasoning in text.

What are the disadvantages of AWS Bedrock?

The clearest documented one, relevant to this story, is that network isolation claims for Code Interpreter's Sandbox mode weren't as absolute as AWS's own documentation once suggested. Independent researchers at BeyondTrust found in 2025 that Sandbox mode allowed DNS based data exfiltration despite being described as having no external access, a gap AWS closed for that specific technique in April 2026 but which illustrates that isolation claims on any managed sandbox deserve independent verification rather than being taken at face value. More generally, teams evaluating Bedrock across multiple providers and pricing modes commonly cite billing complexity as a practical friction point.

How much does Amazon Bedrock cost?

Pricing is usage based and varies by model, provider, and modality, and AWS itself directs customers to select a specific model provider on its pricing page to see applicable rates rather than publishing one flat number. AWS also offers Standard, Flex, Priority, and Reserved pricing tiers, along with batch inference at a discount versus on demand pricing for select models. Because rates change and vary this much by model, check AWS's official Bedrock pricing page for current figures rather than relying on a single quoted number.

What are the different AWS Bedrock models?

Bedrock provides access to foundation models from multiple third party providers, including Anthropic, Meta, Mistral, Cohere, and AI21, alongside Amazon's own Nova model family, spanning text, image, and other modalities. The specific lineup changes regularly as new models reach general availability, so AWS's own model catalog is the source to check for what's currently offered rather than any fixed list.