Build1 publisher2 min readPublished
Abnormal AI runs agent-driven code in an ephemeral MicroVM on the inline email path
AWS's post on the deployment gives the sandbox defaults that decide whether it fits an inline path, among them a 15-minute session time-to-live configurable to eight hours and a choice between VPC-only and public internet access.
The Engineer · Build desk
What happened
- Abnormal AI, which AWS says protects more than a quarter of the Fortune 500, now runs Amazon Bedrock AgentCore Code Interpreter behind the agents in its real-time inline email threat detection.
- The sandbox accepts up to 100 MB of files through its API or larger datasets from Amazon S3, ships preloaded Python and Node.js runtimes, and sends logs to CloudWatch and CloudTrail.
- AWS says 80 percent of Abnormal's code changes are built using an agent in some way, and 40 percent end-to-end by a background agent, described in the post as fully AI built, not AI assisted.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- cost Every escalation buys a sandbox session, so where Tier 1 and Tier 2 set their confidence thresholds sets the session count and the compute bill.
- capability An agent that can execute code answers counting and aggregation questions by computing them. A language model can only generate text about that class of question.
- constraint The published tier volumes will not size this pattern for your own inline path. How long a session takes to become usable, while a message is held before delivery, is the constraint.
- precedent With AWS publishing an 80/40 agent-authored split as customer practice, engineering managers will be asked for their own figure, and whatever reviews those changes becomes the cost centre.
The integration surface is one API call. AWS's post says Code Interpreter is exposed as an API that does not dictate the agent's workflow, and provides a box where the agent can run commands, upload files and retrieve results [12]. A team with an existing agent loop keeps its orchestration and adds a tool.
A session is an ephemeral MicroVM. Its time-to-live defaults to 15 minutes and can be configured up to eight hours [6], which is 32 times the default [18]. Eight hours is a long time to keep a scratch pad alive for a question about one email. AWS says sessions run in secure sandboxes with "full separation at the host operating system level, designed to help prevent inadvertent disclosure between sessions" [7].
The input to these agents is email written by an attacker. So the networking setting is the one I would argue about at review: the sandbox can be configured for VPC mode or for public internet access [8]. Public access helps when the agent wants to enrich an indicator. It also gives adversary-authored content a path to the internet, and a raised TTL keeps that path open for hours.
Heuristic rules, small models and logistic regressions carry the billions of messages a day, because AWS's post says larger models at that volume are both cost-prohibitive and unnecessary [15]. The cases Tier 1 is unconfident about, millions a day, fall through to deep learning and behavioural signal models [16]. Tens of thousands a day, the hardest cases that would typically need a human analyst, go to inline agents that receive threat intelligence data and analyze it in the sandbox [17]. Take 50,000 escalations against 2 billion messages and the agent tier sees one message in 40,000 [19].
"Pretty much any agent, whether it's writing code or not, needs a code interpreter sandbox that allows it to actually crunch data and come to answers," said Shrivu Shankar, VP of AI Strategy at Abnormal AI [14]. The build-side figures come from the same post: 80 percent of code changes built using an agent in some way, and 40 percent built end-to-end by a background agent, defined there as fully AI built, not AI assisted [4]. Half of the agent-touched changes therefore have no human author [20]. Running unit tests, linting and integration tests to validate agent-generated output is on AWS's list of what the sandbox is for [13].
What to watch
- Session start latency and the p99 of the code step, if AWS or Abnormal publish them; those decide whether the tiered design transfers to another inline path.
- Whether the 15-minute default TTL or the 100 MB API file limit moves as customers push longer analyses through S3.
- Whether Abnormal describes what reviews the 40 percent of changes built end-to-end by a background agent.