build1 publisher
A three-rule DNS allowlist closes the last exit from Benchling's agent code sandbox
Benchling runs agent-written scientific code in a separate AWS account with no internet gateway and no NAT gateway, so the remaining way out of the VPC was a name lookup. The resolver policy answers the endpoints Benchling listed and blocks everything else.
Publishers:aws.amazon.com
Reality
- Evidence56
- Adoption44
- Hype gap+16
- Incentives82
- Confidence58