How Abnormal AI uses Amazon Bedrock AgentCore Code Interpreter to run agentic email security at billion-message scale

# What this story is about Abnormal AI uses Amazon Bedrock AgentCore Code Interpreter as an ephemeral compute sandbox for the inline agents that decide the hardest email threat cases. The company runs these systems in production at billion-message scale and describes the architecture, sandbox features, and practical lessons for operators who want to deploy Code Interpreter in production.

# Why agents need a compute scratch pad Large language models are strong at semantic reasoning but can't replace deterministic computation or file-based workflows. Tasks that require exact counting, data transformation, visualization, or code verification need a real execution environment. Abnormal AI treats Code Interpreter as a place where agents can run scripts, upload and download files, execute tests, and produce structured outputs that integrate back into detection logic.

# What Code Interpreter provides Code Interpreter is a managed, serverless runtime that exposes an API. Key capabilities used by Abnormal AI:

• Host-level sandboxing for session separation and reduced cross-session disclosure risk.
• Networking modes: sandbox VPC or public internet access depending on threat model and data needs.
• Preloaded Python and Node.js runtimes with common libraries for visualization, statistics, and data processing.
• File handling via the API up to 100 MB, and integration with Amazon S3 for larger datasets.
• Built-in observability: logs sent to Amazon CloudWatch and audit records to AWS CloudTrail.

Because Code Interpreter is API-driven, teams retain control over agent workflows and can plug it into existing agent infrastructure.

# Abnormal AI's three-tiered detection architecture Abnormal AI classifies email traffic across three tiers to balance scale and precision:

• Tier 1: High-volume lightweight classification (billions/day). Small models, heuristics, and logistic regressions handle the bulk of messages where deep analysis isn't necessary or cost-effective.
• Tier 2: Medium models for uncertain cases (millions/day). Deeper ML and behavioral analysis run on messages where Tier 1 lacks confidence.
• Tier 3: Inline agents with Code Interpreter (tens of thousands/day). The hardest cases that would otherwise require a human analyst are routed to agents that run code in sandboxes, analyze threat intelligence, dynamically generate scripts, and make inline block/allow decisions.

This staged approach reserves expensive, stateful sandbox compute for the small fraction of messages that need it.

# How agents operate at Tier 3 Inline agents receive enriched threat intelligence for a message, spin up a MicroVM session via the Code Interpreter API, and perform concrete operations: run analysis scripts, query and transform data, produce visualizations or reports, and run tests against generated code. Decisions flow back into the behavioral model. Misclassifications feed a separate learning system so the overall pipeline improves over time.

# Design and operational lessons

• Choose sandbox networking (VPC vs public) based on access needs and data sensitivity.
• Offload larger file workloads to S3 rather than API file uploads when datasets exceed 100 MB.
• Route only the hardest, low-volume cases to inline agents to control cost and complexity.
• Rely on observability (CloudWatch, CloudTrail) and dedicated monitoring systems to verify live agent behavior and capture misclassifications for retraining.

# What this means for builders Teams that already run agents can integrate Code Interpreter without changing agent workflows: the service acts as a plug-in execution environment. For security-sensitive workloads, combine host-level sandboxing, VPC controls, audit logging, and a limited-scope routing policy so only necessary traffic reaches the interpreter.

# Bottom line Abnormal AI shows a practical pattern: keep the majority of traffic in lightweight classifiers, escalate uncertain cases to stronger ML, and use a managed code-execution sandbox for the toughest, analyst-level decisions. That combination provides inline, real-time threat detection while containing cost and operational surface area.