Abnormal AI: Amazon Bedrock AgentCore for agentic email security at scaleAbnormal AI：利用 Amazon Bedrock AgentCore 实现大规模代理式电子邮件安全防护

AI agents now run in production at a scale of billions of operations a day, and a recurring architectural pattern has surfaced: agents need a compute scratch pad. Not only for coding tasks, but for data aggregation, analysis, verification, and any workflow where semantic reasoning alone isn’t enough.AI 代理目前已在生产环境中以每天数十亿次操作的规模运行，一种反复出现的架构模式也随之浮现：代理需要一个计算暂存区。这不仅是为了编码任务，也是为了数据聚合、分析、验证以及任何仅靠语义推理无法完成的工作流。

Abnormal AI, a behavioral security service that protects more than 25 percent of the Fortune 500, has deployed Amazon Bedrock AgentCore Code Interpreter, a capability of Amazon Bedrock AgentCore. Abnormal AI uses it for the agents that support its real-time inline email threat detection. These systems run in production today, processing billions of messages and executing agent-driven code at that same scale to detect and block threats inline, before they reach the inbox.Abnormal AI 是一家行为安全服务公司，为超过 25% 的财富 500 强企业提供保护。该公司部署了 Amazon Bedrock AgentCore 的一项功能——Amazon Bedrock AgentCore 代码解释器（Code Interpreter）。Abnormal AI 将其用于支持实时内联电子邮件威胁检测的代理。这些系统目前已在生产环境中运行，处理数十亿条消息，并以同样的规模执行代理驱动的代码，从而在威胁到达收件箱之前对其进行内联检测和拦截。

This work is part of how Abnormal AI builds software. Today, 80 percent of their code changes are built using an agent in some way, and 40 percent are built end-to-end by a background agent (fully AI built, not AI assisted). Their use of AgentCore Code Interpreter for threat detection reflects the same AI-native approach applied to their production runtime.这项工作是 Abnormal AI 构建软件方式的一部分。如今，他们 80% 的代码变更在某种程度上都是由代理构建的，其中 40% 是由后台代理端到端构建的（完全由 AI 构建，而非 AI 辅助）。他们将代码解释器用于威胁检测，反映了应用于其生产运行时的同一种 AI 原生方法。

In this post, we share how Abnormal AI architected these systems, the design decisions behind their sandbox approach, and practical lessons for builders deploying Code Interpreter at scale.在本文中，我们将分享 Abnormal AI 如何构建这些系统，其沙箱方法背后的设计决策，以及为大规模部署代码解释器的构建者们提供实用经验。

What is Amazon Bedrock AgentCore Code Interpreter?什么是 Amazon Bedrock AgentCore 代码解释器？

Amazon Bedrock AgentCore Code Interpreter provides a fully managed, serverless runtime for agents to execute code dynamically. Key characteristics include:Amazon Bedrock AgentCore 代码解释器为代理动态执行代码提供了一个完全托管的无服务器运行时。其主要特性包括：

• Ephemeral MicroVM sessions: configurable time-to-live from 15 minutes (default) up to 8 hours for long-running tasks.临时 MicroVM 会话：生存时间（TTL）可配置，从 15 分钟（默认）到最长 8 小时，适用于长时间运行的任务。
• Security: sessions run in secure sandboxes with full separation at the host operating system level, designed to help prevent inadvertent disclosure between sessions.安全性：会话在安全沙箱中运行，并在主机操作系统层面实现完全隔离，旨在防止会话间发生意外的数据泄露。
• Flexible networking: configurable for sandbox virtual private cloud (VPC) mode, or public internet access.灵活的网络连接：可配置为沙箱虚拟私有云（VPC）模式或公网访问模式。
• File handling: up to 100 MB through the API directly, or connect to Amazon Simple Storage Service (Amazon S3) for larger datasets.文件处理：通过 API 直接处理最大 100 MB 的文件，或连接到 Amazon Simple Storage Service (Amazon S3) 处理更大的数据集。
• Preloaded runtimes: Python and Node.js environments with common visualization, statistics, and data processing libraries.预加载运行时：提供包含常用可视化、统计和数据处理库的 Python 和 Node.js 环境。
• Built-in observability: logs sent to Amazon CloudWatch and AWS CloudTrail for monitoring.内置可观测性：日志发送至 Amazon CloudWatch 和 AWS CloudTrail 以进行监控。

Critically, Code Interpreter is exposed as an API. This means it doesn’t dictate the agent’s workflow. Instead, it provides a box where the agent can run commands, upload files, and retrieve results. For teams with existing agent infrastructure, this plug-and-play design makes the integration straightforward.关键在于，代码解释器是以 API 形式提供的。这意味着它不会限定代理的工作流。相反，它提供了一个盒子，代理可以在其中运行命令、上传文件并获取结果。对于拥有现有代理基础设施的团队来说，这种即插即用的设计使得集成变得非常简单。

Figure 1: Amazon Bedrock AgentCore Code Interpreter architecture, where the agent invokes the Code Interpreter API to provision an ephemeral MicroVM sandbox session for code execution, file input and output, and result retrieval图 1：Amazon Bedrock AgentCore 代码解释器架构。代理调用代码解释器 API 来配置临时的 MicroVM 沙箱会话，用于代码执行、文件输入输出以及结果检索。

Why agents need a compute scratch pad为什么代理需要计算暂存区

Large language models (LLMs) excel at reasoning and semantic coherence, but many real-world operations don’t map to semantic reasoning:大语言模型（LLM）擅长推理和语义连贯性，但许多现实世界中的操作并不能映射到语义推理上：

• Basic math and counting: “How many phishing email did we detect in the past hour?” requires computation, not language generation.基础数学和计数：“我们在过去一小时内检测到了多少封钓鱼邮件？”这需要计算，而不是语言生成。
• Data processing and visualization: transforming raw data into charts, PDFs, or structured reports.数据处理和可视化：将原始数据转换为图表、PDF 或结构化报告。
• Code verification: running unit tests, linting, and integration tests to validate agent-generated outputs.代码验证：运行单元测试、代码检查（linting）和集成测试，以验证代理生成的输出。

By pairing a large language model with Code Interpreter, you enhance the agent’s capabilities beyond what reasoning alone can achieve.通过将大语言模型与代码解释器相结合，您可以增强代理的能力，使其超越仅靠推理所能达到的水平。

“Pretty much any agent, whether it’s writing code or not, needs a code interpreter sandbox that allows it to actually crunch data and come to answers.”“几乎任何代理，无论它是否在编写代码，都需要一个代码解释器沙箱，使其能够真正处理数据并得出答案。”

— Shrivu Shankar, VP of AI Strategy, Abnormal AI——Shrivu Shankar，Abnormal AI 人工智能战略副总裁

Abnormal AI’s architecture: Three-tiered detection at billion-message scaleAbnormal AI 的架构：十亿级消息规模下的三层检测

Abnormal AI processes billions of email messages through a three-tiered detection architecture, as shown in Figure 2.Abnormal AI 通过三层检测架构处理数十亿封电子邮件，如图 2 所示。

Figure 2: Abnormal AI’s three-tiered email detection pipeline, with Tier 1 (heuristics, billions/day), Tier 2 (machine learning models, millions/day), and Tier 3 (inline agents with Code Interpreter, tens of thousands/day), where each tier handles progressively harder cases that the previous tier was unconfident about图 2：Abnormal AI 的三层电子邮件检测流水线。第 1 层（启发式，每天数十亿条）、第 2 层（机器学习模型，每天数百万条）和第 3 层（带代码解释器的内联代理，每天数万条）。每一层都会处理前一层无法确定的、难度递增的案例。

Tier 1 — high-volume lightweight classification (billions/day)第 1 层 — 高容量轻量级分类（每天数十亿条）

Small models, heuristic rules, and lightweight classifiers (logistic regressions) handle the largest volume of traffic. At this scale, it’s both cost-prohibitive to run larger models and unnecessary. Most messages can be classified without deep analysis.小型模型、启发式规则和轻量级分类器（逻辑回归）处理最大流量。在此规模下，运行大型模型既成本高昂，也没有必要。大多数消息无需深度分析即可分类。

Tier 2 — medium models for uncertain cases (millions/day)第 2 层 — 针对不确定案例的中型模型（每天数百万条）

Messages that Tier 1 is unconfident about flow into deep learning and machine learning (ML) models that perform more behavioral signal analysis.第 1 层无法确定的消息会流入深度学习和机器学习（ML）模型，这些模型会执行更多的行为信号分析。

Tier 3 — inline agents with Code Interpreter (tens of thousands/day)第 3 层 — 带代码解释器的内联代理（每天数万条）

The hardest cases, which would typically require a human analyst to evaluate, are processed by inline agents. These agents receive the threat intelligence data and use a sandbox to analyze it, writing scripts dynamically. They then evaluate how it fits into the overall behavioral model and make a determination. Misclassifications are handled by a separate system that learns and improves the system. A variety of monitoring systems verify the live system.最困难的案例（通常需要人类分析师来评估）由内联代理处理。这些代理接收威胁情报数据并使用沙箱进行分析，动态编写脚本。然后，它们评估这些数据如何融入整体行为模型并做出决定。分类错误由一个单独的系统处理，该系统会学习并改进整体系统。各种监控系统会对实时系统进行验证。

The analyst agent — batch intelligence分析师代理 — 批处理智能

Beyond the real-time classification pipeline shown in Figure 2, Abnormal deploys an analyst agent that operates in batch mode (Figure 3):除了图 2 所示的实时分类流水线外，Abnormal 还部署了一个以批处理模式运行的分析师代理（图 3）：

• Ingests misclassifications and tuning signals from its detection pipeline.摄取来自其检测流水线的分类错误和调优信号。
• Identifies patterns and trends across large message sets.识别大型消息集中的模式和趋势。
• Autonomously writes draft candidate heuristics for Tier 1, operating on Abnormal AI’s own detection-pipeline features and signals.基于 Abnormal AI 自身的检测流水线特征和信号，自主编写第 1 层的候选启发式规则草案。
• Improved models for Tier 2.为第 2 层改进模型。
• Runs on the scale of approximately 100 batch jobs per week.以每周约 100 个批处理作业的规模运行。

Figure 3: The analyst agent feedback loop, where the batch agent ingests misclassifications from the real-time pipeline, analyzes patterns using Code Interpreter sessions, and feeds improved heuristics and models back into Tier 1 and Tier 2图 3：分析师代理反馈循环。批处理代理摄取来自实时流水线的分类错误，使用代码解释器会话分析模式，并将改进后的启发式规则和模型反馈回第 1 层和第 2 层。

These batch jobs can run for more than 30 minutes with Code Interpreter sessions maintained throughout. They can also span day-long operations where the agent uses Code Interpreter intermittently. For example, it runs a session, trains a model externally, then re-invokes Code Interpreter to process the result.这些批处理作业运行时间可超过 30 分钟，期间代码解释器会话保持开启。它们还可以跨越全天的操作，代理在期间间歇性地使用代码解释器。例如，它运行一个会话、在外部训练一个模型，然后重新调用代码解释器来处理结果。

Security: Zero-trust sandbox design安全性：零信任沙箱设计

Abnormal chose the sandbox (no egress) configuration for Code Interpreter driven by two considerations:Abnormal 选择为代码解释器配置沙箱（无出口流量），是基于两点考虑：

1. Reproducibility – Because the sandbox has no external network access, nothing outside Abnormal AI’s control can influence the agent’s behavior during that session. The environment is designed to be fully deterministic.可复现性——由于沙箱没有外部网络访问权限，在会话期间，Abnormal AI 控制之外的任何因素都无法影响代理的行为。该环境旨在实现完全确定性。
2. Data exfiltration prevention – threat intelligence data enters the sandbox for analysis. Even if the agent becomes malicious through prompt injection or stochastic behavior, it is designed to prevent the exfiltration of that data to the internet.防止数据泄露——威胁情报数据进入沙箱进行分析。即使代理因提示词注入或随机行为而变得恶意，该设计也能防止这些数据被泄露到互联网。

Additional security practices:其他安全实践：

• Controlled data ingestion: intentional about what types of data enter Code Interpreter and what write actions are permitted.受控数据摄取：有意识地控制进入代码解释器的数据类型以及允许的写入操作。
• Subprocessor alignment: Code Interpreter operates under the existing AWS subprocessor relationship and reduces compliance overhead.子处理商对齐：代码解释器在现有的 AWS 子处理商关系下运行，降低了合规负担。
• Network isolation layering: sandbox isolation on top of their existing network-isolated harness provides defense in depth.网络隔离分层：在现有的网络隔离架构之上增加沙箱隔离，提供了纵深防御。

Lessons learned and best practices经验教训与最佳实践

Several practices emerged from running Code Interpreter in production at Abnormal AI.在 Abnormal AI 的生产环境中运行代码解释器，总结出了一些实践经验。

1. Give the agent what it wants1. 给代理它想要的

Agents perform better with a lightweight, general harness rather than rigid step-by-step workflows. Provide high-level principles for solving a problem and let the agent use its intelligence to determine the approach.代理使用轻量级、通用的工具集比使用僵化的分步工作流表现更好。为解决问题提供高级原则，并让代理利用其智能来决定处理方法。

2. Every agent needs a scratch pad2. 每个代理都需要一个暂存区

Code Interpreter isn’t only for coding agents. Security agents analyzing email benefit from compute scratch pads for data aggregation, pattern analysis, and verification.代码解释器不仅适用于编码代理。分析电子邮件的安全代理同样可以利用计算暂存区进行数据聚合、模式分析和验证。

3. Use programmatic verifiers as guardrails3. 使用程序化验证器作为护栏

Agents deliver higher quality outputs when they have programmatic verification tools. Unit tests, integration tests, and linting allow the agent to self-test within the sandbox before delivering final results.当代理拥有程序化验证工具时，能提供更高质量的输出。单元测试、集成测试和代码检查允许代理在交付最终结果之前在沙箱内进行自测。

4. Use file systems as recovery points for long-running tasks4. 使用文件系统作为长时间运行任务的恢复点

For operations exceeding the Code Interpreter session time (for example, model training), use the file system as a checkpoint. Run Code Interpreter for computation, persist state to files, perform long-running operations externally, then re-invoke Code Interpreter to process results. The analyst agent (Figure 3) uses this pattern for day-long model training operations.对于超过代码解释器会话时间的操作（例如模型训练），使用文件系统作为检查点。运行代码解释器进行计算，将状态持久化到文件，在外部执行长时间运行的操作，然后重新调用代码解释器处理结果。分析师代理（图 3）在全天模型训练操作中就使用了这种模式。

Conclusion结论

Abnormal AI’s implementation demonstrates a key insight for production agent systems: Code Interpreter is not merely a coding tool. It’s fundamental infrastructure that agents use to reason computationally. By combining the managed, secure sandbox of AgentCore Code Interpreter with their own lightweight agent harness, Abnormal achieves:Abnormal AI 的实现展示了生产环境代理系统的一个关键洞察：代码解释器不仅仅是一个编码工具。它是代理用于进行计算推理的基础设施。通过将 AgentCore 代码解释器的托管安全沙箱与其自身的轻量级代理工具集相结合，Abnormal 实现了：

• Zero-trust security posture through sandbox isolation helping prevent data exfiltration.通过沙箱隔离实现零信任安全态势，有助于防止数据泄露。
• Billion-message scale by reserving agent compute for the hardest cases (Figure 2).通过将代理计算资源留给最困难的案例，实现了十亿级消息的处理规模（图 2）。

Whether you’re building security agents or a system where agents need to crunch data and verify their own outputs, the pattern is clear. Give your agents a scratch pad and trust their evaluations more than you trust their assertions.无论您是在构建安全代理，还是在构建需要代理处理数据并验证自身输出的系统，该模式都很明确。给您的代理一个暂存区，并且相比于代理的断言，更应信任它们的评估结果。

Next steps后续步骤

• Get started with Amazon Bedrock AgentCore Code Interpreter.开始使用 Amazon Bedrock AgentCore 代码解释器。
• Explore AgentCore capabilities and other tools (Gateway, Memory, Runtime, Identity).探索 AgentCore 的功能及其他工具（网关、内存、运行时、身份验证）。
• Learn more about Abnormal AI at abnormalsecurity.com.访问 abnormalsecurity.com 了解更多关于 Abnormal AI 的信息。

Abnormal AI is an AWS customer. The views and opinions expressed in this post are those of the customer and don’t necessarily reflect the views of Amazon Web Services.Abnormal AI 是 AWS 的客户。本文中表达的观点和意见属于客户本人，并不一定反映亚马逊云科技的观点。

About the authors关于作者