Abnormal AI: Amazon Bedrock AgentCore for agentic email security at scale
aws ·
An AWS post describes how Abnormal AI uses Amazon Bedrock AgentCore Code Interpreter for real-time, inline email threat detection. Abnormal AI, which protects more than 25% of the Fortune 500, processes billions of messages and uses agents to analyze and block threats before they reach inboxes. Code Interpreter provides a managed, serverless runtime with ephemeral MicroVM sandboxes, configurable networking, file handling, preloaded Python and Node.js environments, and built-in observability. Abnormal AI uses a three-tier detection system in which lightweight methods handle billions of messages per day, machine-learning models process millions of uncertain cases, and inline agents with Code Interpreter examine tens of thousands of the hardest cases. A separate batch analyst agent runs about 100 jobs per week to identify patterns, draft heuristics, and improve models using feedback from misclassifications. The company selected a no-egress sandbox to support reproducibility and help prevent threat-intelligence data exfiltration, alongside controlled data ingestion and layered network isolation. The post’s main lessons are to give agents a flexible harness and computational scratch pad, use programmatic verification, and preserve state in files for long-running workflows.
aws