What it takes to make AI agents secure for R&D

AI agents can already do real work in the lab. The open question is whether security teams can trust them with it. As agents take on more work, the security bar rises with it. Benchling’s stance is direct: we hold agentic features to the same standard of security as the rest of our platform. Even then, AI brings its own challenges. Here’s how we classify those concerns and the controls we build to address them.

Your data, your agents

Benchling AI runs on a set of AI Trust Principles. These include:

• Your data is yours. Benchling doesn’t train its own models on customer data or run cross-customer model training.

• Your agents are isolated to your workspace’s tenant and inherit per-user permissions. If a scientist can’t see a project, neither can their agent.

• Underlying AI models handle your data temporarily for inference. The model providers never train on it.

• Everything is encrypted in transit and at rest. We don’t compromise on classical data security controls, so AI features run on the same basics as the rest of the platform.

• You stay in control. Data access is opt-in, and agent actions come with human review and audit logs.

These principles and more protect your R&D data. You can read the specifics in the Benchling AI Security Whitepaper, written by the security engineers who build these controls, in our Trust Center. Ultimately, these principles are the baseline. What matters just as much is what happens once an agent is actually running, and how we keep that control from slipping.

Security at the forefront of how we build

We think about an agent’s reach in four ways: what it decides to do, the code it runs, the models it calls, and the software underneath all of it. Across all four, we treat the model as untrusted by default and design around it, building on a foundation of sandboxing, least-privilege access, and trusted-only inputs to models. These fundamentals predate AI, and they hold up even when a model fails.

Agents can only do what their users can do

An agent can take an unintended action, either by accident through model hallucination or through malicious prompt injection, where instructions are hidden in untrusted data. Accidents and attacks have different causes, but since they can look identical, we focus on limiting what either one can do.

• Agents run with least-privilege access, mirroring the controlling user, so an agent can’t take an action its user couldn’t.

• Actions are auditable and attributed to the agent, and users can see what happened directly within a chat session.

Code and models run in sandboxes with no route out

The sharpest concern is data going somewhere you don’t want it to go. Whether a user or an agent initiates an action, data movement has to follow your company’s policies.

• Code written by an agent is untrusted, so it runs only with true virtual-machine isolation, using Bedrock AgentCore Code Interpreter, gVisor, and Lambda MicroVMs. Code goes in, and results come out as files, with no live network access and no DNS exfiltration path. We test these controls continuously. For more on this architecture, see our AWS Machine Learning blog.

• Web searches use a search index private to our AWS environment.

• Web content written by an agent displays in a strict iframe sandbox, which blocks URL fetching and stops JavaScript from reaching other pages.

Scientific models raise a separate issue that’s easy to miss. A structure-prediction or generative model is a full program, complete with code that has to run somewhere. Benchling treats these models like any other untrusted code, even though we get the models from trusted sources. We run these in sandboxes that use ephemeral or single-tenant execution, so one customer’s run can never access data from another.

Patching keeps pace with the volume

Security researchers now use their own AI agents, which has set off a flood of published open-source supply-chain vulnerabilities. We automate patching and upgrades, prioritized by reachability and regression risk, and batch updates so reviewers can focus on the ones that matter most. When we hold off on low-risk fixes to keep the product stable, our vulnerability management program keeps track of them.

Making the safest path the easiest one

The instinct to lock everything down often backfires. When security says no, motivated scientists will find another way. That’s how shadow AI spreads through unsanctioned tools, unofficial Model Context Protocol (MCP) connectors, and quick vibe-coded scripts that skip review. Benchling’s answer is to make the safest path the easiest one to reach, both internally and in our products.

This can play out in a few ways:

• We use an AI governance layer, especially one that offers official connectors and MCPs configured by your IT team. This gives IT great visibility and lets teams reach for sanctioned options first.

• We use OAuth 2.0 instead of static API keys for MCPs. Static keys tend to be over-permissioned and easy to leak, while OAuth 2.0 ties access to the user and their permissions rather than a service account.

• We give vibe-coded tools an official home, where a useful tool can become supported and the platform can help with tedious details like single sign-on. If your teams want to build their own tools on Benchling, the Benchling Platform’s v3 APIs, Python SDK, and MCP are the place to start. The SDK’s typed interfaces also give AI tools a clear contract to follow, which reduces hallucinated requests. Learn more about the infrastructure behind the Benchling Platform.

Enablement tends to win where prohibition fails. AI gets safer for science when the people building and using it work together and share what works.

Where AI security becomes an R&D advantage

The companies that scale AI in R&D will be the ones that can hand an agent real work on real science, because they know exactly what that agent can and can’t do. That’s the part we build for, and it’s what turns AI security from a blocker into a reason to say yes.

The controls above are in place today, and we’re continuing to invest in them. This includes further alignment with ISO 42001 and AIUC-1 and more testing of how agents behave. We keep our AI security whitepaper and Trust Center up to date along the way, and we’ll share more as each piece is ready. If you want to talk through what’s ahead, we’re glad to do that directly.

More than half of the world’s top 50 biopharma already run their science on Benchling. If you’re weighing how to give science-grounded AI a real and active role in your own R&D, with the necessary safeguards in place, we’re happy to walk through Benchling’s approach and the value that it delivers in the context of your workflows.