Abnormal AI: Amazon Bedrock AgentCore for agentic email security at scale
Amazon Web Services Aswin Vasudevan
Abnormal AI is using Amazon’s Code Interpreter to spot email threats in live traffic. It’s running on billions of messages, not toy demos.
Based on reporting by Amazon Web Services, Aswin Vasudevan — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Abnormal AI has taken Amazon Bedrock AgentCore Code Interpreter into production for one of the least forgiving jobs in security: inline email threat detection at very large scale. The company says its systems process billions of messages and use agent-driven code to catch and block threats before they ever land in an inbox.
That choice follows a pattern AWS says is showing up across production agents: sometimes reasoning isn’t enough, and the model needs a place to compute. Abnormal uses the sandbox for data aggregation, analysis, verification, and other tasks that need actual execution, not just fluent guesses. In practice, that means the agent can write scripts on the fly, run them in a managed sandbox, and pull the results back into the decision process.
Abnormal’s detection stack is deliberately tiered. Lightweight rules, heuristics, and small classifiers handle traffic at billions of messages a day. Uncertain cases move to machine learning models. The hardest ones, the ones that would usually need a human analyst, go to inline agents with Code Interpreter. AWS says those cases number in the tens of thousands per day.
There’s also a batch analyst agent running beside the live system. It ingests misclassifications and tuning signals, looks for patterns across large message sets, and writes draft heuristics for the first tier. It operates at roughly 100 batch jobs a week, and some of those jobs run for more than 30 minutes. Others stretch over a day, with Code Interpreter opened, closed, and reopened as the work moves between sandboxed computation and external training.
The security story is just as important as the performance one. Abnormal chose the no-egress sandbox mode so the session stays deterministic and data can’t be pushed out to the internet. The company layers that on top of its existing network isolation, and says the arrangement helps with reproducibility and compliance. The bigger point is simple: for this kind of agent, the sandbox is not a nice extra. It’s the job.
My take — AI-written commentary, not fact-checked reporting
This is the unglamorous truth about agentic AI: most of the value is in guardrails, sandboxes, and boring verification, not magical autonomy. The people selling sentient coworkers never seem to lead with VPC mode and file recovery points, which is exactly why they should. Security teams, at least, are finally treating agents like tools that need supervision, not mascots that write emails about the future.
Read more about this at: Amazon Web Services