Real-Time Email Threat Detection
Abnormal AI’s architecture leverages Amazon Bedrock AgentCore Code Interpreter to process billions of email messages daily. The system’s core function is inline email threat detection, where agents execute code to analyze messages and block threats before they reach the user’s inbox. This approach is driven by the need for agents to perform tasks beyond semantic reasoning, such as data aggregation, analysis, and verification.
Abnormal AI’s deployment of AgentCore Code Interpreter reflects a broader trend within the company: 80% of code changes are now built using agents, with 40% built end-to-end by AI. The system’s design incorporates ephemeral microVM sessions, configurable from 15 minutes to 8 hours, providing a flexible runtime environment. These sessions operate within secure sandboxes, preventing data leakage between agents.
Code Interpreter Capabilities
The Code Interpreter API provides a managed, serverless runtime for agents. Key features include support for Python and Node.js environments, preloaded with common visualization and data processing libraries. File handling is supported up to 100MB via the API or through Amazon S3 for larger datasets. The API-driven approach simplifies integration with existing agent infrastructure.
Three-Tiered Detection Architecture
Abnormal AI’s email detection pipeline consists of three tiers. Tier 1 uses lightweight models and heuristic rules to classify the majority of traffic (billions of messages per day). Tier 2 employs deeper machine learning models for uncertain cases (millions of messages per day). Tier 3 utilizes inline agents with Code Interpreter to handle the most complex threats (tens of thousands of messages per day).
Analyst Agent Feedback Loop
An analyst agent operates in batch mode, ingesting misclassifications and tuning signals from the real-time pipeline. This agent autonomously writes draft candidate heuristics for Tier 1, analyzing patterns across large message sets. The system monitors live operations to verify the system’s functionality. This feedback loop continuously improves the accuracy of the entire detection pipeline.
