Amazon Bedrock AgentCore Code Interpreter vs InstaVM

Amazon Bedrock AgentCore Code Interpreter 87

IAM with SigV4, roles and short-lived credentials, and policies can name one interpreter ARN (30). Each of the nine operations is its own IAM action, system and custom interpreters have separate ARN types, a custom interpreter's execution role bounds what sandbox code can reach, and the default Sandbox network mode reaches only Amazon S3. No approval step for destructive calls (17 of 20). Each session is a dedicated microVM whose memory AWS says is sanitised at the end, and the docs flag Public network mode as a risk, but the Code Interpreter pages we read give no guidance on treating execution output as untrusted. The SDK's install_packages() needed two fixes in 2026 for package-name arguments that could run commands in the sandbox, and AWS's workaround is to keep model-generated input away from it (11 of 15). CloudWatch metrics, spans and per-second usage logs per session, and the overview claims CloudTrail logging, but we found no page listing Code Interpreter's CloudTrail events, and console logs are not sent to CloudWatch (11 of 15). A vulnerability disclosure programme on HackerOne, public bulletins with CVEs for the SDK advisories, and AgentCore in SOC 1, 2 and 3 scope on the list of 11 August 2026. The security.txt on aws.amazon.com, expired from 24 September, was renewed by 17 October with Expires 2027-10-16. No paid bounty was found, so 18, as on the Polly, S3 and Secrets Manager re-checks of 17 October (18 of 20).

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

Amazon Bedrock AgentCore Code Interpreter 65

The Python SDK that carries code_session shipped 1.24.1 on 7 October 2026 (tagged 6 October) and is still the latest tag on 17 October. The newest change to Code Interpreter itself is the API model update of 23 July 2026, which added filesystemConfigurations for Amazon S3 Files and EFS mounts, 86 days before 17 October, alongside the ActiveSessionCount metric that month. No Code Interpreter entry in the September or October release notes, so 20 of 30 as a judgement call (20). The SDK has had eight tagged releases since 28 July and the release notes have entries every month, yet few touch Code Interpreter (10 of 20). Public release notes with RSS, issues open on the SDK repository with an auto-triage workflow, and re:Post and AWS Support. Reply times were not checked (10 of 15). Current official SDKs, bedrock-agentcore 1.24.1 on PyPI and 0.4.5 on npm (15). The SDK repository runs CI, integration tests, security scanning and a breaking-change check, with a lock file, and since 5 October requires approval before a release is published (10).

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

Amazon Bedrock AgentCore Code Interpreter 75

Results stream back as content blocks with stdout and stderr, and we found no control for truncating or sizing output. The MCP server registers 122 tools by default and AGENTCORE_ENABLE_TOOLS cuts that to the 10 for Code Interpreter (15 of 25). ListCodeInterpreterSessions pages with maxResults of 1 to 100 and nextToken and filters by status (15 of 20). Typed errors with HTTP codes, but a quota breach comes back as HTTP 402 and errors can also arrive inside the result stream (15 of 20). clientToken on session start and on interpreter create and delete. Running code has no idempotency key (15 of 20). The managed interpreter needs no set-up, code_session handles start and stop, and there are AgentCore SDKs for Python and TypeScript beside the AWS SDKs (15).

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

Amazon Bedrock AgentCore Code Interpreter 73

Closed service under the AWS Service Terms, last updated 13 October 2026, with Apache-2.0 SDKs and MCP server (15). The docs say session files are cleaned up when a session ends and also give a 30-day retention period for session data without saying what is kept. Encryption at rest and TLS 1.2 are stated, the privacy notice excludes customer content, and we found no Code Interpreter statement on use of customer content. Section 50.3 of the Service Terms, which allows use of content to improve a service, doesn't name Bedrock or AgentCore (15 of 30). No deprecation policy for the interpreter or its language runtimes was found. The system interpreter id carries a version (3 of 20). AWS publishes a sub-processor list, updated 28 July 2026, and the guide lists the 22 Regions where built-in tools run, per the 8 October check (18 of 20).

InstaVM 57

Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.

Amazon Bedrock AgentCore Code Interpreter 81

The API model is public as Smithy JSON in aws/api-models-aws, version 2024-02-28, and the SDKs are generated from it (25). The developer guide has an llms.txt of 988 lines and serves every page as Markdown (10). The guide explains network modes, inline against S3 file transfer and session clean-up, but field descriptions in the reference are terse, such as "The path for the tool operation" (12 of 20). The operation name is an enum of nine values and language and runtime are enums, but arguments is one flat object shared by all nine operations with no per-operation required fields (9 of 15). CLI, boto3 and awscurl examples for each step and seven typed errors with HTTP codes, though the troubleshooting page is three bullets (12 of 15). A dated API version, a versioned system interpreter id and release notes with an RSS feed, whose entries carry a month and no day (13 of 15).

InstaVM 66

A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.

Amazon Bedrock AgentCore Code Interpreter 30

No x402, MPP or L402 on the Code Interpreter endpoints. AgentCore Payments is a separate component for an agent paying third parties (0). Per-unit prices published without a login, $0.0895 a vCPU-hour and $0.00945 a GB-hour (20). No allowance for Code Interpreter, but the pricing page says new AWS customers get up to $200 in Free Tier credits and the Free Tier FAQ says most new customers need no payment method, so half, as on the other AWS listings (10). A person signs up in a browser and sets up IAM (0).

InstaVM 20

No x402, MPP or L402 (0 of 40). Per-second vCPU, memory and storage prices are published without a login (20). The free plan's $50 credit needs a card on file (0). Signup and key minting are in a browser dashboard (0). Total 20.