- AWS describes Deep Insight, an open-source multi-agent data-analysis system. Its managed version isolates model-written code in containers; its web version auto-approves plans after 300 seconds.
- AWS says the Validator agent re-checks calculations but does not detect prompt-injection instructions hidden in uploaded data. It recommends adding Amazon Bedrock Guardrails.
- Ask your team what each checking step cannot see, where model-written code runs, and what happens if a human approver stays silent.
A checker only checks what it was built to check
Who checks the checker? AWS's Solutions Architecture team gives a plain answer in a post about Deep Insight, a multi-agent system it built and open sourced. Its Validator agent re-verifies calculations. But the authors write that it "doesn’t detect prompt-injection instructions hidden in uploaded data." Prompt injection means text planted in a file that tells an AI to follow new orders.
That admission points to a wider lesson. The post itself covers five production challenges, and this limit takes one sentence in it. The lesson is our own view, not the authors' thesis: a production agent is mostly the controls around the model, and each control covers one kind of failure. The failures nobody built a control for stay open. Leaders approving agent projects should ask what each control cannot see.
What AWS built
Given a CSV file and a plain-language request, Deep Insight uses a team of agents to load the data, run analyses, draw charts and write a Word report with citations. AWS says eight agents share the work: Coordinator, Planner, Plan Reviewer, Supervisor, Coder, Validator, Reporter and Tracker. Each works in its own context and passes on only compressed results.
AWS offers three ways to run it: a local command-line version, a browser version, and a managed version on Amazon Bedrock AgentCore. It says all three share one architecture.
How the work is steered
The order of steps is fixed, even though the agents' reasoning is not. A Graph pattern from the Strands Agents SDK sets the path: Coordinator, Planner, Plan Reviewer, then Supervisor. If the user asks for changes, the flow loops back to the Planner.
The Planner uses Claude Opus with extended thinking. It writes a checklist of five to ten steps. The Supervisor then calls the Coder, Validator, Reporter and Tracker as tools. The Tracker runs after each one, and the Supervisor cannot move on until every item is ticked.
AWS also matches models to jobs. The Coordinator only sorts requests, so it uses the lightweight Claude Haiku. Three agents, the Supervisor, Coder and Reporter, keep stored copies of their instructions and tool lists so the model does not reread them each time. AWS says this can trim input costs by as much as 90 percent when calls repeat. The Validator and Tracker see fresh context on every run, so the team leaves storage off for them.
Where model-written code runs
The Coder writes and runs Python. In the self-hosted version that happens locally. In production, AWS says, running such code directly on a server is risky. The model might delete system files, loop until resources run out, or reach other users' data.
So the managed version gives each session a short-lived container on AWS Fargate, inside a private virtual network. Security groups limit what can reach those containers. Access roles limit what each part can touch. This protects the infrastructure. AWS is clear that it does not govern what the agents produce.
Two details worth a second look
First, the human approval step. In the web version, the Plan Reviewer shows the plan in a browser window. AWS says a 300-second countdown approves the plan automatically if nobody responds. Silence counts as consent. That is a reasonable default for a demo. For reports that feed regulated or financial decisions, a team should choose that default on purpose.
Second, the guardrail gap. For production, AWS recommends adding Amazon Bedrock Guardrails. On the input side, they apply content filters and prompt attack detection to what users type and what they upload. On the output side, they run grounding checks, so report text stays tied to the source data. The base design leaves that layer for the adopter to add.
What the post does not show
This is the builders' account of their own system. The text we reviewed gives no error rates and no independent tests. It also mentions a customer. LG Electronics' Korea Sales Division built a tool called ChatInsight on the same architecture, AWS says. Before that, data analysis requests had taken two to three weeks. The available text cuts off before the results.
Questions to put to your team
Start with each checking step in any agent project. What does it verify, and what can it not see? Then ask who can upload files, and whether anything screens them for hidden instructions. Ask where model-written code runs and what it can reach. Ask what happens when a human approver does not answer in time.
A validator can confirm that the sums add up. It cannot tell you whether someone else wrote the question.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: AWS.
