Kevin Orellana

Kevin Orellana’s work on Amazon Bedrock AgentCore addresses the infrastructure through which AI agents execute code and use browsers. His contributions include co-authored guides to preserving browser sessions and restricting network access, alongside an experiment that used a coding agent to stress-test AgentCore itself. These projects examine specific obstacles to completing tasks: lost authentication, inaccessible tools, malformed outputs, and execution limits.

From model inference to agent execution

Kevin studied computer science at New York University Shanghai, graduating in 2019 with minors in mathematics and interactive media arts. At AWS, he worked on the Bedrock inference team hosting frontier models before working on AgentCore. His 2026 AWS author biography describes him as a Seattle-based software engineer on that team. The work spans two parts of an AI application: serving model responses and providing environments in which agents can act.

Kevin co-authored AWS’ introduction to browser profiles, proxies, and extensions. Each feature addresses a different obstacle to browser automation. Profiles preserve cookies and local storage so an agent can restore an authenticated session. Proxies provide controlled network routing and stable outbound addresses, which can matter when corporate applications require a particular network path or a changing IP triggers another login. Extensions customize browser behavior. Kevin explained these team capabilities alongside other AWS engineers and specialists; the articles do not establish sole ownership of their implementation.

Testing where agent workflows break

Kevin’s sandbox stress-testing experiment used a coding agent to exercise the platform he worked on. He wrapped AgentCore’s code sandbox and cloud browser in an MCP server, then had the agent write and run 1,000 tests across 10 domains, recording results in SQLite. The failures included image-encoding problems, null bytes, unreadable files, and browser memory exhaustion.

The useful distinction was between failures in the interface exposed to the agent and constraints in the underlying sandbox. An encoding bug requires a different remedy from an operation blocked by file permissions or an exhausted memory budget. Kevin’s account connects those failures to sandbox mechanisms including permissions, seccomp, and eBPF, while also addressing the limits of LLM-generated tests. The experiment supplies a concrete way to probe an agent environment; it does not establish comprehensive coverage or certify the platform’s reliability.

Network restrictions and tool discovery

Two other contributions examine what an agent can reach and what it can find:

• Restricting network destinations: In a co-authored guide to domain restrictions, Kevin and his collaborators describe routing AgentCore traffic through AWS Network Firewall and allowing only approved destinations. This makes destination restrictions enforceable by infrastructure when an agent is instructed to visit an unintended site. They also explain the scope of the protection: inspecting the destination hostname during a TLS connection does not replace DNS filtering or content inspection.

• Making available tools discoverable: Kevin’s Claude Code bug report describes a search that could miss a browser evaluation tool because a long MCP server name dominated relevance ranking. He supplied a reproduction and proposed using the server prefix to filter candidates, then ranking them by the requested capabilities. The failure occurs before tool execution: a working tool contributes nothing to a task if the agent cannot discover it.

Outside his AWS work, Kevin’s author biography describes experiments with multi-agent simulations and work toward a personal assistant that can communicate in English, Spanish, and Mandarin.