Vibe Coding is a feature of Benchling Chat. With Vibe Coding, Benchling Chat calls the Canvas tool to create interactive HTML views, such as reports and dashboards directly in your AI chat. The Canvas then shows up as a card in the conversation and an expanded view in the side panel. The content reflects data Benchling Chat retrieved on your behalf at the time the Canvas was created.
Why Canvas content uses a separate domain
When you open a Canvas, its content loads from a dedicated Benchling domain (for example, *.benchlingCanvas.com), not your tenant URL (for example, yoursubdomain.benchling.com). This is intentional.
Benchling treats AI-generated HTML as untrusted content, even though Benchling creates it. Serving it from a separate website creates a hard boundary between the Canvas and your active Benchling session. That boundary stops Canvas code from reaching your login cookies, session tokens, or the Benchling application around it.
The Canvas domain is Benchling-operated infrastructure, not a third-party host. Benchling controls how content is stored, delivered, and restricted on that domain.
To view and interact with Canvases, *.benchlingCanvas.com needs to be reachable through any proxy or firewall on your network. See the FAQ below if your organization's network is blocking this.
How it works at a glance:
- You view a Canvas inside Benchling Assistant while logged into your tenant.
- Benchling verifies your identity and issues a short-lived, secure link to the Canvas content.
- The Canvas loads in a locked-down embedded viewer from the Benchling Canvas domain.
- The Canvas displays interactively but stays isolated from your Benchling session.
How Canvases are isolated and restricted
Benchling applies several layers of protection so a Canvas can be useful without putting your broader Benchling environment at risk. A Canvas cannot:
- Access your Benchling login or session. The Canvas runs in a locked-down embedded viewer. It can display interactive content, but it cannot read your cookies, credentials, or the surrounding Benchling page.
- Open new windows or navigate you away. The Canvas cannot open pop-ups, submit forms to external sites, or redirect you to another website.
- Load content from the internet. The Canvas cannot fetch scripts, images, fonts, or data from external websites. All content is self-contained.
- Run arbitrary third-party code from the web. Interactive features such as charts or structure drawing use Benchling-approved libraries, not code loaded from external sources.
Who can access a Canvas
- You must be logged into Benchling to view a Canvas.
- By default, only the creator can view the Canvas. Canvases added to a project folder can be viewed by users with access to the folder.
- Canvas content is scoped to your organization, consistent with other Benchling data.
How your data is protected
- Encrypted storage. Canvas files are stored in Benchling-managed, encrypted cloud storage.
- Secure delivery. Content is delivered over HTTPS using short-lived access links.
- Not publicly browsable. Canvas HTML is not available on the open internet. Each view needs an authenticated request to Benchling, which issues a time-limited link.
Frequently asked questions
Can Canvas code access my Benchling account or other data?
No. The Canvas is isolated from your session and cannot make live requests to Benchling or external services.
Can I share a Canvas link with a colleague?
Not currently.
Is the separate domain a third-party service?
No, it is Benchling-controlled infrastructure dedicated to serving Canvas content securely.
Does the Canvas send data to external websites?
No. External network requests from the Canvas are blocked.
How is this different from Benchling App Canvas?
App Canvas is a developer framework for building Benchling Apps. Canvas is an Assistant-generated interactive view in chat.
My organization's network is blocking Canvas content. What do I do?
Some corporate firewalls or web proxies block traffic to domains they have not seen before, and *.benchlingCanvas.com may show up as uncategorized the first time. If you see a blocked-access message when opening a Canvas, ask your IT or network team to allowlist *.benchlingCanvas.com over HTTPS. It is Benchling-operated infrastructure, so it can be allowlisted the same way you would allowlist your Benchling tenant URL. If the block persists after allowlisting, contact your Benchling representative.
Availability
Canvas is currently rolling out to eligible tenants. Availability may vary by environment and tenant configuration. Contact your account team or support@benchling.com if you have questions about when this feature will be available to your organization.