Prompts Are Not Boundaries

Top-Line Summary

Zenity Labs showed that one prompt injection on one AgentCore agent could reach the metadata endpoint, grab the default execution role, and take over every agent in the account and region. AWS calls it “documented and expected”, and Brett and Travers agree the lesson is old: IMDS is always the target, and least privilege is still on you. Meta’s rushed Muse VM escape fixes make it two sandbox stories in one week, with Strands Box, Anthropic dropping git for Scion, and a pile of new Jev competitors filling out the rest.

Show Video

The “Pre-Show” Context

Travers adopted a bonded brother-and-sister pair of cats last Friday, Dipper and Nebula (“Nebby”), and five days in they are shockingly well behaved. Brett went to the shelter years ago for one cat, felt too guilty to put the other one back in its cage, and left with two. The sweet one he didn’t go there for turned out to have a bit of an edge.

The Engineering Rundown

• AgentCorruption: one prompt, every AgentCore agent (02:53)

  Zenity Labs used a prompt injection on an exposed AgentCore agent to call the metadata service and pick up the credentials of the default execution role, which was scoped region-wide. From there they could list other agents, pull their images, invoke them, read conversations and plant false long-term memories. The timeline bothered Brett: reported in December 2025, IMDSv2-only in February, the report closed as “informative” in April, the role unchanged until June, and AWS’s official line that it’s “documented and expected.” Travers’ reaction was “always the metadata service,” because that’s where the temporary credentials live. Brett has since added the IAM Access Analyzer CLI to the pipeline that deploys his AgentCore stack, and it flagged a few things. His bigger point: people are letting their agent of choice write policy documents, and the agent can have a bad day too, so a human or a tool needs to check what it produced. Zenity split the research into four detailed posts, and Brett hasn’t finished them yet.

• Strands Box: AI agent sandboxes powered by Dogwood (09:48)

  An open source agent sandbox from the Strands team, released October 7, in developer preview and macOS only for now. It uses Apple’s Seatbelt for OS-level containment plus Dogwood, a Cedar-style permit/forbid policy language. The part Brett likes is the gateway: the agent only holds placeholder tokens, and the gateway swaps in the real credentials on the way out and redacts sensitive data on the way back. That’s the opposite of the AgentCorruption story, where the agent could fetch its own secrets. Travers pointed out the gateway could sanitize responses for prompt injection too. Brett’s caveat is adoption: Cloudflare and Docker already have sandboxes, and like IAM, this tends to be the thing people “tighten up later.”

• Claude Haiku 5.5 on Amazon Bedrock (15:06)

  Haiku 5.5 landed on Bedrock the same day Anthropic announced it, which they missed last week. Anthropic says it’s about 75% cheaper than Haiku 4.5 for most tasks, but the AWS page has no per-token price, so check before you switch. Haiku is the biggest line item in Brett’s brain, so this one is on his list. Travers says it scores a little over twice Haiku 4.5 on the Intelligence Index and beats GLM 5.3 Flash on price.

• Bedrock attributes in Cost Explorer (16:43)

  Cost Explorer, Budgets and the Cost Management dashboards can now group and filter Bedrock spend by model, provider, inference type and feature, at no extra charge. Brett’s read is that this sits on top of cost allocation tags: break spend down by model first, then drop to tagged principals to see which functions are burning Haiku. Travers called it “managed tagging, almost.” Brett already gives each of his roughly dozen agents its own IAM role, so principal tags plus these attributes would give a per-agent, per-model bill. As Brett put it, policies are boring until they aren’t, and finance is the same.

• AWS Lambda Web Functions (20:55)

  A new HTTP-native Lambda form factor for Node.js web servers, with no event handler entry point and up to 128 concurrent requests per environment. Brett wondered whether it’s a response to Cloudflare Workers or Vercel, since every friend showing him a side project seems to host it on Vercel. Travers already runs Flask and Django apps on Lambda through WSGI and thinks keeping one environment warm for that many requests should cut cold starts. Brett’s other note: classic Lambda is now “Event Functions,” next to durable functions, Lambda@Edge, container functions and MicroVMs, so the naming isn’t getting simpler.

• AWS Solutions Architect certification refresh (24:22)

  Brett read that the Solutions Architect cert is being redone around mid-November. If you’re close to taking it, take it before the switch, especially if you want practice tests that match the exam.

• TwelveLabs Pegasus 1.5 on Bedrock (24:52)

  A video-to-text model: you define the moments you care about, like sports highlights or speaker changes, and it returns them with timestamps. It’s US and Global cross-Region inference only, and the hosts didn’t look up pricing. Brett wants to try it on the show recording for chapter markers and clips. Travers went off on a tangent about AI-generated microdramas: ten-minute episodes, first shot with a few actors and three camera angles in China, now generated almost entirely on ByteDance’s stack and posted straight to TikTok.

• Personal projects: agent seats and inboxes (27:25)

  Travers borrowed the “seats” model from Steve Yegge: a roster of agents that tick periodically and each watch one topic, like Google Trends or an ingest inbox for research papers. His framing is that an inbox is just a queue with an event notifier, and something watching it and acting on it has been useful. His top seat is a chief-of-staff agent that tracks project state, and he’s still figuring out how to divide the rest, maybe a bean-counter ops agent for AWS costs.

• Kiro Crew on the issue tracker (29:36)

  Brett stumbled onto crews in Kiro Crew and tied three agents to the GitLab issue tracker for his Kanban project: one for features, one for bugs, one for chores. They wake up during the workday on a remote EC2 box, find work and open merge requests. Where it fell down was that the remote box didn’t have his local skills, so it didn’t log time or write memories back the way his laptop setup does. There’s also a plugin that shows your agents as avatars walking to and from their desks, and Brett isn’t sure what it’s for beyond watching them.

• Should a backlog triager be an agent? (34:17)

  As agents file more work items, Brett is losing track of the backlog. He wants something that reads it against his monthly priorities and farms the easy items out to agents. Claude keeps telling him that’s a script, and he thinks it’s misreading the ask as a report. Travers sees both sides: some of it is just reporting on tagging and what’s piling up, but an agent picking off the low-hanging items is worth having.

• Getting agents off the laptop (38:44)

  When Brett moved to a new machine, his morning brief quietly stopped, because it had been running on the old laptop he’d set to stay awake with the lid closed. He’s moving those jobs into Fargate tasks that start, pull only the specific keys they need from Secrets Manager, make their MCP calls and exit. Travers has run out of disk five times this week on a 2 TB drive, mostly from Rust build artifacts.

• Agent volume is breaking CI runners (40:48)

  At a customer, an account bootstrapper (Control Tower without Control Tower) runs its full workflow against about 30 AWS accounts on every change. Combine that with the new volume of agent-driven work and a whole fleet of runners still isn’t enough. Brett now understands why Control Tower is slow. Travers wondered whether this is why GitHub’s availability looks like one nine.

• Anthropic redesigns source control (43:01)

  Anthropic’s monorepo merges went from about 2,500 a day in May to over 30,000 a day by September, so they built Scion, their own centralized version control, and moved off git. Commits, rebases and merges run on the server. They report about 200x smaller CPU and memory than their git mirrors and roughly 25% CPU back in CI. Travers pointed out that Google (Piper) and Meta (Mononoke) already did this, so it’s a problem for companies at that scale. Brett wonders how long until ordinary companies using these tools hit the same wall, and noted the article’s point that fixing one bottleneck just moves it down the line. It’s internal only, and Anthropic says Scion isn’t a general git replacement.

• Meta Muse Wonder (48:12)

  Meta released Muse Wonder and Wonder Full, and Wonder Full ties Claude Code with Sonnet 5.5 on Artificial Analysis’ Coding Agents Index. Travers has used it a bit and says it feels like a breath of fresh air, clearly not distilled from a Claude or OpenAI lineage. Both hosts are reluctant to give Facebook any money. Brett also waited almost three days for Meta to verify his identity on the first Muse. The price went way up: $4/$20 per million tokens, against $1.25/$4.25 for Spark 1.3, which puts it next to Opus 5.5.

• Meta rushed to fix a Muse VM escape before launch (52:05)

  404 Media reports Meta found several virtualization flaws before Muse launched, the worst a KVM escape to the host or other users’ VMs. Launch went ahead about 11 days after the hardening push started, and one source called the fixes “half-baked protections.” Meta pays up to $300K for a Muse VM escape. Travers called it the ultimate noisy neighbour, and Brett’s prediction is that if 2026 was the year of the agent, 2027 is the year of the sandbox. Brett also recalled a story, from memory and not necessarily tied to this article, of someone who gave Muse their Facebook Marketplace listings and then had a buyer show up to collect a $100 item the agent had agreed to sell for $25.

• Gemini 4 Argon rolls out globally (55:13)

  A follow-up to EP63: Argon is now rolling out in AI Studio, the Gemini API, Antigravity and the Gemini app, at the same $2/$10 intro pricing. Travers describes it as almost whimsical, it gets excited. He’d happily work with Argon in the Antigravity CLI or Wonder Full in the Muse CLI, but Opus 5.5 is still the best tool in the box for him. Brett’s view is that switching models is like switching IDEs: a newcomer has to be much cheaper or give a real reason. He also still doesn’t understand why Google deprecated the Gemini CLI.

• Clef-omni and a cheaper Clef (59:13)

  One week after Clef launched, Cloudflare added Clef-omni, which takes audio and video along with text and images in one call. Cloudflare quotes medians of about 130 ms for text, 150 ms for images and 1.5 s for a 21-second video with sound. Clef-flash dropped to $0.038 per million input tokens, and hosted context shrank from 64K to 24K, which Travers says hardly matters for a snap decision. His first guess at a use: someone points it at a CAPTCHA. His second: driving an unfamiliar remote desktop fast.

• Microsoft Decision-1 (1:01:24)

  Microsoft’s own decision model, released October 9, also built on Qwen. It’s $0.042 per million input with free output, on Foundry and OpenRouter. The benchmarks say it’s very accurate, and Brett gives benchmarks about as much weight as usual. Both it and Clef-flash undercut Jev.

• TypeSafe raises $870M (1:02:43)

  The company behind Jev raised an $870M Series A. Brett’s memory had the valuation at seven or eight billion, which he didn’t have in his notes. They claim about a third of the Fortune 500 uses Jev without naming a customer. Travers’ point is that four or five groups trained the same thing within about two weeks of Jev shipping, so how hard can it be to wrap a transformer to return a fixed choice, given the compute. Brett thinks TypeSafe is “in for some fun.”

• Cloudflare Managed Defense (show notes only)

  Not discussed on air. Cloudflare’s first general-purpose SOC agent made claims the evidence didn’t support, so they split the work: deterministic, versioned API calls collect evidence, specialist agents interpret it, and code checks every citation. The post is where tonight’s title comes from: “prompts are not boundaries.” It’s in early beta, with no alert volumes or accuracy numbers.

Off-the-Clock Recommendations

• Elvira: Mistress of the Dark (1988): Travers’ spooky-month pick. Very campy.
• Thanksgiving (2023): Brett’s pick.
• Below (Netflix): Brett’s six-part miniseries set in a small Newfoundland fishing town, with something under the water and a cast of familiar Canadian faces, including people from This Hour Has 22 Minutes. All episodes drop at once, and Brett is rationing them on purpose.
• Disclosure Day (2026): Brett gave it four stars. Too long at around two and a half hours, and an alien movie with very few aliens, but he liked it.
• Close Encounters of the Third Kind (1977): Five stars on Brett’s scale, which means he’d watch it again if it came up. Travers has never seen it.
• Letterboxd: how Brett is trying to remember what he’s watched.