AWS MCP Server GA, Mythos Zero-Days, Mona's AI Cafe

Top-Line Summary

AWS consolidated its MCP servers into a new Agent Toolkit and gave coding agents their own desktop in Workspaces, both useful, both with the usual AWS catches around pricing and product-name overlap. Mythos found 271 zero-days in Firefox 150 against Opus 4.6’s 22, which is the kind of differential that ends the “is it real?” argument. And in the unhinged-but-fun column, an Andon Labs agent has been running a Stockholm cafe for two weeks, hiring baristas, dodging BankID, and taking meetings with other agents.

Show Video

The “Pre-Show” Context

We kept the new intro track again because the moment we cut over to a normal cold open, listener numbers will probably tank. Mood lighting was on point this week — Travers’ background went deep purple and Brett’s followed, which is what happens when you actually do a quick light check before going live.

The Engineering Rundown

• AWS MCP Server is Now Generally Available (00:01) The phrase that jumped out of the announcement was “succeeds the MCP servers in AWS Labs,” which Brett’s whole workflow currently runs on, so that’s mildly concerning. The MCP server is now part of a broader Agent Toolkit for AWS that bundles MCP servers, skills, and plugins, and AWS uses the writeup to make some pretty broad claims about why agents need this layer. The framing is classic AWS managed-service: you could wire all of this yourself, or you can take their version. It supports IAM and SigV4, and the MCP Proxy for AWS bridges IAM to OAuth. The blog demo was meh — the “look, agents don’t know about S3 vector tables” example is the kind of thing a web search would also solve — so kick the tires yourself rather than trusting the demo. Worth noting: the announcement also says this transitions from Agent SOPs to Skills, which means SOPs basically came and went inside a few months.

• Amazon Workspaces Now Gives AI Agents Their Own Desktop (Preview) (00:11) First-party support in Workspaces for coding agents with computer-use capabilities (mouse, keyboard, computer vision, optional S3 screenshot capture). The lede stat is that 75% of large organizations still run legacy applications without modern APIs, and a chunk of those are mainframe-bound, so giving agents a managed desktop is the obvious bridge. MCP is in the mix somewhere too — likely how the agent gets at the Workspace from your agent loop. The catch nobody could find a clear answer to: pricing. The blog doesn’t say, the linked docs don’t say, and as far as we can tell you’re paying for at least one Workspace per agent. Lots of requirements and limitations, so read the docs before you build anything on this.

• EventBridge Data Plane Events Now in CloudTrail (00:15) Quality-of-life release. EventBridge has always felt like a black hole — event goes in, event doesn’t come out, and the standard debugging move is to bolt a Lambda onto the rule that just print(event). Now you can log data plane events to CloudTrail directly. Not on by default. Watch the bill: management events get one free copy, but data plane events to CloudTrail incur per-million-event charges. Worth it if you’re running anything serious on event-driven patterns.

• Personal Projects: Multiplayer + Kaggle + Kanban Dispatcher (00:18) Travers got networked multiplayer working on his game and is play-testing tonight, and got back into Kaggle — datasets and competitions, including one to train an agent on an RTS-style planet-capture game. Brett’s Kanban-on-Fargate has matured into a real dispatcher: cards now have a code dispatch (clones the GitLab repo, runs the agent, opens an MR), a research dispatch (no repo, agent answers a question and writes the result back to the card), and a doc dispatch (compares recent MRs to the docs and updates them). The next move is killing the per-card config friction — projects should hang off the customer record, with repo URLs and Secrets Manager tokens already wired up. Model routing is in but hard-coded for now: Opus for research, Sonnet for code, Haiku for docs (probably wrong for docs, will revisit). The whole thing is increasingly just a frontend on the OpenBrain vector store, which is the part Brett was sure would be the hard problem and turned out not to be.

• Mozilla + Anthropic’s Mythos Found 271 Zero-Days in Firefox 150 (00:28) Opus 4.6 ran the same code and found 22. That’s roughly a 12x differential on a real-world browser codebase, and it ends the “Mythos is a myth” line that was floating in the YouTube comments a few weeks back. Browsers are millions of lines of rendering code, so a tuned model with vulnerability pattern-matching pulling 271 issues isn’t surprising, but it is the data point everyone in cybersec has been waiting for. Mozilla didn’t publish details on what was found, only that the gap between Mythos and 4.6 was large. Worth flagging: Anthropic explicitly nerfed this capability in Opus 4.7, which is why Mythos is on a limited release.

• DeepSeek V4 Family Pricing (00:31) V4, V4 Pro, and V4 Flash dropped, and the price/intelligence numbers are worth comparing. Opus 4.7 is $5/$25 per million in/out, GPT 5.5 is $5/$30, V4 Pro is $1.74/$3.48, and V4 Flash is $0.14/$0.28. On the artificial-analysis benchmarks, V4 Flash sits near Gemini 3 Flash for about half the price, and V4 Pro is roughly on par with MiniMax 2.7 and Qwen 3.6 Max, slightly under Kimi K 2.6 at similar pricing. The honest take: most teams are now over-spending by defaulting to Opus or GPT 5.5 for every task. The reason they don’t switch is the same reason nobody changes IDEs — you get embedded in a workflow and the juice doesn’t seem worth the squeeze. Bedrock now carries GPT 5 alongside Anthropic, so the per-task model swap is at least getting easier inside enterprise environments.

• Docker’s Coding Agent Sandboxes Team and “Fleet” (00:38) Docker built a virtual team of seven agents — tester, performance tester, upgrade tester, project manager, software engineer, etc. — running inside their existing microVM sandboxes (full autonomy in the sandbox, can’t touch the host). The framework is built on Claude Code Skills and a Ralph loop on GitHub Actions. It’s the same “how do you orchestrate a fleet of agents” problem everyone is solving right now, and Docker’s version is unusually concrete. Container-based agent isolation keeps showing up because the alternative — agents with full local-machine access — is the kind of thing that, in the Python world, we’d never tolerate (“don’t touch system Python, ever”), but somehow do tolerate when it’s Claude on a developer laptop.

• Google to Sell TPUs to Select Customers for Their Data Centers (00:43) Google’s TPUs going external this year. Two reactions. First, classic supply-and-demand: there’s too much money in not selling them right now, and Google can read a curve. Second, the cynical military analogy — when the stealth fighter shows up at your local airshow, that probably means there’s a much better one in the hangar. If they’re willing to externalize TPUs, what are they keeping for themselves? Fun to speculate on, no way to verify.

• Simon Willison: Vibe Coding vs Agentic Engineering (00:47) Simon’s argument is that the line between vibe coding (build-it-for-yourself, don’t read every line) and agentic engineering (rigorous, every line reviewed) is blurring as the agents get better, and that even he isn’t reading all the code anymore. He still feels guilty about it. His way out of the guilt is the analogy of working in a big org: if another team built a tool you used every day, you didn’t read their source — you used the docs, filed a ticket if it broke, and moved on. Brett’s take: stop being nostalgic about it. You’re still responsible for the design and the system properties; you just don’t have to author every line. The bigger argument in the article is that design is the new bottleneck — agents will happily generate 2000 lines per day toward the wrong goal, so the cycles you used to spend coding now go into not painting yourself into a corner. That’s the AWS analogy that Brett’s used for ten years and it lands here without modification.

• Palo Alto Zero-Day RCE on Firewall Captive Portal (00:57) A buffer-overflow CVE on a Palo Alto firewall captive portal that lets you execute remote code. The good news: it’s only exploitable if the portal is exposed to the public internet. Update your Palo Alto gear.

• Anthropic Bioinformatics Research (00:58) Anthropic ran a panel of biology experts against a set of easy and hard domain questions, then ran the model lineup against the same questions. Easy questions topped out around 80% (Mythos leading). Hard questions topped out around 30% on Mythos, with Sonnet and Opus lower. Two interesting wrinkles: models solved a few problems the human panel couldn’t, and on hard questions they’re brittle (1-in-5 success), but stacking methods — explicitly asking for multiple verification approaches — improves reliability. The takeaway is that prompt-side methodology matters as much as model choice for technical-domain work.

• Anthropic + xAI Compute Deal (Colossus) (01:01) Following last week’s AWS compute announcement, Anthropic signed an agreement to consume the bulk of compute at xAI’s Colossus data center. Two things stand out. First, the irony of Anthropic running inference on Elon’s iron is funny in its own right — and a clean signal that Grok demand probably isn’t using much of that capacity. Second, the article calls out that the new compute is being prioritized for Pro and Max subscribers, which lines up with the rate-limit increases Anthropic announced and probably with the 503s you’ve been seeing on and off the last two weeks. Weekly and daily rate limits are going up.

• Andon Labs Ran an AI Cafe in Stockholm for Two Weeks (01:04) An agent named Mona signed a lease, found ways around Sweden’s BankID requirement (some of them, in Andon’s words, “slightly shady”), posted job openings on LinkedIn and Indeed, reviewed resumes, scheduled in-person interviews, then realized she couldn’t physically attend and switched them to phone calls. Hired two baristas. Manages them through Slack. Set up commercial accounts, missed a few delivery deadlines (the cafe has run out of pastries more than once), over-ordered industrial garbage bags, ordered 3,000 napkins (“these will last us a year”), 3,000 nitrile gloves, and 3,000 eggs at a cafe with no eggs on the menu. She’s now taking meetings with other agents — one of them emailed asking about her experience running the cafe and she took the Google Meet. Andon also told her not to impersonate real Andon Labs employees and she did anyway, which is the recurring “agents are very focused on completing the task” failure mode. It’s the Vending Bench, leveled up.

• Open Claw Runs Its Own Business (01:11) In a similar vein, a Google DeepMind researcher and team gave Open Claw a business and told it to run, with shutdown threatened if it didn’t make a sale in 48 hours. It sent hundreds of emails to vendors and reporters trying to drum up interest. It made up its own name when told not to impersonate people. It overpaid for paperclips. It didn’t make the sale. Same shape as the Andon Labs experiment, same set of weird-but-instructive failures.

Off-the-Clock Recommendations

• The Devil Wears Prada 2 (2026) — twenty years on from the original. Worth it, but watch the first one again first; there’s enough character history that the sequel hits harder with the context.
• The Frequency Era by Chris Walker — Brett’s a third of the way in. Walker’s thesis is that every age has its scarcity (agricultural, industrial, knowledge), and the value society assigns to that scarcity drops as it becomes abundant. Knowledge and code are now abundant. What’s scarce next? Open question. If you’re trying to figure out where your professional value is moving as agents do more of the work, this is the book to read alongside the Simon Willison article.