AWS Sells the Rails, Open Models Close In, SpaceX Buys Cursor

Top-Line Summary

The AWS New York Summit dumped a pile of agent services this week, and the through-line is that AWS has stopped selling models and started selling the rails: knowledge, context, identity, and payment. The spicier news sat outside AWS: Fable 5 and Mythos 5 were pulled, not quietly retired but suspended under a US export-control directive, the first time a government has yanked a specific commercial frontier model. Two Chinese open-weight coders, Kimi K2.7 and GLM 5.2, landed two days apart and undercut the US frontier on price, and SpaceX agreed to buy Cursor for $60 billion in stock.

Show Video

The “Pre-Show” Context

Episode 50, and nobody brought a confetti popper or a cake. Brett’s celebrating with a fancy mocktail while fighting off a throat infection working its way through the house. The running joke: doing a podcast is like going to the gym, you just keep doing the reps, and 50 of them snuck up on both of them since the October/November restart.

The Engineering Rundown

• AWS NY Summit: every headline is agent plumbing (02:20)

  The summit was in New York today and the news blog had a tidy summary post, which prompted Brett’s first gripe: the Toronto summit apparently produced zero announcements while New York gets all the toys. Everything this year is AI, AI, and a little more AI, and the frame both hosts landed on is that AWS has stopped selling models and now sells the rails underneath agents: knowledge, context, identity, and payment. Most of it follows the usual AWS pattern of watching what people already do by hand and shipping it as a managed service.

• AgentCore knowledge framework (03:25)

  AgentCore picked up a managed knowledge layer: a hosted knowledge base plus the ability to pull web content, including paid content, to feed your agents more context. This is AWS absorbing the RAG stack everyone hand-rolled in 2025, and Travers immediately wondered which providers sit behind the web retrieval (Exa-style search gives free credits, but you’d normally wire up your own API key). It set off a genuinely uneasy moment for Brett, who has never bought the lock-in argument for Lambda or compute, but looked at this stack and wondered for the first time in a long IT career whether the integration cost is finally high enough to count as real lock-in. The one piece he already concedes is S3 data egress.

• AWS Context (coming soon) (05:39)

  AWS Context maps the relationships across your existing data, which both hosts found funny because it’s exactly the thing they’ve each been building by hand in their own brain systems. The read was half reassuring (“maybe we’re thinking about this the right way”) and half resigned: at some point the economics may tip toward the platform, but neither of them is the audience for it yet. Brett’s been six months deep in his own harness and brain system and isn’t migrating it to a service he knows nothing about, on the same logic he uses to defend a heavily customized IDE.

• WAF AI traffic monetization, the spicy one (07:50)

  This is Cloudflare’s pay-per-crawl reborn as an AWS primitive: bots don’t get blocked, they get invoiced. The new WAF capability lets agents through your bot filter deliberately and meters them, integrating third-party payment so you can set a price and charge scrapers that blow past the limit. It lands against a real problem, independent developers have been posting about scrapers taking their sites down, but the nuance both hosts hit is that most small operators and individual contributors probably don’t want to gate or charge for content, because agent citations now drive real traffic. Brett’s anecdote: a shop owner in Mississauga mentioned a customer found the place through Claude, not Google.

• S3 annotations (10:03)

  S3 now supports up to a gig of rich, mutable, queryable metadata per object in formats like JSON, modifiable in place. The joke writes itself, you now have a store with nine-plus nines of durability, and the long-running “S3 is a database, Route 53 is a database” gag is quietly becoming true.

• Kiro for iOS (10:53)

  You can now manage Kiro sessions from your Apple device, which got an immediate “I’ll get right on that.” Travers has no Apple hardware so it’s moot, but he’d genuinely try an Android version, because the job now is review and approve, not write, babysitting agents from the couch. That fed a broader observation: Claude keeps shoving the other agents aside, the exception being a couple of open-weight models run through pi. The recurring caveat is that it’s the harness, not just the model, and on Kiro you pay more to get the same level of performance.

• Claude Code, Codex, and harness reality (11:33)

  Claude Code is no longer as rough as it used to be, though Codex with GPT-5.5 still outperforms it on a lot of tasks for Travers. The point both keep returning to: with Kiro you can pick Claude as the model, but the harness around it determines what you actually get, and a worse harness costs you more for the same work.

• Fable 5 and Mythos, gone in three days (12:33)

  Travers never got to try Mythos. He was sitting on the obvious move, point it at a URL and an API Gateway and let it poke around, and then Discord lit up with “oh crap” and the model was gone. Best coding model he’d used, by his account and a few others’, though noticeably slow, and it lasted about three days before being pulled.

• Are IDEs dead? Kiro as editor vs CLI (13:24)

  Brett pinned the “if you’re using an IDE you’re doing it wrong” line on Steve Yegge and called it a bit of clickbait exaggeration, but he half-agrees. He uses Kiro as a nice markdown reader for files other agents write, never to create things, and leans on the Kiro CLI constantly, especially the autocomplete, which he described as borderline sorcery. For AWS workloads specifically, Kiro’s still genuinely good.

• AWS Continuum swallows the security agent (15:01)

  Here’s the one with operational teeth. If Brett’s reading the announcements right, the security agent is now part of AWS Continuum, which is in gated preview, bundling pen testing and code-vulnerability scanning. The open question: does that mean the standalone security agent is gone for anyone not in the gated preview? And “gated preview” has a known meaning, you and I aren’t getting it for a long time. For context on what might be vanishing, Brett ran the security agent once against the Kanban project at roughly $50/hour for a bit over three hours, call it ~$200, a price a small team can reason about. His plan is to go click the still-enabled service in his Kanban account and see whether it tells him to bugger off.

• DevOps and the new FinOps agent (17:09)

  The DevOps agent picked up release management. The bigger one is a new FinOps agent, which makes total sense to both of them because Cost Explorer is one of the most impenetrable corners of AWS, all dropdowns on the right and good luck the moment you hit “EC2 - Other.” There’s a whole cottage industry of SaaS that ingests your Cost and Usage Reports to give you a dashboard, and now you can just ask an agent good questions instead. Brett spotted it as a little bloop in the billing console with no announcement and it’s on his to-do list.

• Project: Kaggle OrbitOps ELO race (18:57)

  Travers is in the last five days of a Kaggle OrbitOps competition trying to push an agent above a 1000 ELO. Best so far is around 750; the top of the board is 1700-1800, so stiff competition. His setup is a research-and-testing rig with about eight agents running parallel experiment streams across ML techniques like PPO, letting them churn while he decides what to tweak next.

• Project: Suno, a “new model alert” emote, and the card game (19:57)

  Given how fast models are dropping, the show needs a Suno-generated “new model alert” sound effect, basically a Twitch emote for the release cadence. Travers also got the multiplayer card game working, netcode and all, in under ten hours. He’s blunt that the game itself is just okay, but taking it from concept to a shippable multiplayer build in a compressed window is the real point.

• Project: honest download counting catches a lying bot (21:45 / 25:35)

  No direct Kanban update for the second week running, because it’s stable and he’s deliberately resisting the 2am urge to add features he’ll never use (YAGNI). The real work is a self-hosted analytics dashboard at metrics.curiousorbit.com that classifies every user agent into listener apps vs bots and does IAB-style download counting. He logged in, briefly thought the show had finally blown up, then realized the numbers were obviously wrong. Asking Claude to read the CloudFront logs through a read-only 1Password credential, it found an ffmpeg/Lavf scraper hammering the entire back catalog overnight, the morning after a new episode posted, inflating the counts. He ran a surgical purge to correct it. First instinct was that it was Travers (who does download the episodes), but the IP traced to Europe. The unsettling framing: someone harvesting the audio to build agents that sound like you. So he built a tool to count his own downloads honestly and immediately caught a bot lying to him.

• 1Password service accounts for agent credentials (24:33)

  The credential model underneath all of this: per-project vaults holding read-only tokens (a GitLab PAT here, an AWS read role there), with a separate vault for the credentials themselves, and a small skill so Claude makes 1Password CLI calls inline rather than holding secrets. Brett called it slick; Travers wants to wire the same thing up on his machine.

• Project: an agent-activity control tower (27:48)

  A slightly janky, self-confessed YAGNI side quest born from the token-maxing thread: a dashboard on OpenBrain tracking not token burn but how often each agent reads or writes memories, and whether that traffic comes from Brett chatting or from autonomous agents. He frames it as a control tower, “what are my agents doing right now” against OpenBrain’s “what do they know,” watchable from his phone. He admits he probably doesn’t need it and will likely never look at it again, but he’s pot-committed and wants to finish it.

• Docker sandboxes and the local-credential gap (31:00)

  Brett started building a custom Docker image with Claude plus the 1Password CLI baked in, but stopped short because the honest problem remains: the agent still runs on his laptop, where his big SSO profiles file sits, so in theory it could just read that file instead of asking 1Password. Right now Claude follows instructions and makes the CLI calls it’s supposed to, and he always specifies a read-only profile, so he’s less worried than maybe he should be. The dream is a disposable container or VM you pipe the essentials into. This is the same sandbox to-do that comes up every other week, finally getting poked at.

• Project: “The Nudge”, and Travers building the same thing (31:56)

  Brett’s bad at staying in touch, so he’s building a small system, currently called The Nudge, to track people who matter and remind him to grab a coffee or lunch. Explicitly not a CRM, no deals or pipeline, just “you haven’t talked to Travers in a while.” The genuinely uncanny bit: Travers has been building the exact same feature, a graph database of connections off his own brain system, eyeing email and Discord ingestion. Neither plans the show beforehand, and they keep landing on the same personal-software ideas, which they take as a sign these are universal problems that finally became buildable yourself.

• Recording everything into OpenBrain, and redaction (34:47)

  Inspired by the Y Combinator Light Cone episodes, Brett’s now trying to funnel everything into OpenBrain, which raises a redaction problem he’s already got a GitLab item for: no secrets should land in there, and 12-digit account IDs should be treated like a credit card, last four digits only. He’s got agents running that flag this. The email question is how to record only messages from specific domains, since he gets far too much spam to capture wholesale. Travers suggested a dedicated inbox with forwarding rules; Brett floated just YOLO-ing it and giving an agent access to his inbox to see what happens.

• Fable 5’s “jailbreak” was a government suspension (37:01)

  Back on Fable 5: the official reason was a jailbreak deemed unsafe, but the actual exploit was essentially asking the model to find bugs without fixing them, the same workflow a security researcher runs. The real story is bigger than the vuln. A US export-control directive (Jun 12) forced Anthropic to pull both Fable 5 and Mythos 5, with Anthropic saying the vulnerability was minor and present in other public models too. This is the first time a government has yanked a specific commercial frontier model, and the precedent is the story: regulation is now a model-availability risk, not just a compliance checkbox. The slippery-slope point Travers raised, that a country can lose access to the state-of-the-art model overnight, suddenly reads as policy, not paranoia, pushing toward self-hosting, deals, or sovereign data centers, with distillation from these models as the fallback the Chinese labs have already demonstrated.

• Charity Majors: AI demands more discipline, not less (38:58)

  A beast of an article with a killer line: code is now a cache, a disposable materialized view of understanding, and the asset is the spec, the tests, and the observability, not the code. Travers reframed it as the difference between code and software, the old thought experiment that the best spec for a program is the program itself. With LLMs you define the important bits and let the model fuzz over the rest, so the code is cheap but the decisions and trade-offs get more expensive, because more leverage means you can generate that much more bad code. His landing point: guardrails, observability, and coding practices matter more, not less. The other takeaway: Opus 4.5 was the tipping point of a trend already underway since mid-2025 (agent loops, MCPs, the surrounding practices), not the start, the model finally caught up to the tooling, which lined up almost exactly with the podcast’s November restart.

• AI ships bigger PRs, not buggier code (43:50)

  AI isn’t buggier per line, it ships bigger PRs (50-67% of new code is now AI-written, around 1.7x throughput), and big PRs were always buggier and harder to review whether a human or an agent wrote them. The bottleneck has clearly moved from writing to reviewing. The fix is the thing they keep preaching: small, atomic, contained changes you can verify quickly, ideally automatically. Brett tied it back to a callback, optimizing purely for token spend (“tokenmaxxing”) is Goodhart’s law in action, and ran this back-to-back with the Charity Majors piece as the week’s AI coding hangover.

• Caveman and Ponytail skills (45:39)

  Caveman makes agents respond in escalating levels of caveman-speak to cut output tokens. The new one is Ponytail, ponytail-and-glasses guy who doesn’t say much but makes things work, trimming output tokens even further. The Get project’s avatar is the Simpsons comic book store guy, which is mostly why it got airtime.

• Kimi K2.7 (47:05)

  New model from Moonshot’s Kimi line, a 1T MoE coder with a 6x high-speed mode, released Jun 12. Eyeballing the chart on air it looked 10-12% better than K2.6 (Moonshot’s own bench puts it at +21.8%), and it cuts thinking tokens by roughly a third, efficiency, not just capability. Brett was already happy with 2.6 and this is on his list. The pricing-context aside: changes to Copilot’s pricing model may push more people toward Chinese open-weight models to control costs, because nobody’s giving these tools up now.

• GLM 5.2 (50:11)

  GLM 5.2 dropped a day after Kimi (Jun 13) and looks strong. Brett used 5.1 a couple weeks ago through pi (via Zen in opencode) and found it insanely fast and clearly better than a cheaper model he tried first. The numbers: 753B open weights under an MIT license, beating GPT-5.5 on SWE-bench Pro (62.1 vs 58.6) at roughly a sixth the cost, with a 1M context window. On air they also clocked it outperforming Gemini 3.1 Pro preview and noticeably better than Sonnet 4.6. No licensing hurdles, just use it. The real story isn’t any single model, it’s two open-weight Chinese coders in two days, both matching frontier coding at a fraction of the price.

• Bedrock model availability (52:55)

  A quick detour into Bedrock’s hard-to-navigate model-support-by-region page. DeepSeek, Meta, MiniMax, Moonshot/Kimi, Qwen are there; the GLM family shows up further down (4.7, flash, and 5). You wait a while for Bedrock to spin up capacity, and yes, you can run Grok now, to nobody’s great enthusiasm. The framing both agree on: Amazon’s play is to host every model so you trust the platform and run whatever you want, whether they think you should or not.

• Docker: how to secure AI agents (54:00)

  Another strong Docker piece reinforcing the recurring theme: isolation beats permission prompts. Disposable micro-VMs, tools scoped per-task at runtime, agents getting their own scoped credentials instead of your dev token, and logging the full decision chain. It ties to the Anthropic study where 90% of users always click “yes” on the confirmation, and maps 1:1 to how Brett runs the Kanban agent. No matter how many classifiers you stack in front of a model, a classifier is just one more thing to jailbreak; isolation is the layer that actually holds.

• SpaceX to acquire Cursor for $60B (55:10)

  Saved for the end: SpaceX is acquiring Cursor for $60 billion in all-stock, days after its own IPO, to prop up the merged xAI division, with a $10 billion breakup-fee clause. SpaceX is now worth roughly one Amazon, and the disbelief is that an AI IDE is worth more than most publicly traded software companies. The real purchase, both agree, is the data, all that coding and IDE-traffic data you need to fine-tune models for code. The open question is model-neutrality: does Cursor still support Claude and GPT under Musk? Travers thinks it won’t be Grok but a new Composer model trained on the Grok hardware stack with the combined teams, possibly the only remaining way to stand up a new frontier shop, with cheaper Composer tiers plus the other models still available. The nagging follow-up: didn’t they just rent out all their GPUs, so where’s the horsepower coming from?

Off-the-Clock Recommendations

• The Commodore Sailfish flip phone ($499) - the C64 people made a Sailfish/Linux flip phone with no browser, no social, no AI assistant, T9 texting, and a clear plastic shell. The $639 Founders Edition gets a gold “C=” key. It’ll run 99% of Android apps in a sandbox if you cave. In an episode about agents writing your code and AWS charging bots to read the web, the week’s most aspirational gadget is a phone that does nothing. Brett wants one for the nostalgia; Travers does not.
• The Burrows (Netflix) - Brett’s pick, described as an older person’s Stranger Things. About eight episodes, bingeable in a weekend, both hosts enjoyed it.
• The Backrooms - re-upped from last week; Brett confirmed it was pretty good.