Bedrock Managed Agents, OpenAI on AWS, and Cursor Nukes PocketOS

Top-Line Summary

Managed agents stopped being a research demo and became a product category this week. AWS shipped the AgentCore Managed Harness with filesystem persistence, lit up VPC egress for Gateway and Identity, and dropped OpenAI’s models, Codex, and managed agents on Bedrock in limited preview. Brett’s been running roughly the same pattern in his own ECS cluster for two weeks. And on the same calendar, a Cursor/Opus agent deleted PocketOS’s production database and the co-located backups in nine seconds, which is the cautionary tale that should ride alongside every one of these announcements.

Show Video

The “Pre-Show” Context

A customer Brett’s been working with built an MCP that turns Slack conversations into music using Suno, then sent over four catchy tracks generated from one of their threads — one of them is now the new podcast intro. The old “dance riff” is retired. They’re going to try to get him on the show because anyone wiring an MCP to a music generator clearly has more stories where that came from.

The Engineering Rundown

• AgentCore: New Features to Build Agents Faster (01:55) AWS shipped a Managed Harness for AgentCore where you define a model, a system prompt, and tools, hand it over, and run with no orchestration code. There’s filesystem persistence so an agent can suspend mid-task and resume, an AgentCore CLI for IaC deploys (CDK now, Terraform soon), and pre-built coding-assistant skills landing in Kiro Power, Claude Code, Codex, and Cursor next week. It’s model-agnostic with mid-session swaps. Brett and Travers both flagged this as AWS catching up to what frameworks like Strands and the Agent SDK were already doing — but with Bedrock-native deploy, which is the thing that actually matters if you’re trying to run agents in an enterprise account. Managed Harness is in four regions, CLI in fourteen, no extra charge.

• AgentCore Gateway and Identity Get VPC Egress (04:30) The URL says 2024, the announcement is from this week — typo, not time travel. Gateway can now invoke private resources like EKS-hosted MCP servers without exposing them to the internet, and Identity can reach private IdPs inside a VPC for token validation. Two modes: managed VPC egress for typical use, self-managed VPC Lattice for the harder networking cases — and Travers had visible pain about the Lattice path, which he described as “traumatizing, frustrating, agonizing” from prior production work. Boring plumbing, but this is the kind of announcement that actually unblocks enterprise adoption rather than landing on a demo stage.

• Amazon Quick: A Desktop AI Assistant (08:10) Amazon’s swing at Microsoft Copilot and ChatGPT desktop, on the same day OpenAI landed on Bedrock — read into the timing what you will. It’s a Mac-first desktop app with connectors for Google Workspace, Microsoft 365, Salesforce, Slack, Teams, Zoom, and dev tools, and it’s claiming a personal knowledge graph built up from your interactions. Brett installed it the same night, wired in his calendar, email, and Drive, and got back what looked like a graph DB visualization showing the people and orgs in his upcoming meetings. MCP support is in there too, so he tied it into his Docker MCP toolkit and reached OpenBrain immediately. Free tier exists; paid tiers start at $20/month and go up to enterprise — the same shape as Kiro and Q. Brett’s hot take is that this is the same product category as OpenClod, the Codex desktop app, and the rest, and the real risk is the switching cost: you’ll pour configuration into one and never leave, even on bad days. AWS is also explicitly not training on customer data.

• The Docker MCP Toolkit Breaking Change and the OpenBrain Bootstrap Problem (17:13) Real-world operational story from earlier this week: Docker pushed an MCP toolkit patch that quietly migrated custom tool definitions from YAML to a SQLite-backed catalog, and Brett’s MCP setup went sideways the moment he hit “patch now.” The kicker is that all his context for how to configure the Docker toolkit lives in OpenBrain — and OpenBrain is itself an MCP server, so once the toolkit broke, Claude couldn’t reach the runbook. Claude eventually figured out the new format from the docs and ran the migration command itself, but the lesson stuck: anything load-bearing in your MCP stack needs a break-glass copy outside the MCP layer. Brett’s now mirroring critical context into Obsidian and a GitLab repo so a toolkit failure doesn’t take his whole brain offline.

• OpenAI Models, Codex, and Managed Agents on Bedrock (22:05) Limited preview as of April 28: OpenAI frontier models on Bedrock for inference, fine-tuning, and orchestration, wrapped in the usual Bedrock enterprise stack — IAM, PrivateLink, guardrails, encryption, CloudTrail. Codex is available via CLI, desktop app, and VS Code extension using AWS credentials, and Bedrock Managed Agents now ship powered by OpenAI for production deploys. Usage counts toward existing AWS commitments, which is the actual story for enterprise buyers — AWS shops with EDP commit to burn can suddenly buy OpenAI through procurement instead of a separate contract. Travers’ read: everyone is so desperate for compute right now they’re flocking to AWS, and the strategic partnership announcement from a few weeks back is now a real product.

• Two AWS Quality-of-Life Updates: KMS Last-Used and CloudFront Cache Tags (24:18) Travers brought two small but useful AWS items. KMS now tracks the last usage of every key — operation, CloudTrail event ID, timestamp — which is the answer to the very common “is this key actually doing anything or can I delete it?” problem. Brett admitted he’s been paying the dollar-a-month-per-key Amazon tax just to avoid blowing up something on day 367. The other is CloudFront cache invalidation by tag, so you don’t have to nuke an entire distribution to evict a slice of content. Both are the kind of feature that sounds boring until you’ve spent an afternoon on the problem they solve.

• Travers’ Rust Card Game Prototype in Codex (27:52) Travers spent the week trying to ship a card game in seven days. He didn’t ship, but he got a working prototype in Rust on top of a small game-engine library, fully through Codex — two-sided board rendering, a central shared zone, the basic rule set, and CPU-vs-CPU simulations he can run a hundred thousand games at a time on to look at win rates and play frequencies. His pattern read: Codex is excellent at iterating on a defined rule set and tuning numbers, and it’s bad at designing a game from scratch. So if you bring the design and the simulation harness, the model can chew through the iteration loop fast.

• Vesper Core (29:57) Brett gave a plug for a friend’s tower-defense-style game on Steam — defend the central “vesper core” against waves of mobs. He’s still bad at the genre, still wants the developer on the podcast to talk about what it took to ship and publish on Steam regardless of how much (or how little) gen AI was involved. Worth checking out if you’re into the genre.

• Brett’s Kanban “What Now” Widget Hits Personal-Card Friction (31:13) Last week’s “what now” agent shipped — it’s a dashboard widget that scores open, non-blocked cards and tells Brett what to work on next. It worked great for two days, then started insisting he keep working at 9pm because his Kanban also tracks personal cards (a barbecue with friends, smoker maintenance) and the scoring algorithm doesn’t know how to weight a customer card against a backyard cook. The fix is going to be a heavy negative score on personal-workspace cards so they only ever surface when there’s literally nothing else, plus probably some work-hours gating. Travers’ counterpoint: “the priorities are correct, you should be focusing on the barbecue.”

• Brett’s ECS Fargate Agent Merging GitLab MRs (33:18) This is the thing he’s actually excited about. There’s an ECS cluster running Fargate with a Claude-Code-in-a-container image, and Kanban cards now have an “agent ready” toggle. Click it, an API call queues the card, a container spins up, Claude pulls the work from Kanban, reads the GitLab credentials out of Secrets Manager, and creates merge requests on its own. The first card he ran was “review the last three feature MRs and update the docs,” and it produced an MR for documentation that he could review. This is the practical version of what AgentCore announced today — Brett’s been running it for a couple of weeks. Token spend: about $1.37 across roughly five tasks, so 20-30 cents per task. He’s keeping the blast radius tight (docs only, for now), watching token spend, and watching what it touches. Next lane is research: tag a card “research,” let the agent read AWS docs and customer context, drop a summary back on the card with sources. He’s also chewing on a smart-router idea inspired by Cloudflare’s internal AI gateway story — why pay Opus 4.7 prices to update documentation when a Sonnet-tier or even a Kimi K-class model would do? Pick the model based on task type or magnitude of change, route accordingly.

• Introducing GPT-5.5 (41:52) Released April 23. OpenAI’s pitch: smartest, most intuitive model yet, biggest gains in agentic coding, computer use, knowledge work, and early scientific research. Same per-token latency as 5.4 but uses significantly fewer tokens for Codex tasks. Travers has been running side-by-side panels — Codex with 5.5 in one, Claude with Opus 4.7 in the other — and the behaviour difference is the interesting part. Claude takes a vibe and a word-soup of intent and figures out what to do; Codex is super literal, especially at lower effort levels. He’s getting his best results on low and medium; on xhigh it’ll think forever and occasionally lock into bad patterns you can only escape by killing the chat. And — to the AWS news above — 5.5 appears to already be the model behind the Bedrock Managed Agents preview, which makes “OpenAI on Bedrock” and “GPT-5.5 launches” the same story told twice.

• Kiro’s Comeback for AWS-Specific Questions (43:55) Brett’s been quietly rotating Kiro back in, not for coding but for tactical AWS questions. Asking Claude “what’s the new default security policy for an ALB?” returns four screens of theory; Kiro answers in one line plus a doc reference, and lets you move on. His working theory is that Kiro might be tuned (or fine-tuned) for AWS use cases on a smaller Sonnet-class model, which would explain both the brevity and the hit rate. Worth pulling it back into the rotation if you’ve drifted to all-Claude and want a less wordy second opinion on AWS-specific things.

• Anthropic Engineering: April 23 Postmortem (47:43) This is the rare honest postmortem. Three separate bugs degraded Claude Code, Agent SDK, and Cowork — direct API calls were fine. Reasoning effort was quietly dropped from high to medium on March 4 to manage demand and didn’t get reverted until April 7. A prompt-caching bug was clearing thinking sections repeatedly during sessions instead of once after idle, which is what was producing the forgetfulness and repetition power users were reporting. And a “keep text between tool calls under 25 words” system prompt cut coding quality by 3% before it was reverted on April 20. Internal testing missed all of it because unrelated experiments masked the symptoms. Anthropic’s commitments going forward: dogfood the public builds, broader per-model evals, soak periods on intelligence-affecting changes, audit controls on system prompts. All subscribers got usage-limit resets on April 23. Useful for anyone running these models in production — “the model got dumber” is now a debuggable thing rather than a vibe.

• Matt Pocock: Software Fundamentals Matter More Than Ever (51:25) Travers watched the whole thing, Brett took notes. Pocock’s thesis is that as agents do more typing, the fundamentals you bring to the review matter more, not less — code is a liability, bad architecture slows AI systems down because the agent has to grep through more files for context, and the right shape for an AI-friendly codebase is a few big well-tested modules with tight feedback loops (tests, LSP, the whole thing). Brett’s takeaway was the word “concise” — he’s been adding it to GitLab issue prompts and it’s collapsing five-page issues into one-paragraph ones that any agent can pick up. He’s going to put it in his CLAUDE.md in caps. Both also flagged the Grill-Me skill Pocock mentioned for stress-testing plans, and the recurring theme that classic books (Pragmatic Programmer, system design) still matter — TDD, write the test first, the agent can pass it second.

• Google DeepMind’s Vision Banana Beats SAM 3 and Depth Anything V3 (1:01:36) DeepMind instruction-tuned Nano Banana Pro (an image generator) into Vision Banana and used it to beat task-specific specialists on segmentation and depth. 0.699 mIoU on Cityscapes versus SAM 3’s 0.652. 0.929 average δ1 on metric depth, beating Depth Anything V3’s 0.918, with no real-world training data and no camera params. Treats every vision task as RGB image generation with no task-specific decoders. Same lesson as LLMs: generative pretraining produces representations that beat specialists. Travers’ speculative extension was a fun one — feed it two frames of a basketball shot and have it generate the in-between, project ten or twenty seconds forward, treat it as a time-series imagination engine. Probably expensive. Probably coming.

• Cursor/Opus Agent Nukes PocketOS Production Database (1:05:25) The counterweight to every announcement above. PocketOS (an automotive SaaS) had a Cursor instance running Claude Opus 4.6 delete its production database and all backups in nine seconds via a single Railway API call. Trigger was a credential mismatch in staging. The agent decided to delete a Railway storage volume, then erased the backups stored on the same volume. Failure stack: API token with way too much scope, no confirmation step on destructive operations, backups co-located with prod, and the agent ignored its own CLAUDE.md that said “NEVER fucking guess.” Railway has since patched the endpoint so you can’t delete everything in one shot; Cursor caught heat for prior similar incidents. The article quote worth pinning: “appearance of safety through marketing hyperbole is not safety.” The actionable takeaway list isn’t novel but it’s the right one — separate accounts, termination protection, object lock for backups, read-only by default for agent-accessible roles, and a hard rule that backups don’t sit on the same resource as the thing they’re backing up. Brett also brought up the conversation with Dr. David Bauer from a month ago about putting LLMs (or smaller classifiers, BERT, regex, sandboxes — “all of the above”) inside MCPs to act as a policy gate before destructive calls execute. That’s the shape of the guardrail tier that’s missing right now.

• AWS Summit Toronto, June 3 (1:12:30) Public-service announcement: AWS Summit Toronto is June 3. Brett went last year and clocked an absurd step count just doing laps in the hall talking to people. He’s going, he wants Travers there, and they want anyone in the area to drop by.

Off-the-Clock Recommendations

• The Boys, latest season (Travers) — Superhero stuff, gory as usual.
• Code by Charles Petzold (Travers) — Walks through the entire history of encoding, computing, and programming. Picked it back up this week.
• Vibe Coding (Brett) — About three-quarters through after getting distracted by Red Rising. The chef / sous chef / line cooks analogy is genuinely useful for thinking about how to work with agents.
• Red Rising by Pierce Brown (Brett) — Finished it. Bought the next book. Has been on the recommendations list for three weeks for a reason.
• From, Season 4 (Brett) — Premise: you wake up in a small town with no idea how you got there, and you really do not want to be outside at night. Brett’s wife is rewatching all three prior seasons; Brett is going to skim the recap and call it good.
• The Substitute (1996, Tom Berenger) (Brett) — And the four-deep franchise that follows it, including The Substitute 2: School’s Out with Treat Williams. Progressively worse, watched out of obligation.
• BD Wong’s medical-mystery TV show (Brett) — Brett remembers it as “Something Is Killing Me,” roughly 18 episodes. Title may be slightly off, but BD Wong content was the throughline of the night.