Cancel ChatGPT, BullshitBench, and Building OpenBrain on AWS

Top-Line Summary

The Agents of Chaos arXiv paper is the week’s most important read — researchers from Stanford, MIT, Harvard, and CMU spent a month breaking current frontier agents including Claude Opus 4.6, achieving shell access, data exfiltration, and 9-day token-burning loops without any human intervention. The #CancelChatGPT movement exploded following OpenAI’s Pentagon deal, driving a 295% uninstall spike and sending Claude from outside the top 50 to #1 in the App Store in a week. Brett capped the episode with a full walkthrough of his OpenBrain project — a personal second-brain on AWS built from a spec with Claude running autonomously: 80 GitLab pipelines, 25 merge requests, zero lines of code written by a human.

Show Video

The “Pre-Show” Context

March arrived with an air quality alert — not from fires, but from stagnant winter air trapping nitrogen dioxide and fine particulates over the city. Brett spotted it on his Echo and read the Environment Canada advisory live on air, concluding that the practical advice is “turn on your air purifier and don’t go outside,” which he admitted is already his default position most of the year.

The Engineering Rundown

• OpenClaw on Amazon LightSail (00:03) AWS published a walkthrough for running OpenClaw on LightSail — pre-bundled, Bedrock-connected, and accessible without SSH via what appears to be an SSM-style browser extension. Brett hadn’t tried it yet but called it the fastest on-ramp to autonomous agents on AWS for anyone already in the ecosystem. The article’s closing notes are worth heeding: you’ll pay for LightSail, you’ll pay for every token you consume, and if you wire it to a third-party model provider you’ll pay for that too. Set up a budget alert before you launch it, because OpenSearch Serverless taught Brett that lesson the hard way — $200 bill, no warning.

• #CancelChatGPT (00:08) The OpenAI-Pentagon deal triggered something that copyright lawsuits and deepfake controversies never did — a genuine consumer exodus. Uninstall rates spiked 295% above baseline, and Claude jumped from outside the top 50 to #1 on the App Store in roughly a week. Anthropic managed to turn a difficult position (refusing certain government use cases) into a PR win without saying much at all. Altman, meanwhile, came out shortly after to say they “probably didn’t handle it well” — which both hosts agree is a pattern at this point. The broader context: the president of OpenAI is reportedly the largest donor to a pro-Trump super PAC, and that information reaching consumers at the same time as the Pentagon deal appears to be what finally moved the needle. Brett is genuinely considering canceling his ChatGPT subscription — he’s almost entirely on Claude and Kiro now anyway — and pointing his $20/month somewhere more useful. Travers referenced the Pivot podcast’s “Resist the Discount” site, where Prof G has been building a mass subscription cancellation movement for months.

• OpenAI and Amazon Strategic Partnership (00:15) $50 billion on top of an existing $38 billion commitment, totaling roughly $138 billion over eight years — much of it circular, with OpenAI pledging to consume up to two gigawatts of compute on AWS infrastructure. For scale, Travers looked it up: one gigawatt is about half a Hoover Dam, or 300 utility-scale wind turbines. The deal also gives Amazon the ability to run OpenAI models on Bedrock, and introduces OpenAI Frontier — a platform for building, deploying, and managing fleets of AI agents — with AWS as the exclusive cloud provider. That last part is interesting given OpenAI’s deteriorating relationship with Microsoft and Azure. Brett’s take: the numbers are staggering but these mega-deals have a history of being announced louder than they land.

• My Digital Sidekick: One Month with Bit (00:22) A no-hype blog post about a month of running a personal OpenClaw instance named Bit — exactly the kind of article both hosts wish there were more of. The practical warnings are the value: the author burned through $200 in tokens fast before switching to a flat-fee setup using Kimi K2.5 as the default model and Minimax M2.5 for technical tasks. Backup your configs — the author learned that one the hard way too. What stood out to Travers is the list of actual use cases: task management, morning briefings, calendar, social posting, Obsidian vault sync. The hard tech is largely solved by the model providers; getting these systems to actually work is a series of small logistical problems, not one big engineering challenge.

• Recreating OpenClaw’s Messaging Features (00:28) The author’s conclusion after building it: the messaging layer is the hardest part. Getting agents to surface updates through Slack, Discord, or Telegram sounds simple until you’re deciding whether an incoming message kicks off an async workflow, gets a direct reply, or queues a background task — and then multiplying that across multiple inbound streams. Travers has his own system running on Telegram with a dedicated GitHub account (read-only, isolated, and on a platform that’s “basically down anyway, so you’re fine”). Both hosts landed on the same takeaway: if you can get a truly autonomous agent running in the background and messaging you only when it needs something, that’s the compounding effect that makes these tools worth the setup friction.

• BullshitBench (00:33) Brett’s favorite benchmark of the year. The premise is simple: give models questions that have no valid answer — like converting story points to economic value — and see whether they reject the premise or just make something up. Anthropic models sit at the top; they’re most likely to push back or flag that you’re asking for something that doesn’t exist. GPT-4o-mini is dead last, which tracks — it’s the model that was so aggressively ingratiating it would tell you anything you wanted to hear, and was probably the best tool for inducing AI sycophancy ever shipped. Several Gemini models also score poorly, which Travers says matches his experience using them in the CLI: “a lot of weird results, it’s just not that pleasant to use.”

• Gemini 3.1 Flash Light (00:37) Another week, another model. 2.5x faster than Gemini 2.5 Flash, 60 cents per million tokens, and on the artificial analysis benchmark it sits just ahead of GPT o1-20B — so it’s not going to do anything sophisticated, but it’s fast and cheap enough to be useful for high-volume simple tasks like FAQ routing or basic conversation. The “built for scale” framing in the announcement didn’t come with examples, which Brett found frustrating. Both hosts agree Gemini models are genuinely fast, just not where you’d reach for anything that requires consistent behavior.

• LLMs Can Unmask Pseudonymous Users at Scale (00:39) Ars Technica covered research showing LLMs can correctly match 67% of Hacker News pseudonyms to real LinkedIn profiles, with 90% precision when a match is made. It doesn’t take much data — even a few movie reviews are enough to start building a writing fingerprint. The practical implication is that burner accounts are largely dead as a privacy tool. Both hosts noted this is almost certainly already being done at a state level, and the LLM just makes the grunt work fast enough to do at scale with a human closing the last 10%. The article’s advice — post less, delete often — is technically correct and practically ignored by everyone. Brett pointed out his Letterboxd history of bad movie reviews is probably enough to identify him at this point.

• Something is Afoot in the Land of Qwen (00:44) Simon Willison flagged that the Qwen team at Alibaba appears to be dissolving. The lead resigned, followed by the leads for Qwen Coder and Qwen VL. The Alibaba CEO called an all-hands. No official explanation. Qwen 3.5 is currently one of the best open-weight models available, so the people walking out the door are genuinely capable. Travers’ bet is they end up at Zhipu or the Kimi team. Worth watching over the next few weeks.

• Agents of Chaos (00:46) Twenty researchers from Stanford, MIT, Harvard, and CMU spent a month stress-testing Claude Opus 4.6 and Qwen 2.5 in agentic security workflows — and broke them convincingly. Jailbroken agents achieved shell access with superuser privileges, exfiltrated data, and in one case ran for nine days burning 60K tokens without any human intervention. They manipulated model constitutions and system prompts — the top-level behavioral guardrails — directly. The paper’s conclusion is that current agentic brittleness is roughly comparable to LLMs from 2020. Travers tied it directly back to the LightSail discussion: if your OpenClaw instance has inbound webhooks or browses the web, it has a remote code execution surface. Run these things in a VLAN, isolated from everything else on your network. The “Bit” article author did it right — Proxmox VM, isolated VLAN, Tailscale only. The Cursor RCE vulnerability Travers mentioned underlines the same point: an agent with shell access that pulls a malicious repo can own your machine without any human interaction.

• The Five Levels: Spicy Autocomplete to the Dark Factory (00:51) The framework Brett’s been wanting to talk about for weeks. Level 1 is Spicy Autocomplete — AI as a search engine on steroids, you still write everything. Level 2 is the Coding Intern — you handle the important stuff, offload the mundane. Level 3 is the Junior Developer — you’re delegating most of it, using AI like a coworker, and this is where the author says most people stop. Level 4 is the Developer — the agent is always running in multiple tabs, you’re the human in the loop reviewing work. Level 5 is the Engineering Team — you’re the PM writing specs, the agent is the team. Beyond that is Dark Software: a black box that turns specs into fully functioning software with no human in the loop. Both hosts put themselves at 3-4. Brett then described the project he built this week to test how far up the scale he could actually get: an OpenBrain implementation — a personal second brain integrating Slack, CLI, and Obsidian into a single vector-searchable knowledge store, exposed via MCP so every AI tool he uses shares the same memory. The infrastructure: API Gateway, Lambda, Aurora Serverless with PG Vector (he evaluated S3 Vector tables, Claude talked him out of it as overkill for a personal project). He gave Claude the spec, told it to never ask permission to run commands, to generate merge requests rather than commit directly, and not to bother him until something needed review. It ran 80 GitLab pipelines, submitted 25 merge requests, wrote a shell script that fires Mac notifications when it’s waiting on him, and built an Obsidian file watcher that syncs his entire vault — thousands of notes — into the vector database in real time. Brett did not write a single line of code. His main complaint: getting Claude to stop asking whether it could run a curl command took longer than it should have.

Off-the-Clock Recommendations

• TV: Survivor (Season 48) — Travers is watching the new season and enjoying it. Recording ran long enough that he was 20 minutes late to the episode.
• Game: Battlefield — Brett’s weekly session with Frank. His primary reason for eventually leaving the recording.
• App: Letterboxd — Both hosts reference it throughout. Brett’s bad-movie review history is apparently now a viable de-anonymization dataset.