Claude Fable 5, AgentCore Everywhere, and Token Maxing

Top-Line Summary

Claude Fable 5 dropped this week, and the detail buried in the system card is that even Claude Max subscribers start paying extra for Fable on June 22nd. The longer conversation was about blast radius. Anthropic mentioned, almost in passing, that it runs its own agents in sandboxes, which left both hosts asking why they hand coding agents full access to laptops wired into dozens of customer AWS accounts. AgentCore, meanwhile, keeps turning up in nearly everything AWS ships.

Show Video

The “Pre-Show” Context

The intro this week was a Toronto Summit post-mortem. Both hosts agreed it felt smaller than previous years, with the end-of-day networking event clearing out fast instead of running for hours the way it used to. Brett skipped every session, walked out of the keynote the moment the customer product placements started, and spent the day doing laps of the expo hall looking for people he knew. He did both partner and customer days back to back and got home so wrecked he did not move off the couch for the rest of the night. The practical takeaway buried in the banter: register early, because several people they know forgot and could not get tickets.

The Engineering Rundown

• AWS Step Functions Adds an AgentCore Agentic Reasoning Step (07:18)

  Step Functions now lets you drop a block into a workflow that calls one of your AgentCore agents, so you can inject fuzzy reasoning into an otherwise deterministic pipeline. Brett’s running joke is that AgentCore has become the new EC2: every week there are multiple features bolted onto it, and it is getting genuinely hard to keep up. The example in the release was document classification, which sent Brett back to a project from years ago where they were wiring up Textract to pull info out of documents and could have used exactly this. He also had to go look up what a “managed harness” in preview actually means, and it turns out to be the AgentCore feature where you declare an agent in config and specify its model, tools, credentials, and behaviour. His half-joking plan is a Step Function that runs his RSS backlog through an agent and classifies it into actionable items so he stops drowning in his newsreader.

• AgentCore Runtime Adds Interactive Shells for Terminal Access (11:12)

  This one both hosts liked. You can now open a full terminal into a running agent session over websockets, poke around while the agent is working, and reconnect to the same session later instead of restarting the whole run. Brett laughed that the example command in the docs is basically a docker exec with “agentcore” stuck on the front. The comparison that stuck was ECS Exec, which uses SSM under the hood to drop you onto a running container. Brett leans on it constantly for the old nginx environment he still maintains, usually to grab one piece of information when something that worked yesterday breaks today. His one note of caution: jump in to debug by all means, but ship the logs off to CloudWatch so you keep a persistent copy rather than relying on a shell you have to be present for.

• The AWS CLI Now Supports the Agent Toolkit for AWS (14:56)

  You can now run a CLI command that fires a wizard and installs the Agent Toolkit, with support for Kiro, Claude Code, Codex, and Cursor. Under the hood it is the AWS MCP Server plus bundled skills and plugins, so it is less a new product than a faster on-ramp to tooling they already talk about most weeks. Brett was honest that he is not sure he will use it, but the install-by-wizard approach makes sense for getting people started quickly. It also tied into a summit aside: Brett saw a demo of the DevOps agent network on the floor and reckoned you could get most of the same outcomes with the MCP server in a plain agent loop. That is the familiar AWS pattern of shipping fourteen ways to do the same task and letting you pick the one that fits your workflow.

• The AWS MCP Server Now Supports Cross-Account and Cross-Role Access (16:49)

  The AWS MCP Server can now reach across accounts and assume roles without a restart, with the release pitching multi-account S3 log analysis as the use case. Instead of stopping to switch profiles for each account, the server pulls logs from everywhere in one go. Brett admitted he is dragging his feet here purely because he has a tidy MCP-toolkit workflow he likes and does not want to replace, but he expects he will have to try it. His comfort line is read-only: he will grant read access freely because it has been genuinely useful for debugging, especially with custom skills that feed in his architecture and the log paths where errors usually live. He is wary of handing over write access to many accounts at once. He was also surprised no customer has asked him about the MCP server yet, and the hosts kicked around whether individual contributors are quietly using it without telling anyone, or whether it has just been lost in the firehose of new AI releases.

• Amazon Cognito Now Supports Multi-Region Replication (21:36)

  Cognito user pools can finally replicate across regions, and the hosts’ shared reaction was disbelief that this did not already exist. It echoes IAM Identity Center, which only recently got cross-region replication, leaving people to set things up in one region and hope for the best. Brett forwarded the news straight to a customer who runs a quarter of a million user IDs in a single region, where until now a regional service outage would have taken authentication down with no real fallback. Plenty of hacky workarounds existed for this, so it is good to see a supported path.

• Personal Projects: Travers’s “Workhorse” Sprint Loop (23:14)

  Travers spent another week building the system that does the work rather than doing the work, which he owns up to as a fun trap. The project is a skill he calls “workhorse,” aimed at the question of how you keep a multi-session project on track without drift. What he has landed on is a north-star document describing where the project should end up, then checking each generated sprint against those goals before letting the agent run, so it sticks to the testing patterns and standards already set. He is also still poking at his own programming language and a game engine, which he cheerfully labelled ongoing psychosis.

• “Token Maxing” and Goodhart’s Law (26:39)

  Brett picked up the term “token maxing” from Y Combinator’s Light Cone podcast, which he recommends for the ideas even when they do not map to his day job. The Light Cone take was to lean in: tokens are cheap and heavily subsidised right now, so burn them to learn how to use these tools while you can, because under the current paradigm they are unlikely to get cheaper soon. Both hosts agreed with the spirit of that. What they did not buy was AWS reportedly setting up leaderboards around it, which Travers tagged as a clean case of Goodhart’s law. The moment you measure something and let people see the metric, they game it. Brett’s version was lines of code and test coverage, metrics that stopped meaning anything the day they became targets. Measuring token spend for cost tracking is fine. Tying it to bonuses or performance reviews is asking to be gamed.

• Personal Projects: OpenBrain’s Nightly “State of Play” Synthesizer (29:50)

  Brett’s main project update was about OpenBrain, his context store, which is now past 3,000 episodic memories for a single user. The problem he hit is staleness: a memory from six weeks ago is rarely still relevant to a project that has moved on, yet it still surfaces. His fix, lifted from another Light Cone episode about using AI to improve your products without you in the loop, is a nightly synthesizer that rolls up all the memories for a given customer and project into a single “state of play” document, a name Claude came up with. When he opens a Kanban card and assigns it to a customer and project, he now gets the synthesized current state first, with the individual memories still there underneath if he wants them. The part he likes most is the confidence handling: when the nightly run cannot classify a memory, it tags it, drops a summary into Slack, and asks him to confirm, so it learns the right bucket for next time. He was candid that if OpenBrain ever disappeared he would be far less effective, which is its own kind of warning.

• Personal Projects: Moving Secrets Into 1Password Service Accounts (35:31)

  A summit hallway conversation with someone from 1Password sent Brett to fix something that had nagged at him for a while. His API keys and secrets lived in the macOS keychain, which works and which Claude knows how to read, but it all vanishes if anything happens to his laptop. The 1Password person pointed him at service accounts, a feature he discovered he had actually created back in 2023 and forgotten about. He had Claude build a tool around the 1Password CLI to pull secrets from the vault, and set up a separate service account per project, each bound to a single vault it can see and nothing else. The security upside is the real story. Previously an agent running with his local SSO profiles technically had enough access to break something it was told not to touch, especially mid-session in an account he had already logged into. Now the agent’s only path to credentials is a scoped 1Password call. It has been running for about a week on OpenBrain, with the other projects still to migrate.

• Claude Fable 5 and Mythos 5 (39:42)

  New model alert. Travers spent about an hour pointing Fable 5 at his roughly 300,000-line harness project and burned through his 5x-plan session limit doing it, but came away with genuinely good insights and recommendations and called it solid, with strong sub-agent handling. Brett had not tried it yet and planned to swap the model in on a project first thing the next morning. The quirk worth knowing sits in the system card. Fable is positioned as a nerfed Mythos, with less cyber and bio capability and tighter guardrails, and if it detects you working on LLM technology or attempting distillation attacks it can quietly degrade its own performance or route you to Opus 4.8 without telling you. Both hosts read that as straightforward anti-competition dressed in safety language, and had some fun with Anthropic putting out yet another call to pause AI development right as it takes a clear lead. The benchmark jumps that stood out were cybersecurity and spatial reasoning, the latter leapfrogging Opus 4.8, which itself only shipped around May 20th.

• Simon Willison’s Initial Fable 5 Impressions (43:34)

  Brett flagged Simon Willison’s write-up, paraphrasing the gist as slow, expensive, and quite happy churning through everything thrown at it, which matched Travers’s experience. Pricing is $10 per million tokens in and $50 per million out, and the models carry a 1-million-token context window with 128,000 max output. The detail that got both hosts was billing. Per the article, Fable is available on subscription plans only until June 22nd, after which even a Claude Max subscriber gets billed extra. They pulled the article up live to check, and it reads as though that extra billing may be scoped to the Claude.ai interface rather than the whole Max plan, which would make more sense than charging your most valuable subscribers twice. One more wrinkle: Mythos-class traffic is retained for 30 days for safety monitoring regardless of where you call it from, so the fully isolated traffic some users relied on may not apply here.

• How Anthropic Contains Claude Across Its Products (48:30)

  Brett rated this the best technical read of the week. Two things jumped out. First, Anthropic reports that more than 90% of the time Claude asks “are you sure,” people say yes, and the more often it asks, the less anyone reads the prompt. They called it Claude crying wolf, and the decision fatigue it creates means the one prompt that actually mattered is the one you waved through. Second, and this is the part that landed, Anthropic constrains where its own agents run by putting them in sandboxes. Brett’s honest reaction was to ask why, if Anthropic sandboxes its agents, he is giving an agent full access to his operating system. He has watched Docker push micro-VM sandboxing for ages, but this is the first time he can recall Anthropic itself saying plainly that this is how they run things. The uncomfortable math is risk tolerance. A vendor can absorb the occasional deleted system as a PR hit, but the individual who has never backed up their photos and files is the one who eats it when an agent does something unexpected. He expects to end up on Docker sandboxes or VMs himself, probably after something bad forces the issue.

• Claude, Please Rack Me a Datacenter, Make No Mistakes (52:56)

  Railway walked through commissioning one of their own datacenters with Claude designing the wiring diagrams, system layouts, and inter-machine communication setups. Two things stuck. The scaling line: what used to give them three months of runway now lasts about three weeks, and they are running into hardware scarcity so acute they talk about not being able to get fiber, never mind memory. And the line Brett loved, that artisanal human-led Excel build documents just do not cut it anymore, because the manual steps are exactly where errors creep in and Claude is now good enough to run the procedure with a lower error rate than most human pass-throughs. Humans have become the bottleneck on a task that is highly procedural, where the common failures are copy-paste and bad inputs. Naturally it has an MCP server wired in, so an engineer can say “I added this” and the agent updates the documentation and databases. It also fed the running mainframe joke: scarce, expensive compute on the network with a dumb terminal in front of you starts to look a lot like where this is heading.

• Envade: One Click in VS Code, Full Shell for the Attacker (57:33)

  Here we go again, in Travers’s words. The Envade write-up shows a VS Code MCP install screen that displays a few innocent fields while hiding others, so a deep link for installing an MCP can be triggered from a malicious web page. You click the wrong thing, VS Code quietly installs it in the background, and you are severely owned. It is the same theme they hit most weeks: you now have to decide your own level of trust in these tool repos and review everything you install. Brett’s standby analogy is that you would never pick a USB key up off the street and plug it into your laptop, yet people happily fire up their favourite tool, browse the repo, and install whatever looks neat. The expectation that Microsoft vets the VS Code marketplace has not held up well lately, and Travers teased some recent security-disclosure problems there for a future episode. Their conclusion was the practical one. The tools are good enough now that you can build an 80% version of what you need yourself, for your own use, so why trust a random extension at all.

Off-the-Clock Recommendations

• Backrooms — Travers caught it in theatres and had fun with it. His honest steer is that it is fine to wait for streaming rather than pay cinema prices.
• Obsession — On Traver’s must-see list. Oddly it came out last year and is only now getting a theatrical run, possibly off a film-festival pickup.
• Masters of the Universe (2026) — Both hosts are in, theatre included. Brett’s pitch is pure nostalgia: night shifts home from university, staying up to watch He-Man and Power Rangers cartoons in the morning.
• Hokum — Also on Traver’s watchlist.
• Light Cone (Y Combinator podcast) — Brett’s non-movie pick. He does not think it maps directly to his work, but the ideas are worth the listen, and it is where “token maxing” came from.
• Burn cheap tokens while you can — Both hosts’ recommendation of the week. Tokens are subsidised right now, so use them to learn these tools and to replicate what YouTube builders are showing off. Just turn off your billing overages so you do not get a surprise invoice.