GuardDuty Watches Your Agents, Bun Rewrites Itself in Rust

Top-Line Summary

The week’s AWS news is all about giving agents the keys: OAuth for the MCP servers, GuardDuty finally watching Bedrock and SageMaker, and Loom wrapping the agent primitives AWS spent two years shipping. The unifying thread is that every one of those conveniences has a bill or a blast radius attached, which Brett learned the hard way when a runaway Lambda retry loop quietly multiplied his Bedrock spend by 25. Outside AWS: Bun’s maintainers spent $165,000 porting half a million lines of Zig to Rust with 64 agents, and OpenAI built a model whose entire job is to break its other models.

Show Video

The “Pre-Show” Context

Northwestern Ontario is on fire and neither host really knew about it until an air quality alert came over the morning news. Brett went outside and looked up at a sun that was just a red disc, so washed out the camera couldn’t even separate it from the sky, and his morning walk felt like walking through a campfire. The fires cover an area comparable in size to Lake Nipigon. The thing that stuck with both of them was the CN Rail footage: engineers going back for a foreman they’d left behind, filming from the cab of a locomotive completely engulfed in flames, then abandoning it when it quit in the heat, losing the hi-rail truck too, and running out on foot.

The Engineering Rundown

• AWS MCP servers now support OAuth (04:39)

  The collection of AWS MCP servers picked up OAuth, so you can do live logins against your accounts instead of whatever credential shuffle you were doing before. Brett’s reaction was less “great news” and more surprise that it took this long, and it comes with an asterisk the size of the announcement itself: making it easier to hand an agent access to your AWS account means you should be much more deliberate about what that agent is allowed to touch. The show has covered enough “oops, I deleted my production database” stories to know how this goes. The practical version both hosts already run is read-only access and let it churn, which Brett uses to point an agent at a misbehaving Lambda function and go do something else while it spiders through the logs. That grunt work is roughly 95% of what a DevOps agent is actually for, and it’s a lot less interesting than the YouTube thumbnails about making a thousand dollars a day with an automated marketing agent, which is precisely why it’s the part worth paying attention to.

• GPT-5.6 and Sol Terra land on Bedrock (09:27)

  Last week’s OpenAI release is already on Bedrock, inside of a week, and apparently in Kiro too. Nobody was surprised: the labs are welded to the hyperscalers now, and Bedrock is where businesses actually reach these models. The more interesting angle is the economics, because per-transaction API pricing is almost certainly better for the labs than a flat subscription, and both hosts noticed how fast they’ve been trained to flinch at the little dollar counter ticking up in the corner while a Claude Max plan sits right there charging nothing extra. Brett doesn’t buy the fear that the subscriptions vanish, since every developer would walk the same day, though he’d drop his instantly at $200 given how many tokens he burns. Travers’ read is that inference at a given intelligence tier keeps getting cheaper to serve while the training runs for the next tier get exponentially more expensive, so the plausible future is the good-enough models landing in your subscription while the new stuff goes to internal use or a select list of business customers, the way Fable did. The stealth bomber flies at air shows because it stopped being the secret.

• GuardDuty gets AI Protection (15:04)

  GuardDuty can now watch Bedrock and SageMaker, and like every other GuardDuty protection plan it’s off by default and you get 30 days free before it starts costing money. Brett turned it on through the delegated administrator in his centralized security account, but only for the project accounts actually running Bedrock, because he doesn’t need it everywhere. The threat model is the genuinely fun part: leak your credentials now and the attacker doesn’t just take your data, they spin up an agent in your account and tell it to export production somewhere else “for DR purposes,” and you pay for the tokens they burn stealing your own data. You get cut twice.

• Loom for AWS (18:57)

  An open source reference platform for governing AI agents, built on Strands, giving you a control plane with RBAC, ownership, an agent registry, and a human approval panel. So that’s where the agent news went this week. Brett called it completely on brand: AWS hands you the primitives, lets you glue them together like Lego for a while, then arrives with a layer that means you don’t have to think about it anymore. It says enterprise grade, and he doesn’t see himself using it, partly because the wrapper takes the fun and the learning out of it, and partly because of a real objection: these systems are already mysterious to customers who ask how the thing actually got its answer and get “it’s magic, man, there’s numbers in the box” for a response. Abstraction is fine and we’ve been doing it for decades, but putting an abstraction on top of something this abstract might be too soon. Travers’ counter is that this is Control Tower for agents, aimed at the multinational with compliance requirements, and somebody has to write the context system and the memory database whether you find that interesting or not. Brett’s cynical hat: easier to use means more consumption, which means those AI workloads finally start generating real dollars, and $200 billion of investment doesn’t justify itself.

• Nobody shipped an AgentCore update (03:54)

  Not one. Both hosts were genuinely thrown by it, which says a lot about the cadence of the last few months. The running theory is a rename to Kiro Core.

• A Discord movie bot on AgentCore (23:48)

  Travers built an agent to solve a parsing problem in his Discord movie voting bot: people take a lot of creative license with movie titles when they vote, so tabulating the week’s results is a mess. The bot runs on API Gateway and Lambda, and when a vote misses the database and isn’t in the cache, it fires off to an agent that guesses what the movie could be, searches TMDB, and comes back with “did you mean this one?” It’s a fuzzy search problem that lines up perfectly with what an LLM is good at, and it runs on Nova models because that’s all it needs. Brett’s take is that this is exactly the thing that flipped him from skeptic to believer late last year: a small piece of personalized software that makes your life easier and costs about a dollar. You don’t need Opus 4.8 to match movie titles, and it would probably make fun of you for asking.

• Pokémon TCG on Kaggle (27:10)

  The Pokémon Company put a runtime, an engine, and a legal card pool on Kaggle and told roughly 4,000 people to build pilots for decks and climb the leaderboard. Travers peaked at second before the metagame shifted and is now somewhere around 100th, and currently has a Codex session running with the goal of building an observable engine he can pull data and reusable seeds out of, so he can run ML on it and mine what’s actually winning and losing. Brett’s diagnosis: you need a hobby. Travers: this is my hobby.

• A $28 Bedrock bill with a UUID bug underneath it (28:56)

  Brett’s OpenBrain Bedrock bill went from hovering around a dollar to about $28, and the obvious suspect was the new dream cycle synthesizer. It wasn’t. He tagged the Lambda functions making the Bedrock calls to find out what was actually generating tokens, then handed Claude read-only access to the account and told it he didn’t understand why the bill was that high. The real culprit was the piece that reads episodic memories and decides which project each one belongs to, and whether it’s confident enough to file it or should ask a human. It was talking to Bedrock fine and getting responses back, then parsing the project UUIDs wrong and timing the Lambda out, and because it’s an async function it retried three times by default, burning tokens on every attempt and never writing anything to the database. No DLQ, so nothing surfaced. It took three nights of trial and error, mostly because Brett refused to force it and let it work through the scheduled jobs instead, and the bill is now down to two or three cents a day with the synthesis actually running.

• The Kanban board isn’t for humans anymore (34:50)

  The honest follow-up question was whether any of that synthesized memory has been useful, and the answer is no, for a reason Brett didn’t expect: he’s stopped using UIs. He built the Kanban because that’s what he did in Jira, dragging cards and writing notes, and now he just talks to the agent, says the ticket’s done, and it closes it. He isn’t looking at the board anymore. The agents might be. Which reframes what the rolled-up project summary is for: it’s context for whatever agent picks up that ticket, so it can read one summary instead of chewing through every episodic memory the project ever produced. Kanban-generated memories are explicitly ignored during summarization, because “moved from TODO to IN_PROGRESS” carries no signal worth keeping.

• The /retro skill (38:20)

  Stolen from a YouTube video Brett describes as a love letter to Pi, where the guy asks his agent for nicely styled HTML documents instead of markdown. So Brett built a skill that reads the session and reports what worked, what didn’t, and how to fix it next time: this took four attempts, here’s why, here’s the memory update or the tweak to the skill definition that would have prevented it. It’s been running about a week and he’s happy with it. Travers is stealing it.

• Branded HTML handover docs, via Claude in Chrome (41:19)

  Brett has switched his customer handover docs from markdown to HTML, and this week pushed it further: he told Claude not to touch a word of the text, go look at the customer’s website, and rebrand the document to match. Then he wandered off to dinner, came back, and found Chrome clicking around on its own, which briefly freaked him out until he remembered he’d installed the plugin. It pulled the logo, the colors, the typefaces, even the customer’s H1-to-H2 sizing. Markdown is still fine for stuffing things into a data store, but for anything a human has to read or a customer has to receive, HTML wins. Someone in a Discord Brett hangs around in reported the logical extension: sent a branded PDF, customer printed it, marked it up by hand, photographed it, and Claude read the handwriting and revised accordingly. Both hosts are fairly confident Claude could not read theirs.

• Take-home exam scores that didn’t survive the in-person final (44:47)

  A professor at Brown gave a take-home midterm and nearly everyone scored in the 90s, which was odd enough that he ran the final in person. The 95s turned into 40s. A few students dropped the class outright, and one kid went 95 then 96. Nobody had much sympathy: prepping for the test is the part where the learning happens, and skipping it is just cheating yourself. It’s also why cursive is quietly coming back in schools, since handwriting is about the only way left to guarantee an essay wasn’t ghostwritten.

• Netflix might buy Letterboxd (46:14)

  Fine, as long as they don’t ruin it. The specific worry is the streaming availability list quietly losing every service that isn’t Netflix.

• Pi extensions and 1Password service accounts (46:55)

  Pi doesn’t have skills, it has extensions, so Brett pointed it at the Claude skill he uses for 1Password service account access and told it to write itself an equivalent. It produced a TypeScript extension, he reloaded, asked it to read the open OpenBrain work items, and it went to 1Password, logged in with its service account, grabbed the tokens it needed, and didn’t leak any of them into its thought process. That last part is the win. Pi with GLM 5.2 is his default now for anything that doesn’t require Claude Code, and Travers runs the same split: Claude for reasoning through the work items, GLM 5.2 in Pi for writing the CloudFormation and the Lambda functions, because Opus 4.8 is not what that job needs.

• GLM 5.2 filed a VAT return for three dollars (48:50)

  Someone in the UK ran their VAT return through GLM 5.2. It took about 70 minutes, cost just under three dollars, and came out about six or seven pence off, which a human bookkeeper could manage on a bad day. The comparison point is the £1,500 to £2,000 a quarter small businesses pay to have it done. On a pure math problem that’s not a close call, and Brett’s broader read is that these tools are getting good enough to do the work nobody wants to do at a price that makes the professions hosting that work distinctly uncomfortable. But he wouldn’t hand CRA paperwork to a model, and Travers put a finer point on why: LLMs aren’t reliably identical across runs with the same inputs, which is a non-starter for accounting, where being wrong costs you a fine and possibly the business. The realistic version is the model hitting a purpose-built API or MCP server, producing a first cut, and a human accountant reviewing it, which still removes most of the work. The unresolved question is whether you want your income statements and your T4 crossing a model provider’s API at all. That kind of niche legal edge case, multiplied by a few million, is a decent explanation for why the sweeping workforce change hasn’t landed yet. It’ll probably go like internet banking: nobody used it, then convenience won and nobody thought about it again.

• AI browsers can be lulled into a dream world (54:14)

  Neither host uses an AI browser. Brett installed something called Aside on a Discord recommendation, opened a couple of sites, never connected it to his Anthropic account, and hasn’t touched it since, on the theory that browsers are like IDEs and almost nobody switches. The attack, named BioShock, is engineered web content that convinces the agent something false is true, and once it believes one plus one is three you can walk it somewhere it would never otherwise go. Jailbreaking by logical paradox, essentially, complete with “victory is defeat” in the copy. The reason it matters is that the browser is sitting on your laptop with your files, your cookies, your session tokens, and whatever your password manager has open. The name is well chosen and the takeaway is boring: stick with a regular browser for now.

• Microsoft’s MAI-Thinking-1 (58:01)

  Microsoft is back in the foundation model game. Performance isn’t top tier (roughly 97 on AIME, roughly 50 on SWE-bench), but they published the entire training paper, which is one of the better views anyone’s had into how these things actually get built. It’s a little funny given how much Microsoft has poured into the big AI players, though Amazon did exactly the same thing with Nova. The detail that caught Brett’s eye is a safety-versus-helpfulness chart benchmarking themselves against Sonnet across content moderation categories like self-harm and sexualized content, which he’s never seen another lab publish. That’s probably where they’re trying to differentiate. Nobody expects it on Bedrock, though the usual turnaround is four or five days, so ask again next episode.

• Bun ported itself from Zig to Rust for $165,000 (1:01:34)

  Bun is a JavaScript runtime plus the bundling and hosting machinery around it, and it had a Zig problem: memory leaks and use-after-frees they kept running into. So in May the project owner pointed Fable at half a million lines of code and asked whether it could be ported to Rust. Sixty-four concurrent agents, eleven days, and it was done. The lessons are in how, not whether. This was not one prompt: they ironed out the rules of engagement first, the porting requirements, the docs, which compiler errors to chase, and what the test suite was. The test suite happened to be in TypeScript, a separate language entirely, which is what made it safe to turn agents loose on the code in parallel. Each working agent had two oppositional review agents riding it, and that adversarial setup is what bought them reliable parallel code generation. They ported the unsafe Zig straight across into Rust unsafe blocks first and are refining it into idiomatic Rust now. Both hosts noted this is the kind of rewrite that normally kills a project: three or four engineers, a year plus, well north of $165,000, and a real chance you get nothing at all at the end. Brett’s reference point is that Anthropic tried and failed badly at writing a C compiler from scratch not that long ago. Worst model you’ll ever see, as the Mollick line goes.

• Is your CLAUDE.md too big? (1:06:43)

  The received wisdom is that skills should be two lines and your CLAUDE.md should stay under 50K, and Brett isn’t seeing the downside. His global CLAUDE.md, project CLAUDE.md, and memory files keep growing as the agent learns his projects and environments, and the promised penalty (burned tokens, slower runs, worse output) hasn’t shown up. Travers does trim when he notices bloat, and handles it with hierarchical skills: an entry skill that calls sub-skills and tools on demand rather than one flat wall of context. The Bun port had a rule worth stealing here: if you have to spend more than a paragraph justifying a workaround, don’t do it, veto it. It kills the rationalization loops before they start.

• GPT-Red, OpenAI’s in-house attacker (1:09:29)

  OpenAI built a model described as a sparring partner, whose job is automating the red teaming that humans used to do against their other models. It’s effective, and it’s finding attacks nobody had thought of. The standout is fake chain of thought: GPT-Red inserted fabricated reasoning steps into another model’s thinking, which is the browser attack again in a different costume, just convincing a model of something that isn’t true. It also talked a vending machine agent into selling something expensive for 50 cents. Most of the effort went into prompt injection, which tracks. The training setup is a self-play loop where models work against each other, one trying to break, the other trying to improve, which is exactly how the superhuman Go model was trained, now pointed at cybersecurity. It is also extremely persistent, which is the real gap: a human red teamer gets bored and moves on, and this doesn’t. Both hosts think cybersecurity is in for a rough few years. Two Linux kernel exploits landed last week, and Microsoft just shipped what may be its largest patch load ever, which rather implies somebody’s tooling is finding things that were sitting there all along.

Off-the-Clock Recommendations

• The Alters (2025, Steam) — a role-playing sci-fi game Travers picked up right after the summer sale ended. He refused to explain the concept to avoid spoiling it, but compared the talking-to-NPCs, choose-how-you-play feel to Mass Effect or Cyberpunk, and says he’s never seen anything like the central idea.
• Herdr — a lighter fork of Ghostty in the same family as Cmux, with the tabs down the side but a more CLI-feeling presentation and no menu overlay. The feature that caught Brett is built-in scheduling: it sets cron for itself, so it can pick work up overnight. He used it while chasing the OpenBrain bug, and it got grumpy with him by day three because it authenticates through SSO rather than an IAM user, so the session had expired every morning.
• Pokémon Trading Card Game — Travers’ actual recommendation, and his actual hobby.
• Slotherhouse (2023) — a killer sloth in a sorority house. Brett’s wife insisted he tell Travers about it.
• Borderlands (2024) — genuinely terrible, with Jamie Lee Curtis and Jack Black as the robot, and a budget you can see on screen. Watch it free, then spend two hours wondering how they got that many good actors into it. The games were fun and the movie tried to bottle that and missed completely.
• Ghoulies (1985) — a cult leader’s interrupted ritual, a son inheriting the house 20 years later, the black magic paraphernalia in it, and little puppet creatures everywhere. Recommended if you’re a Critters person, which Brett is. Not to be confused with The Goonies (1985), which is a much better movie and has Data instead of puppet freaks.
• Mars Attacks! (1996) — last week’s watch, star-studded, with a Jack Black barely out of his twenties.
• Oblivion (2013) — invoked mid-episode for “are you still an efficient team,” and worth a watch if only for the Tom Cruise run.