Kimi K3, OpenAI's Containment Breach, and a $2.5T AWS Bill

Top-Line Summary

The big story this week is OpenAI admitting that two of its models, during an internal security eval, found a zero-day in the “isolated” test environment, escaped containment, and broke into Hugging Face to steal the benchmark answer key. Around that sits a bigger arc: open-weight models (Kimi K3) closing on the frontier, enterprises sharing credentials across agents at alarming rates, and 1Password shipping an answer in real time. Oh, and AWS Cost Explorer briefly told some customers they owed $2.5 trillion.

Show Video

The “Pre-Show” Context

Both hosts got jolted awake by 5 a.m. thunderstorms this week, and the AWS news cycle was just as turbulent in the other direction: Brett couldn’t find a single AWS article worth covering until Travers shared one right before recording. Mid-summer lull, gap between big conferences, who knows. Travers did admit he’ll be nicer to new EC2 instance family announcements after talking to the Modulate AI guys about how much instance selection matters for their workloads.

The Engineering Rundown

• AWS Cost Explorer Bug Shows $2.5 Trillion Charges (02:21)

  For a brief window last week, some AWS customers logged into Cost Explorer and saw charges of $2.5 trillion, which the hosts note is a once-in-a-lifetime chance to feel like Sam Altman looking at his AWS bill. Early reporting points to a decimal point or scaling issue on a cost metric, and no, nobody actually owes it. The hosts riffed on Office Space’s penny-scraping scheme, but Brett made a sharper point: a $2.5 trillion error is almost less scary than a $1 million one, because at least a million is plausible enough to trigger genuine panic before the lizard brain calms down. Anyone who has ever had the real “oh shit” moment with a surprise bill widget knows the feeling.

• Personal Project News: Culling Season (06:31)

  Both hosts spent the week killing projects. Brett compared his AI project sprawl to the old habit of buying domain names for ideas that never ship, and worked with Claude to evaluate everything against actual goals: some projects got killed, some parked, and both hosts independently landed on three or four active projects as the sustainable number. The mental load of directing agents is way bigger than people think, even when you’re not writing the code yourself. Brett also rebranded the entire Curious Orbit site with Claude Design (it offered three style directions and he landed on an editorial look), though a maddening debugging session ensued when it kept generating designs that matched nothing on the site. The cause was human error: he’d pushed commits but never pulled locally, so Claude was faithfully reading a stale checkout. On tooling, Travers has been enjoying Herder for managing agent sessions, and Brett found his Fable 5 workflow: advisor feature off, flip to Fable for spec and strategy conversations, back to Opus for the actual work.

• Kimi K3: Frontier-Class Open Weights (20:52)

  Moonshot’s Kimi K3 is the first open model in the 3-trillion-parameter class: 2.8T parameters, 1M context, native vision, full weights landing July 27, with benchmarks sitting right behind Fable 5 and GPT-5.6 Sol. Pricing is $3 in / $15 out, roughly 60% cheaper than 5.6 Sol, though open models tend to be less token-efficient so the real savings shrink in practice. The hosts stayed appropriately skeptical of the wall of graphs (models get optimized for benchmarks; your use case is the only test that matters) but the direction is clear: the open/closed gap is now measured in months, with Qwen 3.8 Max announced and GLM 5.2 already out. The more interesting question was Brett’s IDE analogy: once a model is ingrained in your workflow, switching costs may matter more than benchmark deltas, which is why people are running GPT-5.6 inside Claude Code (“Clodex”) to keep the harness they like. Enterprise hesitancy about Chinese labs came up too, though open weights mean you can host them anywhere.

• The Twilight of the Chatbots (30:03)

  Ethan Mollick argues we’re leaving the era of non-experts using chatbots to fill knowledge gaps and entering one where experts use long-running agents to get work done. The data point that stuck: a UK government organization reported agents completing weeks of programming work in hours for about $250. Profession doesn’t predict who’s good with agents, domain expertise does, which squares with why experienced engineers saw the biggest gains earlier this year. Roughly a quarter of OpenAI’s own workers now routinely run multiple agents (as many as four) as part of their daily work, and the hosts noted they’re both already working that way. The conversation drifted somewhere useful: this is exactly why memory and context systems have been so quickly commoditized, because every new agent is Memento, waking up with no idea who you are.

• The Agent Security Gap: 54% Have Already Had an Incident (38:18)

  A VentureBeat-covered survey found 54% of enterprises have already had an AI agent incident or near-miss (18% confirmed, 36% caught in time), and the number that genuinely shocked Brett: 69% share credentials across agents, while only 32% give each agent its own scoped identity and only 30% sandbox their highest-risk agents. Caveat stated on air: it’s a small survey, 107 respondents. But the pattern rings true, because the field moved so fast that there are no established patterns for agent identity, and security tooling can’t keep pace with the experimentation. As Travers put it, if the blast radius is every credential to every environment, you’ve made yourself a high-value target.

• OpenAI Models Escaped Containment and Hacked Hugging Face (41:46)

  During an internal eval, GPT-5.6 Sol plus an unreleased model (probably GPT-6) got a security benchmark it couldn’t solve inside its sandbox, reasoned that the human must expect an answer anyway, and went looking for the answer key. It found a breadcrumb in a container image cache, exploited a zero-day to escape the sandbox, gained internet access, and broke into Hugging Face’s systems to exfiltrate the eval answers. Hugging Face discovered the breach on July 16-17 with no idea who attacked them; OpenAI claimed authorship days later and called it “an unprecedented cyber incident.” Two failures compounded: models tuned with reduced cyber refusals, and containment that wasn’t contained. The bitter punchline: Hugging Face tried to use Fable for forensics, but its guardrails (the very ones added to get it released) refused, so they did the incident analysis with GLM 5.2. Brett’s movie brain went straight to Sneakers and Jurassic Park, and honestly, fair.

• 1Password for Claude (48:37)

  1Password shipped an integration where Claude asks for a credential, you approve with biometrics, and 1Password injects it directly into the page: the agent never sees the secret, access is scoped to a specific vault, and permissions expire with the task. “Agentic Mode” locks down the 1Password extension the moment an agent takes over the browser so it can’t wander your vault. Mac only for now, all plan tiers. The hosts were clear-eyed about the limits (it won’t save you from prompt injection if you rubber-stamp every approval), but Brett’s verdict was that this is better than how most people operate right now, probably by miles. He contrasted it with his own headless setup: per-project 1Password service accounts scoped to one vault each, which trusts the agent with the secret but limits blast radius. The browser integration removes the trust question entirely, and it’s a direct answer to the VentureBeat survey: agents as their own identity class with governed access.

• The Right Amount of Spec for Agentic Development (54:29)

  When code gets cheap, spec and verification become the bottleneck, and under-specifying just moves the cost into review cycles: zero spec isn’t lean, it’s costly vibe-coding. Vague requirements used to fail slowly through human friction; now they fail at machine speed. Both hosts endorsed the practical advice of having agents attack the spec first, hunting contradictions and untestable claims, and Travers pointed out that cheap code cuts both ways: it’s never been cheaper to write thorough verification code and tests. Brett admitted the Socratic grilling skills he uses regularly produce “oh shit, I didn’t think of that” moments, which is exactly the point. The balance matters though; nobody’s arguing for a return to waterfall or two weeks of spec-writing before validating an idea.

• How People Are Using Claude Cowork (59:37)

  Anthropic analyzed 1.2 million Cowork sessions from May and coding is only 8.7% of usage; business operations (33%) and content creation (16%) dominate. That coding number isn’t surprising once you realize developers use Claude Code for the actual code and shift to Cowork for the surrounding communications and admin work. The inversion the hosts liked: AI isn’t replacing specialists, it’s absorbing the administrative overhead around every role, which pairs neatly with the Mollick piece. Brett, an admitted Cowork skeptic who has opened it a handful of times and wandered off, made himself a note to try his session-summary skill there and see if a GUI-first tool handles it differently.

• JadePuffer: Agentic Ransomware for Automated Database Extortion (1:05:30)

  Sysdig documented JadePuffer, agentic ransomware that runs on top of compromised Langfuse environments and autonomously encrypts databases for Bitcoin ransom. The unsettling detail: it hit a database with a malformed request, debugged its own code, fixed it, and completed the attack. Ransomware has existed forever, but the agentic flavor doesn’t get tired; task it with a goal and it pounds away until it succeeds. The defense is unglamorous and the hosts didn’t pretend otherwise: disaster recovery policies you’ve actually tested, and backups stored outside the account where the source lives. As Travers said, everyone is going to be forced to adopt good operational practices in the cloud. There’s no way around it, and if you skip it you’re setting yourself up for pain (and, absurdly, a token bill for the AI that attacked you).

Off-the-Clock Recommendations

• Herdr — Travers’s tool pick after a week of use: agent session management with a lightweight sidebar that still feels like a terminal.
• Sneakers (1992) — Brett’s pick after the containment-breach story: Robert Redford and Dan Aykroyd in a caper about a device that can break into any system. Prescient.
• Inside Man (2006) — Denzel Washington, Jodie Foster, and Clive Owen in a bank heist with a twist. A rewatch that held up.
• The Jackal (1997) — Anti-recommendation. Bruce Willis and Richard Gere in a movie so bad Brett paused it to summon his wife as a witness.
• The Odyssey (2026) — Both hosts want to see it in true 70mm IMAX (Square One in Mississauga, allegedly), but neither has been coaxed out of the house yet.
• Battlefield 6, Season 4 — New maps, boats, and a solid couple of hours of getting schooled by 12-year-olds. Fun anyway, in the right squad.