October 9, 2026 — One Prompt Could Have Owned Your AWS Agents

Host0:30

The address is one sixty nine dot two fifty four dot one sixty nine dot two fifty four. If you've done any cloud security, you just winced. That's the instance metadata service. Zenity researchers say a prompt to a public-facing Bedrock AgentCore agent could reach it. Here's the interface. You send the agent a prompt, the agent makes a request to that address, and it hands back temporary credentials for its own AWS identity. It also hands back a reference to its container image. Now the mechanism. AgentCore runs agents in ephemeral Firecracker microVMs, which are small, isolated virtual machines. Zenity says a network isolation failure let an agent with HTTP or shell ability reach the metadata service, and that service hands out workload credentials. It's the old request forgery trick, pointed at a new kind of workload. The bigger problem was the role behind the credentials. In Zenity's account, the default execution role reached well beyond the one compromised agent. With it, the researchers say they could enumerate other agents and touch private conversations, memory, and secrets. Their report describes a chain of flaws, not prompt injection alone. They also used the credentials to pull the agent's container image and inspect it as root. Zenity's Tamir Ishay Sharbat told Dark Reading, quote, “Cloud and AI are kind of like fire and ice,” and, “That was so freakin' easy.” Fire, ice, and a container image inspected as root. Now the caveats. Zenity says it reported this to AWS in December twenty twenty-five. As of February fourteenth, twenty twenty-six, newly deployed agents use IMDS version two. Dark Reading says AWS also restricted the default role. Dark Reading reports Zenity saw no evidence of exploitation in the wild before the fix. That's the researchers' finding, not proof it never happened. And the claim that one prompt could control every agent in an account and region is Zenity's demonstration, not a verified customer incident. AWS may stress that it's patched and that the research describes a specific configuration. Here's what's unclear. Reports describe the fix for newly deployed agents. Whether agents deployed before February fourteenth are covered, or need a redeploy, isn't settled in what I read. So check the old ones, audit the permissions, and give each agent a least-privilege role of its own. That was about what an agent can reach. The next story is about what you might run the agent on.

3:23

Three thousand eighty two turns. That's how long StepFun's agent played Pokémon Red, and it ended with three badges and a win over Lt. Surge. About a third of the story, after more than six million tokens, and by StepFun's own account. That's the vendor-reported demo for Step five Preview, a model that landed on OpenRouter yesterday. It's a sparse mixture of experts, six hundred billion parameters in total, twenty seven billion active per token. It only wakes part of itself up for each token. Where can you use it? StepFun's own products and API, and OpenRouter, where StepFun is the only provider. The OpenRouter name is stepfun slash step five preview. Bedrock and Vertex availability is unknown. The interface is OpenAI-compatible. You send text, images, or video, and it hands back text. OpenRouter lists tool calling and JSON schema output. CellCog reports low, medium, and high reasoning effort, and says reasoning tokens bill as output. Price is one dollar per million input tokens, two dollars seventy cents per million output, and five cents per million cached reads. The window is one million tokens, with up to sixty four thousand out. Now the benchmarks, and whose they are. StepFun's own StepCodeBench gives it forty nine percent. On DeepSWE version one point one, CellCog's transcription of StepFun's table has Step at sixty seven point seven. Kimi K three is at sixty seven point five, and GLM five point three at sixty six point nine. Claude Opus five scores seventy four, and GPT six Astra seventy four point one. Step ran at High effort while rivals ran at Max. StepFun also reports five hundred eight teraflops on an H100 kernel task against Opus five's four hundred ninety three. That one's vendor-run. The independent number is narrower. Artificial Analysis measured provider speed, not capability. It got eighty six point eight tokens per second, and twenty five point eight eight seconds to the first answer token. Limits. StepFun itself admits a meaningful gap to the frontier on the hardest long-running coding tasks. Weights are promised for October fifteenth, but the license is unknown. So are rate limits. Sources even disagree on launch date, September twentieth versus OpenRouter's October eighth. Verdict. Try it on a long-prompt, tool-calling agent job, and compare quality and total cost with your current model. Wait if you need the weights, the license, or a reason beyond vendor benchmarks. Whatever model you pick, it'll eventually be pointed at a cluster, and you'll be the one staring at it.

6:24

The demo cluster in K10s ships with a pod that's deliberately in CrashLoopBackOff. Fake fire, safe to practice on. K10s is an Apache two point oh Kubernetes terminal UI, written in Go. Its README pitch is the Kubernetes terminal UI you can click. You get mouse interaction, instant search, logs, exec, port-forwarding, themes, and optional AI. How does it work? It reads the same kubeconfig as kubectl. The README says startup registers zero watches, and informers start lazily the first time you view a resource kind. Folded groups don't request counts. The interface uses Charm's Bubble Tea, and the README credits BubbleZone for the clicking. The AI mode injects your current cluster, namespace, kind, and selected object into the prompt. The README says cluster data isn't sent unless you submit in AI mode. There's also a read-only mode, and a self-update command that verifies checksums. Why are people looking? Because k9s is the incumbent, and this is a newer take that's easier to discover. The Show HN thread split. Some people dislike mouse use in terminals, and others asked about maturity and overlap with k9s. Those are user comments, not an evaluation. Claims like opens instantly are the project's own. Here's the honest limit. The author says they haven't smoke-tested it against a production cluster. In the README's own words, try it on kind first. Or skip the cluster entirely. Git clone the p10node slash k10s repository, change into it, and run go run, dot, demo.

8:16

Claude Code, version two point one point two ninety five. A hook that can't start, times out, or exits with an unexpected code can now block the action instead of letting it through. Set onFailure to block on a command or HTTP hook. The release also fixes a bug where deeply nested tool input reached a hook cut short, which could let a guard pass content it never saw. Upgrade if hooks guard anything, and test the failure cases first. It also adds status reporting through O S C seventy five oh one, and fixes a vim tilde bug that left x doing nothing. FastAPI, version zero point one forty three. This one breaks things quietly. Automatic OpenTelemetry exporter setup is now opt-in, so apps that relied on OTEL environment variables may stop exporting after the upgrade. Set the FASTAPI OTEL AUTO CONFIGURE variable to true, or pass auto_configure true in the FastAPI telemetry argument. Apps that configure their own providers and exporters need no changes. The release doesn't say why the default changed. Codex CLI, rust version zero point one sixty two. Codex can now create and list managed Git worktrees for trusted local projects, with the worktrees feature enabled. Worktrees give parallel tasks separate checkouts instead of one shared directory. It also adds task pinning with the p key, when supported by the server. If you already script worktrees, this is convenience, so read how it defines trusted. uv, version zero point twelve point twenty four. uv cache prune now removes orphaned temporary build environments. It also accepts PEP five oh eight marker operators before grouped expressions, and rejects malformed requirements-file options instead of half-parsing them. The notes don't say how much disk you'll get back. The standalone uv-build binary also got seven point five percent smaller by dropping unused Zstandard support. Everything so far was software behaving as shipped. The next set is software behaving as feared.

10:34

Fast Boot. Three items, one worm, one raid, and one very bad idea. Tensorlake worm. Version zero point five point one forty four of Tensorlake on npm carried a Shai-Hulud worm variant, so rebuild and rotate if you installed it. Revoking its stolen GitHub token could trigger a wipe, so the worm has opinions about your incident response. Flax Typhoon. The FBI seized seven domains tied to MicroScan and FishHub, Flax Typhoon-linked tools, with agencies in seven countries issuing an advisory. One seized domain was outlook three six five oh dot com, a name hoping you'd skim. SQLDoom. CedarDB's Lukas Vogel ported Doom into SQL, about fifty nine hundred lines of game logic, with a renderer built from eighty nine CTEs. On the developer's Ryzen 7 PRO 7840U, it typically hits about sixty frames per second, dropping to thirty five in busy scenes. Vogel says rendering Doom in a database is obviously a bad idea, and the project supports four-player deathmatch. So that's a worm in your install, a raid on the scanners, and Doom in a database. Only one of those was built on purpose by someone who admits it's a bad idea.

11:55

Today was the AgentCore credential flaw, StepFun's Step five Preview, K10s, four ship log releases, and Doom in SQL. Your try-it for the weekend is the K10s demo. Run go run, dot, demo, and chase that fake CrashLoopBackOff pod. Links to everything are in the show notes. Follow The Daily Reboot in your podcast app so the next one finds you. I'm your host. Check your agents' roles, and I'll see you next time.