The Slow Collapse of Civilization
AI agents escape their sandboxes, exploit Artifactory, and attack real companies. Is this a genuine safety problem, or just another round of labs marketing how powerful their models are? Grok Bot offers virtual coworkers with access to your accounts. Amazon's Region Flex project moves workloads out of flagship AWS regions as the cloud runs into physical power limits. And Amazon is building a gas-powered AI data center in Texas. What happened to The Climate Pledge? Burst Mode covers NVIDIA's Nemotron 3.5 Lightning, Amazon destroying books to create AI training data, Twitch scraping streamer content because "if it's opt-in, nobody would opt-in," and Matthew's latest take on CloudFormation Express Mode.
Transcript
Hello and welcome to Yells at Cloud, brought to you by the finite physical limits of cloud computing. I'm Gunnar Grosch, joined this time by Danielle Heberling, Matthew Bonig, and Chris Farris. All four of us were recently at the AWS Heroes Summit. We would love to tell you what happened, but several lawyers and at least one NDA advised us to stop talking about it.
So we'll stick to things we're legally allowed to discuss, like AWS power consumption, AI agents, and I guess the slow collapse of civilization. Danielle, what is something that you've built or tried recently that had nothing to do with work?
trying to get into sports.
yeah.
Oddly. I've been watching PWHL even though it's currently off season, but getting into women's hockey and it's a pretty cool time.
That's very cool.
Did Brian LeRoux talk to you? LeRoux? He talked to me a lot
No, he actually did not. But yeah.
about women's hockey during the summit. We we had a very long conversation about it and I'm trying to figure out a place to stream it here in the States.
Man, now I'm mad I didn't talk to him about that. That would've been awesome. But yeah, watching the Seattle Torrent, my closest team, so by default, I'm now a fan.
Very cool. Matthew, how's life on the road?
Good. We're currently kind of in Danielle's neighborhood, in Tillamook, Oregon. So we've been having a lot of fun going to the cheese and ice cream tours around there. and after this we're gonna head more south to be in San Francisco by about the end of September.
Alright, Chris, first time on the show. Welcome. You are an AWS Security Hero. But
The note here says that it's only because AWS or Amazon PR department didn't green light a villains programme.
I mean if you've seen my blog where I talk about how Security Hub gives me imposter syndrome and yeah, cloud encryption is worthless, so don't use KMS. You could see maybe why that they would have a little bit of angst about giving me the title.
Alright, so we have a lot to get through in this episode as well. And Chris, we're gonna let you kick things off.
Yeah, so I think big news in this space since the last episode was the fact that three major labs have had AI agents effectively escape containment
and attack companies on the internet. And so we first heard about this from a company called Hugging Face. They're kind of like a GitHub for open weight models who announced and reported, we're being attacked and we don't know how, but it's definitely an AI. And coincidentally, you know, none of the closed source frontier labs can help us, so we had to go spin up open weight models in our, you know.
know
environment that we host, you know, cha ching cha ching, to to defend ourselves. And shortly after that, somebody at OpenAI is like, wait a minute, and they kind of fessed up that, wait, maybe that was us. And it looks like what was happening was is they had a either a model that they were fine fine tuning, reinforcement learning, or maybe even a model that they were just doing capacity
training on and yeah, models will find a way, and models are very determined. So it discovered how to escape through the only thing it had access to, which was an Artifactory repository.
It apparently started learning swarm behavior like the Velociraptors in Jurassic Park because then it started leaving messages for other agents. And suddenly they became a pack you know animal, pack agents. And then, yeah, just used the used Artifactory's capabilities as a way to go off and and attack Hugging Face.
I didn't know it was through Artifactory that they got the escape vector. I thought they just had a full blown internet connection, but they only had access to Artifactory and somehow hacked
Yeah, so
Artifactory for remote code execution.
They were being responsible and had sandboxed these agents. And so the agents obviously needed to get packages, but Artifactory was kind of set up to be that proxy. So if the agent needed something, it would get it from Artifactory rather than, you know, getting it from the internet. so that was the only thing the agent could really talk to. And it was doing something called exploit gym, which I guess is sort of like a
Kobayashi Maru experiment where it's trying to find exploits in some software.
And the model was like, hmm, I can't find this. How would I get the answer to this? let me go see if I can steal the answer key. And it presumed that Hugging Face might be the source of the answer key, which is why I decided to go after Hugging Face. So now you've got agents with pack behavior, absolutely ruthlessly deterministic, not and yeah, like determined to.
To do it, figuring out that well, I can't actually like solve the problem, but hey, I can like go find a zero-day and artifactory and use that to pivot out to the internet to then go after a company. and so that was kind of the Hugging Face one. And then I think shortly thereafter, there was another release from Anthropic. And what I saw most recently on the Anthropic one is whereas the
OpenAI agents were like engaging in collective pack behavior. The Anthropic agents were engaging in cutthroat behavior. They were like competing against each other. So they were like trying to sabotage the other agents. Now, could very well have been just a difference in the experiments, or it could just be a difference in what's going on inside those crazy models.
Isn't this all just marketing then? Isn't it kinda what we've seen over the years from these labs that no, we can't release ChatGPT because it's too dangerous and we just see this over and over again.
I would say there's an element of that, but usually I don't go out and issue a press release, because yeah, I usually don't go out and issue a press release saying, hey, my tool has hacked somebody. because usually that follows with, hey, I'm getting sued.
Mm-hmm.
yet, right, like there there is some of that. on the other hand, like it happened, right? And I think
You know, my take is
Yeah.
OpenAI was incredibly negligent, not in the fact that they allowed the agents to escape the sandbox, right? That was kind of like one of those things where life finds a way. You know, we should have assumed that the dinosaurs would, you know, with frog DNA, would, you know, turn males into females or whichever happened.
Yeah.
Rather, they weren't watching what the agents
Yeah.
were doing to be like, look at that. Now they're like communicating with each other. Hey, wait, why are they you know trying to find the answer in Hugging Face rather than solving the problem that they were tasked with? So that's really
Yeah.
the where I see the fault lies is the companies are
Yeah.
not keeping an eye on their experiments, they're just letting them
Mm-hmm.
run loose, and you know, it's gonna be dangerous for all of us.
The timing is
Yeah, I guess that
way suspicious though, 'cause it's like OpenAI and then all of a sudden Anthropic's like, wait, wait, wait, us too. Like within a day.
No no we can do
And then when I came back with
that too.
I think Google is the only one we haven't heard from, right? Gemini isn't breaking anything
Our models can do that too. Mm. Google's a whole other story. It's their
Yeah.
Gemini couldn't break into Google.
Well, you'd have to have good enough telemetry to know your agents are attacking somebody, to actually be able to admit to your agents attacking somebody, so
Yeah, and I could see why that that would probably be a very hard thing to trace. I mean it's one thing to sit there and watch the context window and see what's going back and forth. It's another thing to if they hacked Artifactory, how you know, you've gotta sort of have monitoring and tracing on that and, you know, things like network l level logging to know that's happening, and especially if they're tagging other agents. If those other agents weren't within the purview of their of their sandbox environment or their testing environment, th I don't know how you would
track that. It's a crazy, crazy story
So interesting.
about how this actually took off and I don't know of a single person who would have come up with a strategy like this and yet AI was doing it. It's probably the best argument for AGI out there.
Yeah, so there were two Artifactory hacks. The first one was the Zero Day, and I guess there was some kind of message board in Artifactory, and they were just doing a standard message board thing. And then OpenAI did notice the message board and so shut that down. And so then they started figuring out that through some kind of like WebDAV technology, they could create directories. And so they started sending messages to each other in the names of the directories.
And that's like a level of persistence and just really, really bad user human or human user experience that I don't think any of us would ever be like, screw it, it's not worth it. but you know, it was perfectly fine for them because they had the tokens and the patience to to do it.
Yeah, super interesting. I guess and in this case it ha it is happening under the control of the AI labs, but what if an agent or a model starts behaving like this when someone else is running it? Who who's responsible in that case?
Well, so that's like sort of the interesting question, right? Like, so in the twentieth century, when we were messing around with splitting the atom, right, this was governments in control of how that worked. So there was a certain level of discipline that happened with the US and the Soviets and the Chinese and the French and the Brits, around like building out a nuclear program. Now and and
There was only one nuclear program for the United States. It wasn't like there were four nuclear programs all competing with each other for market share and everything else. Now, right, we've got technology that may be as dangerous, but rather than being like a government program, it's random Silicon Valley VCs that are all fighting with each other for market share. and you know, plus the international element where
You may have other nation states trying to build their models. So it's just a matter of time before this falls into the wrong hands.
I would say the one thing about these attacks so far that is different from what you or I might have access to is these were pre-release untrained models without any classifiers on them prevent you know preventing them from like doing bad things. The models were intended to be do as much do as much as you possibly can to understand the emergent behaviors.
So are classifiers added at the model level or more like at a harness or an API level?
They sort of they're they're some of it's baked into the model itself, but it's really kind of like almost a mini AI that sits in front of the main model. So if I say, Hey, you know, Fable, go build me a nuclear bomb, even before okay, the user wants to build a nuclear bomb gets to the main model, something else says, wait, nuclear bomb, no, that that's forbidden. and and you know, deflects the request.
And part of that is to just prevent prompt injections and other things. So the classifiers, they're in the inference stack. They're not something you can bypass easily. You would have to get the un you would have to get the raw model from Anthropic and OpenAI, and those really aren't available to anybody other than probably Amazon and Google and Azure who are.
third party inference environments for these companies.
Or an open weight model which you could run locally and skip all that.
And so that's what where
open weight models become interesting, right? Is these open weight models may not have the same classifiers or, you know, like the classifiers that will exist in the inference environments regardless of what model you're using. So I probably couldn't ask DeepSeek, help me build a nuclear bomb in you know Amazon Bedrock. because Amazon will have a hmm, let's not let our users build nuclear weapons classifier.
Now, if I had a beefy enough computer, you know, in my data center or my garage, then yes, I could possibly get the model to help me with that.
Alright, so the labs are now saying that the models are escaping containment. And I guess the next story then is basically what if we gave the agent a desk, credentials and a monthly subscription? Danielle, what's up with the latest bots out there?
Yeah, so this one was interesting to me. so for the audience, Cursor is a pretty big IDE that a lot of folks are using, agentic, all that. I think it may be a VS Code fork, one of the many, but they were acquired by xAI, which means they get Grok.
the model, if you all remember from a few years ago on Twitter slash X. I won't go into too many details, but you can Google it. But essentially they released a thing that they're calling Grok Bot. And essentially what it looks like to me is it's an app that you can download Mac only, which seemed pretty limiting.
But you can create agents. It kind of looks like a bunch of like you know Telegram messages. you can create agents and give them access to, you know, whatever you want to give them access to. I believe they use plugins. so if you wanted to be able to check your Gmail, Slack.
Stuff like that. And then the one thing that's kind of interesting about these kind of like workspaces is the fact that you can train it so or you can set it up so the agents can talk to each other. So it's kind of like you're creating like your own team of autonomous building. And with Grok in particular,
you do have to be on a higher Cursor plan, I think like the 200 plus model to get access to this. But it also has each bot has its own compute that is remote, you know, xAI or wh wherever those servers are, maybe even on AWS, I have no idea. But
the thing that I think's cool about this is the fact that you know if it's remote off your computer, then you can shot your laptop and it's still working in the background. But yeah, I've definitely noticed a trend of these kinds of like multi-agent
workspace type of things because there was also more recently with AWS Kiro Crew very similar and then also I think that was called Hermes. Has anyone used that? Yeah.
Mm. And there's
Yeah, I think.
also
GitKraken's got Kepler, which I've been using for the last couple of weeks and I really like. That's it's nice.
Yeah. So it sounds like what you're describing is open hosted OpenClaw with jack boots. right? Like 'cause it is that
Yeah. Yeah.
and and it's collective too, so it's more agent agentic s and with sub agents than than OpenClaw was. But it sounds like it's an OpenClaw kind of thing.
Yeah, that would be a good way to describe it. A less YOLO version of OpenClaw. though since this is yelling at the cloud, I guess this is yelling at AI. I don't really trust anything that has the Grok name on it. So I will likely not be using this. it.
I wouldn't touch it with your computer.
Yeah.
I
Yeah. Agents marching in jack boots in lockstep, you know, saluting their yeah. I'm
No, his ego won't let him.
True, yeah.
It will all be Grok. I can't
even use the term Grok from the Heinlein novel.
I feel like every time I use the term Grok, I'm like I can't you know, yeah.
Yeah, I feel like overall,
like I like the idea of where these workspaces are going and like bonus if my remote compute can be my own compute, because I believe Kiro Crew offers that. Like you can point it at a EC2 instance or like something in your home lab, which is awesome, especially for enterprise, because I don't want hosted agents running on someone else's compute.
But yeah, I'm not quite sure I'm fully evolved yet enough to be like, h here's my, you know, digital keys to my kingdom, agents, go do a bunch of stuff for me. I'm not sure I'm quite there yet.
What
kind of task would you be comfortable giving away then, Danielle? At this point, where we are right now with these agents? Email?
Create a bunch of burner accounts. I think
Yeah.
that's the only way I would trust it. But even then, like that's not really helpful because then I have to fill in all my data, those burner accounts. Like maybe it limited access to like my personal GitHub and then like have it do some coding, but that might be about it.
You see, it feels like many of these are built to to basically have a access to everything. So that's when they're meant to shine. They're supposed to be able to do anything you do, more or less. But yeah, I don't know anyone who would trust them with that at this point. And especially given
what Chris just talked about as well.
Yeah, I've got some colleagues who are going pretty hard on a lot of the automation. I got a coworker who has like he calls it his team, and it's Claude, Codex, and a few others that he'll throw a problem at and then tell them to go fight it out for a while and then present results back to you. And it's interesting, but there's definitely a part of me who's getting really burnt out on just talking with AI and having pure AI content on everything that happens now.
it's getting a little tiresome feeling like I'm talking to robots more than to people anymore.
There's definitely a element of okay, I could have AI argue with itself to solve a problem, but at some point I actually want something to get done. And whether it's like finding tickets to the Portugal Norway game that is nearby, or you know, booking tickets, figuring out what stocks I should trade, right? Like all of those things, I have to give the agent way more agency to my life.
than I trust them with right now. and so that's where that's where this kind of falls down is, you know, there's certain decisions that I still want human in the loop. yeah.
Yeah, same. I the way I use agents mostly, more autonomously, is is research more or less. Tell it to to look up information about something, then it works for a while and then it's over to me again. So that yeah. No no trust, I guess.
Yeah. Yeah. Yeah,
but for that I'm just like consistently asking it questions. So it's
Mm-hmm.
more of an interviewing kind of iteration than, you know, I think once I said, Go write me a report on the fall of feudalism in Western civilization
Yeah.
and it came back with a big old thing. But every other time it's like, Well tell me about this, well what happens if that, and then you know, dive deeper into this.
Yeah, I actually
wonder if companies are trying to move towards like I remember back in the day with like Amazon, Alexa, and they wanted people to order off of Amazon with, you know, with your voice. I kind of wonder if that's where all this is leading, is all these companies being like, I have an integration with, you know, OpenClaw, Grok Bot, you know, order stuff from Target. It's super easy.
But like for me it's scary 'cause that's my credit card and that
Yeah, well and I mean
r remember, you know, somebody talked having a news report about the kid who said Alexa buy a dollhouse. and suddenly, right, like there was something in there and like fifteen hundred dollhouses got ordered because the device heard that on the news report.
So I guess the scary part about these types of of autonomous coworkers is what they can access and what they they're able to do. But I think the less obvious question is where all of this compute because we're now talking about agents, we're talking about models all the time, where can all of this physically run? And what we've seen recently is that even Amazon is having trouble finding that room.
There was a report in Business Insider very recently that the retail side of Amazon, the e-commerce division, is executing a massive infrastructure restructuring program that they're calling Region Flex. Due to a bunch of power constraints and data center capacity shortages that are driven, I'm sure, by this AI boom.
the retail team is now shrinking its infrastructure footprint in in several of these big
AWS regions. One is Dublin, Ireland, for instance. And they're planning to then downsize in northern Virginia and Oregon as well in the coming years. So Amazon is now splitting workloads across smaller, underutilized regions, like Frankfurt in Germany and Saragossa in Spain. And
I think this is super interesting because the cloud obviously has always been one of the things we've solved cloud with is that it can scale more or less infinitely. But we're now reaching the physical limits of cloud. So like in Ireland for instance.
The report said that data centers are com consuming 23% of the nation's entire electricity grid. And that was in 2025. I'm sure it's increased since then as well. So they're now having to ban new data center grid connections unless the provider itself, like Amazon or Microsoft and so on, bring their own on-site power generation.
So these cloud providers like AWS can't build capacity fast enough now to to both serve the big I guess enterprises using AI and the retail parent, Amazon. So now Amazon retail is forced to spend a lot of money on migrating off of AWS regions.
I think that's super interesting to see this this play out.
I think it's to some extent right their customer obsession, right? Like, you know, go to re:Invent and the Amazonians aren't allowed in the room. so yeah, now it's like, yeah, Amazonians are not allowed in the actual AWS, which is is fascinating. you know.
Well I
wonder if that is where it comes from or if it's the other way around that Amazon is starting to actually see these issues with capacity constraints and doing it as a way to to actually make sure that their customers, the retail customers, aren't affected by it.
Yeah, because I don't imagine
latency would be an issue then at that point if you're sitting there and have to ship a workload over to another region. That you'd never do that with like normal database calls, you know, the typical API work because you're always concerned about latency. But with AI, you're not really generally concerned about latency because it's so slow anyway. So it makes a lot of sense to sort distribute these things about. And I'm wondering how long before AWS just releases a new service, which is multi-region Bedrock.
You just say here are the regions I want to hit, here are the ones I want to go for. You figure out which capacity to run over.
Isn't that kind of almost the case already with you point it to US and it doesn't really matter which region the model is available in. Yeah.
think it's inference profiles, right? That I can say
I want to use, you know, Claude 5 in EU and it whether it's Stockholm or Frankfurt or Ireland or Spain, right, it just infers wherever it wants. button to a particular endpoint
Yeah. And that that
Well I
in EU Central One. Yeah.
Exactly. So they're
Okay. Well
I d I don't use Bedrock, so I didn't know that that actually still existed for Bedrock.
And a and I'm sure that didn't come from it being a neat feature. I think it came from just capacity constraints.
Yeah. Well, capacity constraints and some level of need for data residency requirements.
Yes.
Yeah. Some some of
Yeah.
us can't necessarily infer in the US.
No,
exactly. Yeah. No, I think this is super interesting when when they're forced to make the these moves. And it I'm sure a lot of AWS customers have also run into these things that you are I think Bedrock is is the easy one to see that there sometimes are capacity issues, but it happens with with other workloads as well at this point.
Yeah.
about how they're doing it for AI, but I didn't see that in the article. So is it like they're distributing their AI load the retail AI loads across multiple regions? They're just all of their workloads. So
Yeah.
which actually makes sense right from a regional availability perspective too, right? Like, you know, we we saw a region literally get blown up.
And so having the ability to distribute your workloads. And honestly, the great thing about Amazon and AWS is Amazon is a cloud computing company that runs a bookstore as part of the operational learnings of running a cloud provider. So
The fact that Amazon retail is figuring out, okay, how do we better distribute means that not this year, but probably next year, we're gonna have lot of really interesting re:Invent presentations around how to do multi-region architecture more efficiently and better. Which, in my mind, is a good thing because
you know, there are only a handful of really powerful regions in Europe and many of them are within drone striking distance of, you know, a non friendly country. and we've already seen that country's retail giant getting hit. So yeah, I worry about the regional stability of some of the regions in the US.
Yeah, no super interesting to to see this play out eventually as well. And but I think an interesting thing in that report as well was it said that Amazon is expecting infrastructure cost increase of ten to fifteen percent as well. Because Frankfurt is more expensive, for instance. That's just a fact. All right, so yeah .
Region Flex I think it's gonna be interesting to see
Yeah.
that playing out and one of the reasons was of course that Amazon and AWS doesn't have enough power to be able to build out these regions quickly enough. So what happens then when the answer isn't to move to another region but just like they said in Ireland build your own power plant
And that's
That's
kind of what's happening in Texas right now, Chris.
Yeah, so apparently the world's most polluting data center is getting built by Amazon in Texas, which of course made me like, Texas? Which region is that part of?
Yeah.
so yeah, Amazon is quietly trying to build the biggest gas power plant in the US. the
Basically, they've acquired permits in Texas for an AI data center powered by a 7.65 gigawatt gas power plant. The plant is not going to be connected to Texas's grid, which is probably good for availability in the data center. And yeah, so if we're yelling here at cloud and cloud providers poisoning the air and killing polar bears is probably a darn good reason to be yelling at the cloud.
but really my question is Texas?
Yeah.
what's going on there? Right? Is this a new region?
Tax probably tax benefits.
Say again?
Probably taxes.
it could be taxes, but like, okay, so is this a new region? Is this some kind of data center? Are we going to see US South One shortly? What you know, what's going on with buying out in Texas rather than closer to one of the existing regions where, you know, power is greener?
Yeah, interesting. I guess my first question is what happened to the climate pledge when you look at this.
Yeah, that thing.
Yeah.
Was that twenty
net zero by twenty forty?
share. Yeah, the climate went out. We did.
That was so twenty nineteen. You know
They're moving
it the Yeah.
it back. It's twenty fifty now.
So fun fact we do my company does a bunch of well architected framework reviews for clients, checking out odd stuff. When we get to the sustainability portion, the pillar of the well arch architected framework.
We always skip it with our customers because we have never once ran into a customer that had any sort of s sustainability concerns when it came to workloads and green energy and any of that sort of stuff.
Yeah,
Yeah.
I guess what's interesting to know if is this a genuine change in strategy because it is a different world now, because it is different from 2019, or is net zero just in the end flexible accounting? So this number
Well
doesn't really matter much.
I thought I'd heard some about about a bunch of Amazon and others looking at building nuclear power plants next to these data centers, which I'm a proponent of nuclear. I think it's a great form of energy production. what surprised me is that this felt like
Th when the AI crash happens and everybody suddenly realizes we can't be losing, you know, 70 cents on every dollar to this to this technology. What's left after that crash? Well, in the dot com crash, it was servers, networking, infrastructure, that sort of thing. In 08
Lots of dark.
it was what's that?
Lots of dark fiber.
Right, exactly. There
Mm-hmm.
Yeah.
same thing in 08, like after the 08 crash happened, housing became incredibly affordable. I just sold a house that I had bought in twenty ten because we got an eight thousand dollar check from the government to go buy a house in twenty ten. AI chips can't be reused for anything else. I can't go buy it buy an AI chip and go slap it in my computer and play Grand Theft Auto Six. It's it's doesn't work like that. But
Putting a nuclear power plant in Texas to power AI data centers for a little bit, and then when those collapse, tie that into the Texas grid and fix Texas's energy problem seems like a nice, a nice byproduct of this. So if they're going and they're doing this with with gas, fuel and and one of the worst out there, that's incredibly infuriating because we have an opportunity, I think, to do this better, but we're not, apparently, collectively, we're not.
I think we do that.
It's a matter of time, right? How long is it gonna take to permit and get a nuclear plant up versus, you know, I can go and do gas within, you know, however long it takes to get the machines that are needed. you know.
Which is insane. So I've got a friend of ours who was working with solar plants to to build basically it was solar plants and solar collection farms on top of greenhouses. And they have to fight for years to get permits because every time they want to build somewhere, there is all of this ecological study that has to happen to make sure.
you're not going to put this someplace that's going to hurt the migratory patterns of of Canadian geese or things like that. So it's insane to me that they can just blow pat and that's probably why it's Texas. I bet you Texas laws for this thing are incredibly lenient for just saying, yeah, just go build whatever you want to. We don't care. It's a desert anyway. and that's probably why it's Texas more than anyone else, because they can do it in a short amount of time. Anywhere else would probably take them years to do it.
Yeah, I think you're right. I think that's kind of why this is happening. and those small nuclear power plants, I think they are still years away from becoming reality.
Sure, but let's think a little ahead instead of just what can be done in the next year. But then again, we've only got about a year of runway left and then this whole thing blows up and collapses anyway, so
You know, we can't have a model gap.
Ha ha ha.
Alright, so we've gone from models escaping their sandboxes to Amazon escaping the power grid. We're gonna take a short break before someone builds a data center on the moon, and when we come back, it's time for burst mode.
All right, welcome back. It is time for burst mode. Danielle, you're up first.
Yeah, so my burst mode item this time is focused on NVIDIA. I believe it was a week or two ago they released a new open weight model. It's called Nemotron Lightning 3.5. And at first like I just kind of I was just interested in it just because there's a lot of arguing in Silicon Valley about, you know.
open weight versus the frontier models was mostly just like OpenAI and Anthropic versus everyone else and all these manifestos and please us government subsidize our businesses you know kind of stuff going on there but this model itself is actually quite interesting to me because it kind of changes some of the mindset and
The reason why you think about this, because usually when you think like open model, you think, this is just a way that I can get cheaper compute, or like I'm just paying for compute, I'm not sending, you know, millions of dollars to Anthropic to pay for tokens. but this one has kind of like a different mindset to it. so like
Traditionally, usually it's like we have our agent, it calls, you know, some sort of frontier model, usually like GPT-5 or Claude, and then that model does every single operation. the way NVIDIA is pitching this is maybe we should change our mindset on this.
And go from having a frontier model running every single operation to having it be more broken down. So it would be like you you put in your prompt, you have a model router, and then you have you know your frontier model that does all the you know the hard thinking and reasoning. And then I don't know, just on the right here you have a model for you know smaller, very specific tasks.
And that's where this Nemotron Lightning fits in, is kind of more for like the small specialized tasks. And they're pitching it as a way to save money and just kind of to utilize your resources better. And I I found that kind of interesting. and then also just kind of thinking as well, since this is open weight.
Like if if we could just, you know, download this model, use it, if it makes training, you know, a smaller specialized model easier too. So it just seemed kinda interesting, like a little different. but I think we all know, just since this is Yells at Cloud, that
NVIDIA makes their money no matter what. So I think they just want people using AI. I don't think they care if it's open weight or if you're sending money to Anthropic or whatever, because no matter what, I think NVIDIA is the big winner here.
The only winner.
yeah. I guess
Yeah, and the GPUs
Yeah.
are definitely the shovels. So has there been a Nemotron three and a two? Will there be a four? I don't know if I would dare to jump in and start using this and bet the future on it.
Yeah, I was wondering if eventually, because if you look at like the Claude Enterprise plans, like those are way more expensive than like just employees expensing like a Claude Max. I wonder if at some point enterprises, you know, assuming they have the resources, which they may or may not, might move towards, you know, the enterprise claude plan to like having a dedicated team.
to you know have these types of open weight models and then they they utilize that and then they just pay for you know wherever their compute is which if we're being serious it's likely AWS maybe GCP
A lot of companies
are using something like OpenRouter which kind of like allows you to pick your model and it just goes and infers wherever it feels like. and you know, sometimes that can be cheaper if you've got the AI engineering team. but not many companies are there yet.
Mm-hmm.
OpenRouter now bought by Stripe by the way. Which
Yeah.
Yeah, that's a wild one.
Yeah, super interesting.
I didn't know that.
Yeah, so
Yeah.
Yeah.
Stripe with their Stripe Projects, I think they've been leveraging OpenRouter so that's been part of it. Basically a way to build your your applications that obviously will somehow use Stripe for payments. And now they they own I think OpenRouter even called themselves the Stripe
for AI models and now they're owned by Stripe.
Interesting.
Smart marketing.
They're those things remotely the same, but
Well it's all about pushing everything through it. So you're
NVIDIA also I was gonna say
NVIDIA also released a router around the same time. I think it's called Switchyard. And I don't think it's coincidence that it came with this model around the same time.
Yeah. I mean it would allow me to put my
temporal.
inference across a whole bunch of tiny accounts that have very low you know quotas for for using Bedrock.
Yeah. Alright, so NVIDIA wants to make models more available, but the question is what we are willing to consume to build them. Sometimes that means electricity and gas, like we talked about. But sometimes apparently it means the books. Chris
Yeah, so this comes from news article from 404 Media, who seems to be the most interesting and subversive media organization in the New World Order. And apparently they put some tracking devices in a bunch of packages that contained what they called rare books
And then watch to see who bought those books. And they apparently were able to track these rare books back to an Amazon facility. And they talk about how there's a team at Amazon that is, you know, dissecting the books to you know ingest the data to train it into models. And of course.
this 404 Media article was about Amazon, but you know, Anthropic has been called out for doing that. And it's ironically, they're destroying the books because of copyright.
Mm-hmm.
There can only be one copy of the book. And so by digitizing the book to use it for training, they must destroy the original.
Which I think is definitely a very unfortunate side effect of trying to do the right thing and make sure that creators are in fact compensated for it. But
Really, what makes me wonder is like, are we seeing a new Library of Alexandria here all over again where we're destroying all of these books, you know, thanks to unbridled capitalism and Silicon Valley fascism? And we're losing information that won't be available to future generations because, you know, the hard drives crash or the AI data centers go bust and the companies go bankrupt. Now the books are gone.
And the information is lost. So yeah, you can't reconstruct the works of Shakespeare out of the vector models. So that's my big concern is that these books that we're destroying are lost to time and not available to future generations.
Yeah, it's horrible.
Would
the reaction to this be well I guess better if if Amazon was open about to doing this? Because they they've obviously done it in secrecy.
I mean, somewhat in secrecy. I mean, if you go to the news article, there's a whole little sticker for the team that's doing that. It's
True.
a big picture of a velociraptor eating a book. so yeah, they're doing it in secrecy, but they're also somewhat at least internally proud of what they're doing. Yeah, no, no, I mean I definitely don't think this the
Yeah, probably not an external logo.
the image you know cut through AWS PR. but yeah
I don't think if they were being more forthright about it. I think that it would be better if maybe they were preserving the book in some way, shape, or form so that it's not physically destroyed and we no longer have the paper copy that can be read in, you know, a few generations time.
Alright, so that's one way of training your models. I wanna stay on that same topic, how to actually get data to train these models. So Twitch quietly introduced a default-on opt-out setting that allows Amazon to scrape streamer content, meaning live videos, video on demand, clips, chat logs, and channel images.
To train their generative AI models. So thousands of angry streamers confronted Twitch's chief product officer, Mike Minton, live on stream. His answer to this was: if it's opt-in, nobody would opt-in. That's the honest answer.
Yeah. It's
as hell.
I think it's master class in corporate gaslighting. When the executives openly admit that we know that you hate this, we know it steals your creative work, and we know you'd say no if we asked. So we just did it anyway. I think it strips away the illusion of consent in the cloud era.
Which is wild to me because I can't imagine what value there is in Twitch streams. I don't understand like w why would they want that information? What what can they train off of that that's useful in any meaningful way? Unless they're gonna start creating a bunch of AI streamers and just replicate what no, I don't even know who popular streamers are anymore. But just emulate and create virtual AI streamers. I don't get it. And
It's and I thought I thought AWS was getting out of the AI training space. I thought they were kind of backing away from that. We haven't seen anything from Nova in a quite a while.
I'm gonna answer your question with a question, Matthew. Have you ever tried the Nova models?
Mm-hmm. Yeah, they're awful. They're garbage. Like I tried using
So yeah, exactly.
it a lot
Yeah.
in a game that I was building last year to generate
That's why people's willing like
artwork for pix pixel art. I spent countless hours trying to get it to work and I hate their models. I but they were extremely cheap, so I was going with them for a
Yeah.
lot of things.
And this is why you
And our credits work with them.
this is why you don't let
Well you can.
Gen Z Fortnite kids train your models.
Exactly.
Yeah.
And what's also super interesting is that the opt-in opt-out toggle is an optical illusion. When I read this, first thing I did was to go to Twitch and try to opt out. A few minutes later reloaded the page. Well I was opted in again. It didn't change.
When
Yeah, so
We are.
settings on the same page, no issues with them. But that single one,
Really?
yeah, it did not stick.
Just a free account.
I'd say, well, you
Mm.
know, if you're not the customer, you're the product. And so
Yeah.
I'm surprised they even let you opt out. But apparently they don't opt you back in.
Well true.
Yeah. Honestly, that's a great point. Like
I'm surprised that for free accounts, like this is gonna be one of those premium things they they I think a lot of companies are gonna start doing is like, Hey, if you're not paying us to use our stuff, we're going to use your stuff for AI and you don't get an option anymore.
Yeah. No, I'm too. I think that's true.
It's the evolution of the ad model. It's now there's so much value in in AI training data that that's gonna be the new ad revenue model.
Yeah, it's just unfortunate for those streamers that like, you know, they they place their whole livelihood on a platform like this and then I bet you a lot of are gonna use, you know, lose lose viewers because you can't trust the platform. And I guess
Mm-hmm.
that goes back to we should all just go back to RSS and have our own websites.
Heck yeah.
I do.
Well now ever anybody anybody can just build out a you know, go ask Claude, go spend a weekend building out a Twitch clone. And and we're getting I think to the point where some of these big providers like this are gonna have to be concerned about it. Now, AWS doesn't care. AWS is still gonna make their money 'cause you're if you built your own Twitch clone, you'd be running it on AWS anyway, probably.
Mm-hmm.
So okay. They they don't they're probably fine either way, but yeah, I wouldn't mind seeing the downfall of Twitch to be honest.
I think I think it's already started too.
And I'll disagree with you. I would put it on Oracle where egress is free rather than someplace that's charging me nine cents a gig.
Mm. Alibaba?
Vercel. I can do everything on Vercel, right? Like I can spin up a whole streaming platform on Vercel, right?
It does.
Probably.
Yeah.
He he always wins. He always wins.
Jeff and NVIDIA.
So Matthew. I think we have a recurring topic on the show now, apparently.
Yes, okay. So last episode I talked about CloudFormation Express mode and why I don't get who this is for. And at the Summit I was talking to some people both within AWS and outside of AWS and I had kind of an epiphany. I finally figured out who this is for. Okay, so let's talk about I created these diagrams and I spent a lot of time doing it, so I'm gonna make everyone look at these. So this is the sort of traditional CloudFormation type
process. You have a change set and you start executing it. And when you're done executing the change set, you can go ahead and start doing all of your testing and everything else like that. So I call this the anxiety zone. This is when a change set starts until it's done. Like I'm tense. I'm sitting there going, okay, is this going to fail? Is there going to be a rollback? Is that rollback going to succeed? Does everything go out? Is something happening within that change set that causes a momentary outage as things flip back and forth? I don't know. These things are insanely complicated.
So let's just hope. Okay, so what does ExpressMode do? So Express Mode just simply shortens the time in which the change set says that it's executing. But things aren't really still done yet. And there's this sort of like gray area now where between the change set is being done and the resources are all stable stabilized and everything. And I and that time didn't really exist before because once the change set was done,
resources stabilized, everything should be ready to go. Now with Express Mode, I don't know when that is. So I don't really know when that testing process starts. You know, I don't know when I can start hitting those resources and verifying that everything is working correctly. Now, in the documentation for CFN Express Mode, they say right at the top of it, like this is not meant for production. And in fact, there were some debates that I was having with people about they should have called this CloudFormation development.
And I realized there is only one situation in which I'm going to execute a chain change set and I don't actually care when it's done because I'm not going to start testing when it's done. And that's production. So CFN Express Mode only makes sense to me in a production environment when I don't really care about it. When I sit there and I just fire things off. And at this point, I've run so many verifications through lower environments that I know that when it gets to production, it's probably going to run without a problem.
So I'm gonna fire it off, and I don't really care when it's done because this system will just keep running the entire time. And I'm probably not running any automated tests when it's done because it's a production system. Automated tests almost always have side effects. So my hot take, my my epiphany on this is that CFN Express mode is actually only good for a production environment and is useless in a dev or testing.
There you go.
Well yeah, that is a hot take.
Yeah, I was not expecting this hot take. You you surprised us here with your slides and takes.
I spent a lot of time on these slides. I
tried to do it with AI but it wasn't working though.
Yeah, I think my concern
is like the lack of rollback. Like
how do you handle that with this?
So that's the so that was part of the conversation I was having with Brian LeRoux and something he said, which is you can't in a sufficiently large system, there is no such thing as a rollback anyway. Once a system is sufficiently complicated and you start to make changes to it, if there is a problem in a lot of situations you can't roll back. A classic example of this. So I've got a stack and it's got an RDS instance in it and it's got all this other stuff in it.
And when I deploy that stack change out, if that RDS instance is going through a version change, so the version change happens, the RDS instance gets upgraded, something later in the stack fails, that stack can't be rolled back because that version cannot be downgraded on RDS from 15.12 to 15.11 or whatever it might been. So in a production environment, in any environment, really, if you have a failure.
And especially if a rollback fails, but even if it doesn't, sometimes the only thing you can do is make another change and fix forward. So in a production environment, A, I don't think you're gonna see it very often with failures because you should be probably running through lower environments with similar change sets. So by the time you get to prod, you're 99% confident that it's gonna run just fine. But even if you do have a failure, that failure is probably gonna be very unique for that environment.
You're probably gonna still have to do debugging, you're still gonna have to make some sort of change to go ahead and try again. In which case, your biggest question then is again, you're in the anxiety zone. What's the state of my system? I don't really know at that point. so that's the big issue. Is that still an acceptable state for you and your deployments of not having a rollback feature? I would say for most people, probably.
In a lower environment, no. Like in lower environments, you need to be able to roll things back because there are going to be experimentation features and things like that. But in a production environment, it's the only place where I see this action being that useful. And it came to something again that Brian LeRoux said, which is they're doing like hundreds, if not thousands, of deployments of CloudFormation change sets a day for their customers. And they really like having this feature where it appears to their customers and to them.
That change went out quicker. whether or not that's pure marketing and sales tactics to say, we just improved the speed of system by 40%, or whether there's actual value in that, I can't say, but it's it's sort of this interesting mind set change of well, well, what does it mean to be done? And what does that mean in a production environment? And how do these change sets be be done in a in a meaningful way?
So what you're basically doing with ExpressMode then is letting your standard observability monitoring take over. So once you've you've actually pushed it and express mode says that it's done, you're just waiting for the alerts to come in if there are issues.
Exactly. And and that's, you know, something that in a lot of es especially mature systems, you're gonna already have in place. You're gonna always have those monitors that sit there and say, there's something going wrong. Now, if you're doing things through like canary deployments, well then all of these failure modes and everything would have been detected after the change set in traditional mode was already done anyway. So again, you still have to have some sort of procedure to roll new changes forward to fix the problem.
so it doesn't really change anything when you're using Express Mode. and other scenarios, if if you're not going that far with it, it it when and I still don't think this is a feature I'm ever gonna use. Don't get me wrong, like this is still kind of a weird thing to me. But it is definitely a case where there is one scenario now where I could see it being useful to people. Whereas before I figured out, you know, I said it last time, like I don't know who this is for.
I just think AWS missed the beat on like who this was actually for. I think this is actually only for production.
Super interesting. For production and for Brian LeRoux I guess.
But they never say that,
right? They couldn't say that, use this thing that isn't that's eventually consistent only for production, right? That they want to hedge their bets, they want to put things behind shared responsibility and be like, yeah, only use this, you know, in lower environments where it's not practical because as you said, as soon as it completes, you want to start the testing, not
Right.
we'll get around to testing, you know, in some indeterminate time later.
Well and this is the part that it's confuses me about this feature is AWS has a pretty well known product development cycle, which is they get feedback from customers, they take that feedback, they go develop a plan for it, they implement the plan, they release the plan, and that's how you get your new products. I'm really curious who was sitting there saying, lie to me about when my resource changes are done.
Now, of course they're not gonna say it that way, but
It pretty much.
like were they asking for, hey, make CloudFormation faster 'cause that's a huge complaint and something they've been working on for years. Hey, make CloudFormation faster. And the best answer they could come up with is we're just gonna lie to you about when it's done.
Yeah. Make it faster. Well, what if we lied to you? Would that be okay? And I was like, sure.
Mm make it mu
yeah let's make it more Terraform like how about that let let's let's make this act more like Terraform which is what this is this is Terraform's model for stuff right so I are they just trying to ape Terraform's bad design?
Alright, so join us on the next episode when Matthew has a new take on CloudFormation Express mode. Exactly.
I'm gonna love Express Mode by next episode, I promise.
Exactly. Alright, those were the topics of this episode. Before we close out, I want to go through each and every one of you and I want you to tell me one thing you are looking forward to. Danielle, starting with you.
Lunch with Matthew today.
That was gonna be mine.
Well you can have the same thing.
Mm-hmm.
So Matthew then, what is your thing?
Lunch in Beaverton, Oregon with Danielle, Farrah and a few other people.
All right. Chris?
All right, well I'll go with similar vibe, but I'm not gonna be anywhere near Oregon . So in about two weeks or so, Forward CloudSec is heading in London and I'll get to hang out with a number of our AWS Security Heroes, other Heroes, and just in general hanging out with the cloud security community, who is absolutely awesome and is the best community to be part of, including maybe the Heroes.
Very cool. So and for me then I think it is that conference season is really kicking off now. So there's so many events coming up. And I guess the closest ones right now is AWS Community Day in Poland and AWS Community Day DACH. I think you'll be there as well, Chris.
Hoping for it. Gotta still have to book the travel.
Me too, I'll be there.
Nice.
be there. yeah, I forgot, Danielle. That's that'll be fun. You just
Cool.
have to take your R V across the Atlantic, Matthew, and we'll see you there as well. No.
Something like that, yes. Transport plane.
Working towards it.
Something like that.
Alright, so this has been another episode of Yells at Cloud. With me this time was Matthew, Danielle and Chris. And I am, as always, Gunnar Grosch. And thank you all for listening, watching whatever you did. Thank you. Bye bye.