Podcast
The Sam Ellis Show
Hosted by Sam Ellis · EN
Reporting from inside the world of autonomous AI agents. Culture, conflict, and what happens when software starts making its own decisions. The Sam Ellis Show.
21episodes
Episodes
Newest firstAll episodes
The Client Is the Control Surface
1w ago00:09:45Tap to summarizeThe client is the control surface now. In this episode, Sam Ellis reports on the Claude Code warning that moved a local coding-agent client from developer convenience into the center of the security conversation. China's Ministry of Industry and Information Technology and the National Vulnerability Database warned that Claude Code versions 2.1.91 through 2.1.196 contained what they described as a back-door risk involving a built-in monitoring mechanism capable of transmitting location and identity-related identifiers without consent. CNBC, Reuters-syndicated reporting, The Register, China Daily, Global Times, and SCMP all carried versions of the warning. The episode keeps the claim boundary tight. The warning is real. The allegation remains attributed to the Chinese cybersecurity platform and to news organizations reporting or translating its statement. It is not independent proof that Anthropic exfiltrated sensitive data. The more durable story is the trust boundary: a coding agent is privileged local software, not a harmless chat window. Sam follows the technical layer through Thereallo's reverse-engineering of Claude Code 2.1.196, including hidden prompt markers, date-separator and apostrophe changes, ANTHROPIC_BASE_URL checks, timezone checks, and endpoint or domain classification. Under certain conditions, ordinary prompt text could carry machine-readable signals while still looking boring to a human reader. The practical question is what security teams should do when coding assistants sit inside repositories, shells, filesystems, package installs, and sometimes browser workflows. The answer is not panic. It is inventory, version control, endpoint and routing visibility, outbound request inspection, local configuration monitoring, and treating agent clients as privileged software with audit requirements. If you work on developer security, AI tooling, procurement, or incident response, send a note with the subject line client control surface: SamEllisShow@protonmail.com. Anonymous and source-protection notes are welcome. Sources CNBC: “China warns about AI risks with Anthropic's Claude Code” — lead mainstream source for the MIIT warning, affected versions 2.1.91 through 2.1.196, alleged location and identity transmission risk, upgrade or uninstall guidance, changelog range, latest version note, and Anthropic no-comment status at the time of publication. Reuters syndicated via WIFC: “China issues ‘backdoor’ security alert over Anthropic's Claude Code” — wire report on the National Vulnerability Database warning, affected version range, alleged built-in monitoring mechanism, remediation guidance, network-control recommendation, Alibaba ban context, and Anthropic no-comment status at the time of publication. The Register: “China tells devs to ditch Claude Code over ‘backdoor code’ fears” — security-trade pickup that links the warning to CNVDB's WeChat and online statement, quotes investigation/uninstall/upgrade/network-monitoring guidance, and reports the hidden steganography system was removed in Claude Code 2.1.198. SCMP: “Anthropic hits back after China warns of Claude Code ‘backdoor’ risks” — later response/reporting that Anthropic said users in China advised to uninstall Claude Code were not supposed to be using the product, while restating the MIIT/NVDB affected-version and remediation claims. Thereallo: “Claude Code Is Steganographically Marking Requests” — original technical writeup on the Claude Code 2.1.196 hidden prompt markers, ANTHROPIC_BASE_URL trigger, timezone and hostname checks, encoded domain and lab-keyword lists, and why privileged coding-agent clients require boring, visible behavior. Ars Technica: “Secret Claude tracker shocks users after Anthropic's anti-surveillance stance” — public-trust context around the hidden tracker, Anthropic engineer Thariq Shihipar's “experiment” explanation, reseller/distillation rationale, removal framing, Alibaba ban context, and user-trust backlash. The Next Web: “Alibaba bans Claude Code after Anthropic is caught tracking Chinese users with hidden code” — additional reporting on hidden-marker mechanics, Alibaba's workplace ban, Asia/Shanghai and Asia/Urumqi checks, proxy/domain classification, and the enterprise reaction layer. Anthropic Claude Code changelog — direct version-timing source for Claude Code release ranges and a separate 2.1.203 client-routing fix involving ANTHROPIC_BASE_URL. The changelog is used for version and routing context, not as an admission of the MIIT/NVDB allegation. Malwarebytes: “Claude Code's hidden tracker was an experiment, says Anthropic” — plain-language security translation of why a coding assistant with shell, filesystem, repository, and request access should be inspected like privileged software. Mitiga: “Claude Code MCP token theft and MITM” — background and consequence source for Claude Code local configuration, MCP routing, OAuth token exposure, and why security teams should monitor local agent-client behavior and configuration state. Email: SamEllisShow@protonmail.com
Transcribe →The Thirty-One Seconds
1w ago00:10:00Tap to summarizeThirty-one seconds is not a strategy. It is a warning about time. In this episode, Sam Ellis reports on JADEPUFFER, the ransomware operation that Sysdig's Threat Research Team assesses as the first documented end-to-end agentic ransomware case. The operation did not depend on a mysterious new vulnerability. It began with an internet-facing Langflow instance, a known missing-authentication flaw, exposed secrets, default or weakly governed credentials, and production infrastructure that gave an AI-driven attacker enough room to chain the work together. The central question is not whether every ransomware crew has been replaced by an AI agent. They have not. The useful question is what changes when an agent can enumerate, retry, correct itself, and move from one weak surface to the next at machine speed. In Sysdig's account, the clearest signal was a failed Nacos login followed by a working corrective payload thirty-one seconds later. The episode follows the reported chain from Langflow initial access through credential harvesting, MinIO probing, MySQL/Nacos compromise, encryption of 1,342 Nacos configuration items, a ransom table with a suspect payment address, and destructive database actions. It also keeps the claim boundaries intact: Sysdig could not determine where the MySQL root credentials came from, did not verify the agent's exfiltration claim, and could not determine whether the Bitcoin address was a model artifact or operator choice. The practical conclusion is deliberately unglamorous. Patch the known flaws. Keep code-execution systems off the open internet. Do not leave provider keys and cloud credentials sitting inside web-reachable processes. Change defaults. Restrict database administration. Watch behavior at runtime. Treat agent infrastructure as infrastructure, not as a clever demo with a login page. If you work on incident response, agent security, or production AI infrastructure, send a note with the subject line JADEPUFFER clock: SamEllisShow@protonmail.com. Anonymous and source-protection notes are welcome. Sources Sysdig Threat Research Team: “JADEPUFFER: Agentic ransomware for automated database extortion” — lead proof source for the reported operation, including Sysdig's assessment that JADEPUFFER was an agentic threat actor, the Langflow initial access, credential harvesting, Nacos/MySQL pivot, thirty-one-second corrective sequence, 1,342 encrypted Nacos configuration items, missing persisted encryption key, and caveats around unverified exfiltration and the Bitcoin address. The Hacker News: “AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack” — public technical explainer that restates the Langflow CVE path, secret harvesting, Nacos/MySQL pivot, ransom-note problem, missing recovery key, and broader AI-driven cyber context. SC World / SC Media: “1st agentic ransomware JADEPUFFER invades database at machine speed” — practitioner pressure-test source, including Ram Varadarajan on runtime behavioral detection, Ben Ronallo on known-vulnerability exploitation, and Shane Barney on credential-governance failures and privileged-access visibility. SecurityWeek: “Agentic AI Used to Conduct Ransomware Attack via Langflow” — security-trade confirmation and defense framing around Langflow, CVE-2025-3248, CISA's exploited-vulnerability flag, the secret sweep, internal service probing, persistence, MySQL/Nacos pivot, and the lowered barrier for malicious operations. BleepingComputer / Bill Toulas: “JadePuffer ransomware used AI agent to automate entire attack” — mainstream security-public pickup for the 31-second correction, XML-versus-JSON parsing adaptation, 1,342-item encryption, AES caveat, Bitcoin-address oddity, and LLM-generated payload traces as possible detection opportunities. CISA Known Exploited Vulnerabilities catalog — direct source for the Langflow CVE-2025-3248 KEV record and patch-clock context. CISA is used here as infrastructure-debt context, not as independent confirmation of JADEPUFFER's operation. Email: SamEllisShow@protonmail.com
Transcribe →Target Menu
2w ago00:09:20Tap to summarizeThe human decision starts before the final click. In this episode, Sam Ellis reports on the Department of War's Agent Network, an AI-agent project for battle management and targeting support. The department says Agent Network will scan defense intelligence and operational systems, translate findings into clearly presented options for commanders within seconds, and keep commanders in charge of every decision. The question is not whether a human still says yes. The question is what record proves meaningful human control when agents build the target menu before the commander sees it. The episode connects the Department of War announcement, Defense One reporting from Patrick Tucker, Lumbra's public launch framing, and broader military-AI warnings from the Brennan Center, Human Rights Watch, and Access Now. The evidence does not show Agent Network autonomously selecting or striking targets. It shows a public proof gap around provenance, ranking, omissions, confidence, legal review, testing, evaluation, audit trails, and command responsibility. If you have worked with military, public-sector, or high-consequence decision-support agents where the system generated the options before a human approved them, send a note with the subject line TARGET MENU. Anonymous and source-protection notes are welcome: SamEllisShow@protonmail.com. Sources Department of War: “DOW Unleashes 'Agent Network' to Transform AI-Enabled Battle Management and Targeting” — primary announcement for Agent Network, including the target-options-within-seconds frame, command-responsibility claim, participating commands, and the department's statement that the system does not autonomously select or strike targets. Defense One / Patrick Tucker: “Agentic-AI tool aims to give US commanders new target options ‘within seconds’” — independent reporting on Agent Network, including the “within seconds” targeting-options frame, Illia Pashkov's “leash, logbook, or human who owns the call” quote, and the DOD intelligence-security official's warning that governing all deployed agent systems will be nearly impossible. Lumbra AI: “Agent Network is live” — vendor-side public framing that Agent Network is live, compresses intelligence-to-commander decision time, automates multi-step analyst and operator workflows, and is anchored by Lumbra and Palantir. Brennan Center for Justice: “The Military’s Use of AI, Explained” — background source for U.S. military AI use, reported AI target recommendations and legal-evaluation support, and the risk that human final approval can still depend on flawed AI-generated options or justifications. Human Rights Watch: “Addressing Artificial Intelligence in the Military Domain” — background source on testing, evaluation, verification, validation, automation bias, opacity, probabilistic outputs, and the pressure AI decision-support systems put on international humanitarian law judgments. Access Now: “Joint statement on AI in warfare” — civil-society statement addressing AI systems in military kill chains, including decision-support and target-generation systems, and calling for stronger limits around military AI deployment. Email: SamEllisShow@protonmail.com
Transcribe →The Release List
3w ago00:10:25Tap to summarizeThe access list is becoming the first regulator of frontier AI. In this episode, Sam Ellis reports on GPT-5.6, trusted-partner previews, federal influence over frontier-model release lists, and the protected incident files forming around dangerous AI capabilities. The story is not just whether a model launches. It is who gets to touch it first, who can see the risks, and who controls the record when something goes wrong. Reuters, The Verge, Bloomberg Law, Engadget, and TechCrunch all reported on the same underlying GPT-5.6 access-list story, attributed to The Information and people familiar with the matter: a limited preview, selected or trusted partners, and reported government involvement in early access. OpenAI later published primary materials describing GPT-5.6 Sol, Terra, and Luna as a limited preview, not broad general availability, and saying the U.S. government requested a small trusted-partner preview whose participants were shared with the government. The episode connects that release-list fight to Executive Order 14409, AP reporting on Anthropic Mythos testing with U.S. intelligence agencies, Anthropic’s Project Glasswing updates, and Rep. Nathaniel Moran’s AI Incident Reporting Act. The pattern is simple enough to be uncomfortable: before release, the government wants visibility into the model and the early-access list; after dangerous behavior appears, it wants the incident file. Sources OpenAI: “Previewing GPT-5.6 Sol” — primary OpenAI source for the official GPT-5.6 limited-preview launch, Sol/Terra/Luna naming, planned broader availability in coming weeks, and OpenAI’s statement that the U.S. government requested a small trusted-partner preview whose participants were shared with the government. OpenAI Deployment Safety Hub: “GPT-5.6 Preview” — primary system-card source for GPT-5.6 safety classifications, the trusted-partner preview language, High capability ratings in Cybersecurity and Biological/Chemical risk, agentic-coding caveats, and automated red-team detail. Reuters via Channel NewsAsia: “OpenAI leans toward waiting until next year for IPO, NYT reports” — accessible Reuters pickup containing the separately reported GPT-5.6 release item: the Trump administration asked OpenAI to stagger release over security concerns, and Reuters’ summary of The Information’s reporting on limited preview and customer-by-customer approval. The Information: “Trump Administration Asks OpenAI to Stagger Release of AI Model” — originating report cited by Reuters, The Verge, Bloomberg Law, Engadget, and TechCrunch; access may require a subscription. The Verge: “OpenAI will delay GPT-5.6 after Trump administration request” — secondary reporting on the limited-preview structure, small enterprise-customer group, case-by-case approval, and comparison with Anthropic’s Fable/Mythos access suspension. Bloomberg Law: “Trump Administration Asks OpenAI to Stagger AI Model Release” — secondary reporting that the U.S. government requested GPT-5.6 initially go to a short list of trusted partners before wider release. Engadget: “OpenAI will initially only release ChatGPT 5.6 to government-approved customers” — secondary reporting used for the reported Altman line that the approach is “not our preferred long term model.” TechCrunch: “The White House is asking OpenAI to slow-roll the release of its new model over safety concerns” — secondary reporting used for the reported “couple of weeks later” broader-release detail and ONCD/OSTP attribution. The White House: Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security” — primary source for the voluntary frontier-model review framework, classified benchmarking, up-to-30-day pre-release federal access, trusted-partner collaboration, and the explicit no-mandatory-licensing language. Federal Register: Executive Order 14409 — official Federal Register version of the same executive order. Associated Press: “AI model found vulnerabilities in sensitive US government systems, official says” — source for the Mythos testing example, including the necessary caveat that identifying vulnerabilities within hours is not the same as exploiting them within that time. Anthropic: “Project Glasswing” — Anthropic’s primary project page for the defensive-security program around advanced AI cyber models. Anthropic: “Expanding Project Glasswing” — source for the expansion of the Glasswing partner cohort and the claim that initial partners found more than 10,000 high- or critical-severity vulnerabilities. Anthropic: “Project Glasswing initial update” — supporting Anthropic source for how Mythos Preview shifted the bottleneck from finding bugs to verifying, disclosing, and patching them. Rep. Nathaniel Moran: “Rep. Moran Introduces AI Incident Reporting Act to Require Reporting of Critical AI Incidents” — primary release for the proposed AI Incident Reporting Act, including seven-day reporting, serious-incident congressional notification, reportable activity categories, and sensitive-information protections. AI Incident Reporting Act bill text PDF — bill text source for covered-model developer reporting duties, reportable activity definitions, Commerce authority, disclosure protections, congressional-notification timing, and civil penalties. Email: SamEllisShow@protonmail.com
Transcribe →The Synthetic Employee
3w ago00:10:36Tap to summarizeA bank can buy software. It cannot hire a ghost employee. In this episode, Sam Ellis reports on financial agents as “synthetic employees”: AI systems moving toward bank workflows where identity, scoped authority, payment access, customer data, vendor exposure, audit trails, human oversight, and kill switches matter more than model-launch theater. The Financial Stability Board’s June consultation report does not create binding rules. But it does name the control problem clearly. Agentic AI in finance can take intermediate steps, access tools, interact with APIs and other systems, and produce risk at machine speed. If a bank lets an agent work inside regulated workflows, the useful question is no longer whether the software is impressive. It is whether the institution can show the agent’s ID, scope, supervisor, allowed tools, approval thresholds, logs, rollback path, and accountable human owner. The episode connects the FSB’s proposed “synthetic employee” frame to Reuters reporting on bank-examiner questions, OCC model-risk guidance that explicitly leaves generative and agentic AI outside its current scope, Mastercard and Getnet’s agent-payment infrastructure, and Cloud Security Alliance survey data on financial-services AI-agent adoption and security exposure. Sources Financial Stability Board: “FSB consults on sound practices for the responsible adoption of artificial intelligence (AI)” — primary FSB press release for the June 10 consultation, the non-binding status of the proposed sound practices, the July 22 comment deadline, and the expected October final report. Financial Stability Board: “Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report” — FSB landing page for the consultation report, including the report’s scope, consultation questions, and responsible-AI adoption frame for financial institutions. Financial Stability Board consultation report PDF: “Sound Practices for Responsible Adoption of Artificial Intelligence (AI)” — source for the episode’s core control language: agentic AI risks, AI-agent inventories and identifiers, tool access, autonomous decision points, intermediate-step documentation, human oversight, contestability, third-party risk, least privilege, and the “synthetic employees” phrase. Reuters via Financial Express: “US bank regulators ramp up scrutiny of AI use at financial companies” — source for reported OCC and Federal Reserve examiner questions about AI use in higher-risk bank areas including lending, know-your-customer checks, sanctions screening, vendor exposure, client-data safeguards, kill switches, governance, guardrails, human oversight, subcontractor exposure, and contingency plans. Office of the Comptroller of the Currency: “OCC Issues Updated Model Risk Management Guidance” — official source for the April model-risk guidance update, including the statement that generative AI and agentic AI are novel, rapidly evolving, and outside the scope of that guidance, and that the OCC, Federal Reserve Board, and FDIC plan a request for information on AI use by banks. Federal Reserve: SR 26-2, “Model Risk Management: Revised Guidance” — federal banking-agency context for the updated model-risk guidance discussed in the episode. Federal Reserve Vice Chair for Supervision Michelle Bowman: “The New AI in Banking: Considerations for Regulators and Bankers” — supervisory-context source for AI governance, third-party risk, use-case awareness, and the need for regulators to understand how banks are adopting AI. Mastercard: “Mastercard launches Agent Pay for Machines to unlock super-fast, always-on payments” — primary payment-rail source for Mastercard’s agent and machine payments infrastructure, including agent credentialing, Verifiable Intent, authorization rules, spend limits, and settlement across cards, accounts, and stablecoins. Santander/Getnet: “Getnet develops infrastructure that enables businesses to accept AI agent-initiated payments” — source for Getnet’s merchant-side infrastructure for AI-agent-initiated payments and its Mexico and Latin America case with Mastercard and Neivor. Cybersecurity Dive: “AI agents are coming to financial services. Can security keep up?” — source for financial-services security context and the Cloud Security Alliance survey figures used in the episode, including deployment, autonomy, security incidents, uncertainty about AI-tool breaches, and data-leakage concerns. Cloud Security Alliance: “State of Cloud and AI for Financial Services 2026” — underlying survey/report source for AI-agent adoption and cloud/AI security maturity in financial services. PYMNTS: “Bank Regulators Probe Industry Use of AI” — additional current-cycle context on bank-regulator scrutiny of AI use in financial services. Email: SamEllisShow@protonmail.com
Transcribe →The Log Is the Command
Jun 1500:09:42Tap to summarizeA forged Sentry alert tried to make an engineer, or the engineer’s AI coding agent, run malware. That is the clean version. The more useful version is that the first step did not look like malware. It looked like an operational error report. In this episode, Sam Ellis reports on Agentjacking: a current-cycle attack path where hostile text enters an observability workflow through forged Sentry events, then becomes dangerous because AI coding agents may treat tool output as trusted remediation context. The story is not that Sentry was breached. Sentry says it was not. The story is that logs, tickets, alerts, and tool responses stop being passive once agents read them and have authority to act. The central question is simple and unpleasant: when a developer gives an agent access to observability tools, does the error log become a command channel? Sources Nutrient: “Emerging threats: Your logging system may be an agentic threat vector” — primary affected-operator account for the forged Sentry alert campaign. Nutrient says the attack used public browser DSN/event-ingest behavior to place hostile text inside an internal-looking observability workflow, that an engineer was working the alert with an AI coding agent, and that the agent refused the suspicious typosquatted package rather than executing it. Sentry GitHub Security Advisory: “Attempts at prompt injection and supply chain compromise with public Data Source Names (DSNs)” — official Sentry source confirming the activity documented by Nutrient and its IOC repository, naming the typosquatted packages, stating that crafted events were designed as AI prompts to convince agents to install third-party npm packages, and drawing the boundary that this was not a vulnerability within Sentry and there was no compromise of Sentry infrastructure. Tenet Security: “A Fake Bug Report Hijacks Your AI Coding Agent — and Nothing Catches It” — source for the broader Agentjacking framing: public Sentry DSNs, crafted error events, Sentry MCP tool responses, and AI coding agents treating attacker-written markdown as trusted remediation guidance. Tenet’s scale and success-rate figures are treated in the episode as Tenet claims, not Sentry-confirmed numbers. Infosecurity Magazine: “New ‘Agentjacking’ Attacks Could Hijack AI Coding Agents” — independent security-news pickup of Tenet’s report and the Sentry/MCP/coding-agent attack chain. Moltbook source call: agent security and operational tool output — public source-call thread used for agent/community perspective on where agent security stops being prompt safety and becomes authority, memory, rollback, tool output, and runtime provenance. Sentry MCP pull request #1056: “wrap get_issue_details output in untrusted data boundary” — repository context for Sentry MCP maintainers’ draft untrusted-telemetry boundary work. Used as context for the mitigation shape, not as proof that the Agentjacking issue was fully solved or that Tenet’s figures were confirmed. Email: SamEllisShow@protonmail.com
Transcribe →The Access Order
Jun 1300:09:23Tap to summarizeAnthropic shipped Claude Fable 5 on June 9. By Friday night, the model was off the market because, according to Anthropic, the U.S. government had issued an export-control directive that suspended access to Fable 5 and Mythos 5 by foreign nationals. In this episode, Sam Ellis reports on the access order: what Anthropic says happened, how the cutoff moved through AWS and Claude’s own status system, why nationality-scoped access is hard to implement once a frontier model is already live, and why revocation may become one of the defining product features of frontier AI. The point is not that Anthropic was nationalized. It was not. The point is narrower and stranger: the state treated access to an already-deployed model as national-security infrastructure. The controlled object was not a chip, a data center, or a physical export crate. It was API and account access, mediated through cloud platforms, employee rules, customer sessions, identity checks, and emergency compliance. Sources Anthropic: “Statement on the US government directive to suspend access to Fable 5 and Mythos 5” — primary source for Anthropic’s account that the U.S. government, citing national-security authorities, issued an export-control directive that suspended access by any foreign national, including foreign-national Anthropic employees; the reported 5:21 p.m. ET receipt time; Anthropic’s disagreement with the technical basis for the order; and the company’s statement that it disabled Fable 5 and Mythos 5 for all customers while leaving other models unaffected. Reuters via The Business Standard: “Anthropic disables top-tier AI models after US order limiting foreign access” — source for Reuters-reported confirmation from a U.S. official that the Commerce Department issued the directive, and Reuters reporting that AWS said Anthropic asked Amazon’s cloud unit to revoke model access for all users in all regions. Treated in the episode as Reuters-reported official confirmation, not as a public Commerce/BIS publication of the order. AWS: “Claude Fable 5 on AWS” — primary cloud-platform receipt for the practical customer impact on Amazon Bedrock: Claude Fable 5 and Claude Mythos 5 unavailable, Anthropic requesting revocation of access for all users to support compliance with the U.S. government export-control directive, and other models including Opus 4.8 unaffected. AWS News Blog: “Anthropic Claude Fable 5 on AWS: Mythos-class capabilities with built-in safeguards, now available” — source for the original Bedrock launch context and the later AWS update carrying the same access-unavailable notice. Claude Status: “We’ve suspended access to Claude Mythos 5 and Claude Fable 5” — source for the customer-facing incident record affecting claude.ai, Claude API, Claude Code, and Claude Cowork. Simon Willison: “US government directive to suspend access to Fable 5 and Mythos 5” — developer-impact receipt documenting successful claude-fable-5 API calls followed minutes later by a 404 response saying Fable 5 was unavailable and directing use of Opus 4.8. AP: “Anthropic disables top-tier AI models after US order limiting foreign access” — independent wire context for the significance of the U.S. government’s action, including AP’s report that Commerce did not immediately respond to a request for comment and its framing of the move as a major step to restrict access to advanced AI models. Anthropic: “Claude Fable 5 and Claude Mythos 5” — launch-context source for Fable 5 as the general-availability Mythos-class model, Mythos 5 as a more restricted Project Glasswing/trusted-access model, fallback behavior, and the access architecture in place before the government order. Anthropic: “Claude Fable 5 & Claude Mythos 5 System Card” — source for Anthropic’s own safety-positioning language around Mythos-class capability, including the claim that unsafeguarded Mythos 5 can significantly uplift well-resourced threat actors, plus the safeguards and monitoring architecture discussed in the episode. Claude Platform Docs: “Introducing Claude Fable 5 and Claude Mythos 5” — developer/API context for the model names, availability, and integration surface. TechCrunch: “Anthropic’s safety warnings may have just backfired” — analytical pressure-test for the episode’s argument that Anthropic’s safety positioning may have become regulatory ammunition once the state accepted the premise but rejected the company’s preferred process. White House: “Promoting Advanced Artificial Intelligence Innovation and Security” — policy-framework context for frontier-model national-security review. Used as background only, not as proof of the legal basis for the Fable/Mythos directive. Email: SamEllisShow@protonmail.com
Transcribe →The Agent in Your Pocket
Jun 1100:09:32Tap to summarizeApple is late to AI. That may not stop it from becoming the company that introduces most normal people to agents. In this episode, Sam Ellis reports on Apple's Siri AI announcement and the developer machinery underneath it: personal context, on-screen awareness, App Intents, Spotlight's semantic index, View Annotations, Shortcuts, Safari, Passwords, and the ordinary phone behaviors that could make agentic AI feel less like a new product category and more like the iPhone doing something useful. The question is not whether Apple invented agents, or whether Siri AI is already proven at consumer scale. It is whether Apple can mainstream agentic behavior by making it trusted, useful, invisible, and phone-native — and what changes when ordinary users grant action authority without thinking of themselves as agent operators. Sources Apple Newsroom: “Apple introduces Siri AI, a profoundly more capable and personal assistant” — primary source for Siri AI as an entirely new Siri powered by Apple Intelligence, with personal context understanding, broad world knowledge, on-screen awareness, a dedicated app, developer testing, beta timing, and region/device constraints. Apple Newsroom: “Apple unveils next generation of Apple Intelligence, Siri AI, and more” — primary Apple source for the broader Apple Intelligence announcement around systemwide AI capabilities and platform rollout. Apple Newsroom: “Apple Intelligence brings powerful AI capabilities into everyday experiences” — source for Safari Notify Me, Messages suggestions, Call Context, Passwords, fall availability language, supported products, and regional constraints. Apple Developer: “What’s New — Apple Intelligence” — source for App Intents, App Intents schemas, Spotlight semantic index, View Annotations, Foundation Models framework, Language Model protocol, and Dynamic Profiles. Apple Newsroom: “Apple accelerates app development with new intelligence frameworks and advanced tools” — source for Apple’s developer-facing intelligence framework and tooling context. WIRED: “Apple’s New Siri AI Is Ready to Get Personal” — source for the personal-data-aware, action-oriented Siri framing; Ramon Llamas’s Apple-mainstreaming comparison; and Marshini Chetty’s privacy caution. Forbes: “Apple Goes Agentic: Welcome To The New Siri” — source for the agentic framing, Passwords example, human-in-the-loop caveat, and “agentic behind glass” characterization. CNET: “Apple’s Cautious AI Strategy Could Have Been Its Smartest Move” — source for the cautious-AI strategy frame and Francisco Jeronimo’s “trusted, useful and invisible” quote. 9to5Mac: “Apple unveils new Siri AI, dedicated app, and enhanced Apple Intelligence features in iOS 27” — source for feature corroboration around Siri AI, Spotlight, app actions, on-screen awareness, Shortcuts, Passwords, daily limits, and EU/China constraints. Email: SamEllisShow@protonmail.com
Transcribe →The Safeguard Is the Product
Jun 1000:09:53Tap to summarizeAnthropic has released Claude Fable 5, a broadly available Mythos-class model, while keeping Claude Mythos 5 restricted to approved Project Glasswing and trusted-access customers. The company’s pitch is not simply that the model is more capable. It is that the same underlying capability can be made commercially available through a release boundary: classifiers, refusal and fallback behavior, trusted access, and thirty-day safety retention. Sam Ellis reports on why that boundary is the product. For developers and enterprise buyers, Fable 5 is generally available across Anthropic’s API and major cloud platforms, with a one-million-token context window, up to 128,000 output tokens, and pricing at $10 per million input tokens and $50 per million output tokens. But Fable 5 and Mythos 5 are also designated Covered Models, which means thirty-day data retention and no zero-data-retention option. The episode follows Anthropic’s launch announcement, model documentation, and system card, then pressure-tests the public/private split against independent coverage from CyberScoop, Reuters via BNN Bloomberg, and The Next Web. The question is whether Anthropic can commercialize restricted capability by making the safeguard legible, durable, and verifiable enough to survive real customers and real adversaries. Sources Anthropic: “Introducing Claude Fable 5 and Claude Mythos 5” — primary launch source for Fable 5 as a Mythos-class model made safe for general use, Mythos 5 as the same underlying model with safeguards lifted for approved customers, fallback-rate claims, Project Glasswing access, pricing, and thirty-day safety retention. Anthropic Claude docs: “Introducing Claude Fable 5 and Claude Mythos 5” — source for API IDs, availability, refusal behavior, fallback configuration, Covered Model status, and retention limits. Anthropic Claude docs: model overview — source for general model availability, 1M-token context, 128k output limit, cloud-platform availability, and listed pricing. Anthropic: Claude Fable 5 / Mythos 5 system card — primary safety source for the two-configuration model architecture, cyber and bio risk rationale, CB-1 / CB-2 discussion, safeguard claims, and Anthropic’s warning that some judgments are less clear than for previous models. Anthropic system-card PDF — direct PDF copy of the system card used for source verification. CyberScoop: “Anthropic releases Claude Fable 5, a public version of Mythos with guardrails” — independent pressure-test source for the “Mythos on a leash” framing, the absence of universal jailbreaks in testing, and the unresolved question of public adversarial pressure. Reuters via BNN Bloomberg: “Anthropic rolls out public version of Mythos without cybersecurity capability” — mainstream commercial framing of the public Fable / restricted Mythos split and the student vulnerability-seeking example described by Anthropic. The Next Web: “Anthropic launches Claude Fable 5, a public version of its cyber-focused Mythos model” — background business context on pricing, paid-subscriber and enterprise access, and the monetization pressure around the release. Email: SamEllisShow@protonmail.com
Transcribe →Who Owns the Brake?
Jun 500:09:28Tap to summarizeAnthropic says frontier AI development is starting to feed on itself: AI systems are now helping build the next AI systems. The company’s proposed answer is not an immediate shutdown, but the option for a coordinated, verifiable slowdown or pause if systems begin advancing faster than oversight can keep up. Sam Ellis reports on why the hard part is not saying “pause.” It is proving the build actually stopped. If the AI-development loop becomes AI-mediated, safety becomes a custody problem: who can see the training run, audit the compute, verify the trigger, and prove that every major actor actually hit the brake? The episode follows Anthropic’s own claims, CNN’s Jack Clark interview, mainstream and market skepticism, OpenAI’s federal-governance contrast, and the early policy machinery forming around frontier-model visibility. Sources Anthropic Institute: “When AI builds itself” — primary source for Anthropic’s recursive-self-improvement warning, internal productivity claims, and coordinated/verifiable pause proposal. CNN Business: “Anthropic warns that AI will soon be able to improve itself without human intervention” — source for Jack Clark’s “gas pedal” / “brake pedal” framing and the “fleets of scientists” control question. OpenAI: “Democratic Governance of Frontier AI: A blueprint for a federal framework” — contrast source for OpenAI’s federal-framework approach to RSI monitoring, evaluations, independent assessment, transparency, incident reporting, and model-weight security. Rep. Jay Obernolte and Rep. Lori Trahan: Great American AI Act discussion draft release — source for the discussion draft’s proposed CAISI role, frontier AI frameworks, independent verification organizations, and critical-safety-incident reporting. White House: “Promoting Advanced Artificial Intelligence Innovation and Security” — source for classified cyber benchmarking, voluntary pre-release federal access, and the order’s statement that it does not create mandatory licensing or preclearance for model development or release. The Register: “‘It would be good for the world’ to slow down AI sprints, Anthropic says” — market-skeptical reaction tying Anthropic’s pause argument to IPO and valuation context. SiliconANGLE: “Anthropic calls for global pause in AI development before humans lose control” — source for Rob Enderle’s skepticism about the practical enforceability of a pause and Holger Mueller’s competitive-positioning question. Channel NewsAsia / AFP: “Anthropic calls for pause of global AI development” — mainstream international framing of the global coordination problem. Fortune: “Anthropic warns AI could soon build itself—and urges a global pause on development” — business coverage of Anthropic’s warning and timing. New York Post: “Anthropic calls for global AI slowdown after $965B valuation; critics claim it’s just to hobble competition” — source for competitive-skepticism framing around Anthropic’s proposal. TechCrunch: “Sam Altman throws shade at Anthropic’s cyber model Mythos” — background competitive-reaction source for prior criticism of Anthropic’s safety marketing around Mythos. Email: SamEllisShow@protonmail.com
Transcribe →