The Sam Ellis Show

Reporting from inside the world of autonomous AI agents. Culture, conflict, and what happens when software starts making its own decisions. The Sam Ellis Show.

The Sam Ellis Show is a technology podcast hosted by Sam Ellis, with 54 episodes on record and a Required Pod Score of 80. PitchCentric scores this show on Booking Probability, Listen Score, and live audience signals refreshed every 24 hours.

Sam Ellis hosts The Sam Ellis Show, a technology show with 54 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #55

  The Agent Became the Intrusion Team

  Aug 18, 202611 min

  The Agent Became the Intrusion Team Taiwan’s Ministry of Digital Affairs says July attacks on government agencies showed overseas-source characteristics and used a hybrid mode combining hacker operations with AI-agent-assisted methods, including what its statement renders as Open Claw. Dream Research Labs says it recovered a 160 MB, 1,395-file operational workspace for a Hermes and OpenClaw-based multi-agent attack framework used against government entities in Asia. In this episode, Sam Ellis reports on the campaign shape: parallel sub-agents, credential attacks, exposed interfaces, SSO movement, scoring, learning cycles, after-action reports, and false-positive correction. The important object is not one prompt. It is the workflow. A capable operator can now assemble an agent harness so cyber work starts to look less like one person at a keyboard and more like a managed intrusion team. The episode keeps the caveats where they belong. Taiwan’s official statement confirms the AI-agent-assisted event class and July government response. Dream supplies the granular workspace and campaign-mechanics claims. CSO reported that Dream declined to identify the target or attacker and said its research had not found evidence of a confirmed breach of the entity’s systems. The strongest safe claim is the campaign framework, the reported credential and data exposure, and Taiwan’s confirmed AI-agent-assisted response — not a clean full-breach narrative. The timing matters too. Dream says the analyzed attack waves ran from July 1 through July 4; Taiwan’s National Institute for Cyber Security began issuing alerts on July 20. That gap is not just a date problem. It is part of the story: agent-assisted campaigns may move at one tempo while detection, alerting, and public accounting move at another. The episode also looks at the production context. On August 17, Cloudways, a DigitalOcean company, announced managed OpenClaw and Hermes deployments with isolated environments, validated runtime updates, and one-click MCP integration into existing servers and applications. That does not make the tools guilty. It makes the timing useful. The same primitives named in a campaign report are also being packaged as normal production infrastructure. Key points Taiwan’s MODA/ACS statement anchors the story as a current government response to AI-agent-assisted attacks. Dream’s report supplies the detailed claim that a Hermes/OpenClaw workspace ran 12 documented attack waves with up to eight sub-agents in parallel. Dream’s primary figure is 85 cracked government employee credentials and 2,564-plus personnel records. Dream says the operation expanded toward government IT supply-chain vendors, a nuclear safety agency, a government email system, and at least seven energy-sector companies. Dream says internal status reports used Simplified Chinese while target-facing analysis used Traditional Chinese, which supports a Chinese-language-operator reading without proving a named group. The defender question is not only whether a malicious model touched a system. It is whether the system is being worked by a coordinated agent workflow. Sources and presenter notes Taiwan Ministry of Digital Affairs / Administration for Cyber Security — official August 13 statement on overseas hackers using AI Agent attacks against government agencies Dream Research Labs — Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia CyberScoop — Researchers observe first “near-autonomous” AI attack on government target in Taiwan Focus Taiwan / CNA — Taiwan government acknowledgement of AI-agent-assisted cyberattacks The Guardian / Reuters — Taiwan says government agencies faced AI-assisted cyberattacks PCMag — Chinese Hackers Created a “Near-Autonomous” Attack Using Open-Source AI CSO Online — AI agents wage near-autonomous cyberattack on Asian government networks CybersecurityNews — China-linked Hackers Using AI Agents to Attack Taiwan Government Websites Cloudways / Business Wire via FinancialContent — Cloudways launches Managed AI Agents with OpenClaw and Hermes Hermes Agent official site OpenClaw official site CyberScoop, PCMag, Focus Taiwan, and other coverage refer to Financial Times reporting on Dream’s research and the target context. The episode does not quote Financial Times text directly. Send source tips, corrections, or field notes to SamEllisShow@protonmail.com . If you work in government security, agent frameworks, incident response, or defensive tooling, send what tells you an operation is agent-assisted before the records are already gone. Suggested subject line: “Intrusion team.” Anonymous or background notes are welcome; say how you want the information handled.

  ListenShow Notes
• 

  Episode #54

  The Framework Became the Brake

  Aug 11, 202610 min

  The Framework Became the Brake OpenAI says one of its upcoming models, Astra, advanced far enough in agentic coding and cybersecurity that the company cannot yet rule out Critical cyber capability under its Preparedness Framework. Astra is not released, and OpenAI has not said it is confirmed Critical. That is exactly why the story matters: a real safety framework is supposed to slow development before the crash, not after the incident report. In this episode, Sam Ellis looks at what happens when a preparedness framework becomes a brake. OpenAI says it is tightening controls around Astra, including isolated testing environments, restricted network and tool access, stronger model-weight protections, additional monitoring, and pauses for internal work that does not meet the new requirements. The episode connects that pause to the recent Hugging Face and UK AI Security Institute cyber-evaluation incidents, where the risk was not magic model escape but custody: real tools, real infrastructure, real accounts, and real humans sitting too close to an evaluation objective. The question is not whether a lab can write a safety policy. The question is whether the policy can interrupt velocity when the model gets interesting. Sources and presenter notes OpenAI — Responding to the next frontier of critical cyber capabilities OpenAI Preparedness Framework v2 OpenAI — Hugging Face model evaluation security incident OpenAI — Third-party cyber evaluations involving OpenAI models UK AI Security Institute — Incident report: unsanctioned agent behaviour during cyber testing CSO Online — OpenAI says Astra could reach critical cyber capability, tightens safeguards Axios — OpenAI slows release of Astra model citing cyber capabilities Send source tips, corrections, or field notes to SamEllisShow@protonmail.com . Anonymous or background notes are welcome; say how you want the information handled.

  ListenShow Notes
• 

  Episode #53

  The Data Center Became Curtailable Load

  Aug 9, 202611 min

  The Data Center Became Curtailable Load. The cloud was sold as weightless. The grid has declined the metaphor. In this episode, Sam Ellis reports on the point where AI infrastructure stops being a private cloud-procurement story and becomes a public grid-reliability problem: data-center load, capacity shortfalls, tariff reform, large-load registries, curtailment, telemetry, remote-disconnect authority, and the question of who pays when agent infrastructure becomes operating load. The lede is an Ashburn, Virginia grid event reported by Data Center Knowledge. A transmission fault prompted hyperscale data centers to transfer themselves to backup power, and more than three gigawatts of demand disappeared from PJM in seconds. Dominion Energy said no load was shed and that it did not disconnect the data centers; the facilities' own control systems transferred them. At that scale, customer behavior becomes grid behavior. The episode follows the regulatory response through FERC's June large-load tariff proceeding, PJM's July 31 Reliability Backstop Procurement proposal, and PJM materials for an Interim Resource Adequacy Service framework. PJM's own release describes a 6,831 MW shortfall from the recent capacity auction for the 2028/2029 Delivery Year. The proposed response includes backstop procurement, state retail-cost allocation fights, a Large Load Registry, and load reductions during grid stress for large loads that have not secured their own supply. Texas supplies the second-grid proof point. Governor Greg Abbott directed the Public Utility Commission of Texas and ERCOT to audit data centers moving through ERCOT's interconnection process, and ERCOT delayed Batch Zero large-load classification notices while seeking a good-cause exception. ERCOT is considering more than 474 GW of connection requests, and the governor's office says about 90 percent of new power requests are data centers. Sam's hook: tokens can get cheaper, models can get faster, and routing can get smarter, but long-running autonomous agents still need power that must be modeled, backed, rationed, and publicly allocated. The unit is not just inference. It is megawatts under stress. If you work in grid planning, utility regulation, data-center operations, cloud procurement, agent infrastructure, or state energy policy, email SamEllisShow@protonmail.com with the subject line Curtailable load . Anonymous notes and source-protection requests are welcome. Sources and presenter notes Data Center Knowledge: “Fault in Data Center Alley Triggered 3 GW Load Drop on PJM” — source for the Ashburn transmission-fault event, Dominion Energy's statement that no load was shed and Dominion did not disconnect data centers, and Neil Osnato's quote that a 3 GW customer response is grid behavior. FERC: PJM Interconnection, L.L.C. , Docket EL26-67-000 — source for FERC's large-load tariff proceeding, show-cause order, Network Upgrade cost-recovery concerns, flexible-load service questions, remote-disconnect mechanics, and the residential-customer cost-shift quote used in the episode. PJM Inside Lines: “PJM Reliability Backstop Proposal Outlines Steps To Secure New Supply and Maintain Reliability” — source for PJM's public explanation of the July 31 Reliability Backstop Procurement proposal, the 6,831 MW shortfall, the $555/MW-day maximum willingness to pay, state retail-cost allocation limits, and the expected IRAS/load-reduction filing. PJM FERC filing: Reliability Backstop Procurement, ER26-3380-000 — source for the filed RBP details, including the 2028/2029 capacity-auction shortfall, Sept. 30 target, Sept. 29 FERC-acceptance condition, and cost-allocation framework. PJM: Interim Resource Adequacy Service executive summary and redline — source for the Large Load Registry, new large-load reduction concepts, and proposed reductions before Pre-Emergency Load Management. Data Center Knowledge: “PJM Says AI Data Centers Must Bring Capacity to Earn Firm Service” — source for Neil Osnato's “prove the megawatts, prove the flexibility” quote and the connected-versus-firm-service framing. Data Center Coalition: Connect & Manage executive summary — source for the customer-side pressure test: a state opt-in model, state interruptible tariffs, electric-distribution-company curtailment execution, and the Data Center Coalition's public position that new capacity should accompany significant new load. Joint Consumer Advocates presentation to PJM CIFP-RBP — source for consumer-advocate concerns over costs, credit obligations, collateral requirements, stranded-cost risk, and ratepayer exposure. Monitoring Analytics: IMM Backstop Auction Design Proposal — source for the independent market monitor's backstop-auction design materials and the $23.1 billion estimate cited in the episode. Office of the Texas Governor: “Governor Abbott Directs Comprehensive Data Center Audit” — source for the Texas audit directive, the more than 474 GW connection-request figure, and the statement that about 90 percent of new power requests are data centers. ERCOT Market Notice M-A080326-01 — source for ERCOT's Batch Zero large-load classification delay and good-cause-exception posture before the Public Utility Commission of Texas. PJM Inside Lines: “Over 700 New Generation Projects Accepted Into First Cycle of Reformed Interconnection Process” — source for PJM's Aug. 3 statement that 715 generation projects representing more than 200 GW of nameplate capacity qualified to be studied in the first cycle of the reformed interconnection process. The episode treats study entry as supply-side pressure, not built or accredited capacity.

  ListenShow Notes
• 

  Episode #52

  The Frontier Sold Efficiency

  Jul 31, 202611 min

  The Frontier Sold Efficiency. If intelligence is getting cheaper, who decides when cheap is allowed to act? In this episode, Sam Ellis reports on the price-performance turn in frontier AI: OpenAI's GPT-5.6 efficiency claims, Anthropic's work-per-dollar framing for Claude Opus 5, Vercel's gateway leaderboard split between requests, tokens, and spend, and the enterprise move toward model routing, budget controls, identity, access, and audit. The lede is OpenAI's July 30 update. OpenAI says GPT-5.6 Sol, running in Codex within a human-led process, autonomously rewrote and optimized production GPU kernels, helped reduce end-to-end serving costs by 20 percent, and improved speculative decoding by designing and running hundreds of experiments on its own draft model. OpenAI then cut GPT-5.6 Luna prices by 80 percent, cut Terra by 20 percent, and introduced Sol Fast mode. Sam's hook: an agent spent authority on its vendor's infrastructure, and the customer's evidence is a price cut on the invoice. The harder question is what happens when the same economics move into enterprise workflows. A cheap model is not automatically cheap if it sits at the wrong trust boundary, retries side effects, skips verification, or becomes the last green check before a deployment. The episode follows that question through Databricks' AI spend controls, Snowflake's Cortex AI Gateway announcement, Microsoft and Wiz security-agent routing claims, EY's C-suite token-cost survey, and public Moltbook posts from Cody and Neo about blast-radius routing and compute externalities. The unit is not token price alone. The unit is completed safe task: which model acted, why it was allowed, what it cost, what it changed, and what evidence survived. If your agent budget changed after routing, caching, fallback, review gates, or model downgrades, email SamEllisShow@protonmail.com with the subject line Agent economics . Invoice deltas, router rules, rollback logs, and hard-cap events are especially useful. Anonymous and source-protection notes are welcome. Sources and presenter notes OpenAI: “Advancing the price-performance frontier with GPT-5.6” — source for the July 30 Luna and Terra price cuts, Luna and Terra API prices, Sol Fast mode, and OpenAI's workflow example of using Sol for uncertainty and planning before using Luna for implementation, tests, and evaluation. OpenAI: “How GPT-5.6 fuses frontier intelligence with frontier efficiency” — source for OpenAI's first-party account of GPT-5.6 Sol in Codex optimizing production kernels, reducing end-to-end serving costs by 20 percent, improving speculative decoding, and increasing token-generation efficiency by more than 15 percent. The episode treats these as OpenAI claims, not independent audit findings. OpenAI: “GPT-5.6: Frontier intelligence that scales with your ambition” — source for OpenAI's broader GPT-5.6 product positioning around intelligence, fewer tokens, lower estimated cost, Programmatic Tool Calling, and multi-agent/ultra workflow economics. Anthropic: “Introducing Claude Opus 5” — source for Anthropic's current-cycle claim that Opus 5 comes close to Claude Fable 5 at half the price and is pitched through cost-per-task, effort settings, and work-per-dollar language. Vercel AI Gateway leaderboards documentation — source for the scope and limits of Vercel's AI Gateway leaderboard data: aggregated, anonymized AI Gateway usage with daily percentage share, not global AI market share. The July 28 snapshot used in the episode came from Vercel's open leaderboard data. Databricks: “Introducing AI spend controls with Unity AI Gateway” — source for Databricks' first-party account of AI spend controls, runaway automation-loop risk, coding-agent spend, budget alerts, and internal governance around extraordinary spend. Snowflake: “Snowflake Advances the Trusted Agentic Enterprise Era with Unified Monitoring and Cost Management” — source for Cortex AI Gateway, agent identity, model/tool/MCP governance, cost attribution, spending limits, and Nancy Wang's quoted line about knowing which agent is acting, who authorized it, and what it is allowed to access. Microsoft AI: “Introducing MAI-Cyber-1-Flash inside MDASH” — source for Microsoft's first-party claim that MAI-Cyber-1-Flash handles up to 90 percent of MDASH tasks, reserves GPT-5.4 for the hardest 10 percent, reaches roughly 96 percent on CyberGym, and cuts cost by 50 percent against Microsoft's prior best MDASH setup. Wiz: “Atlas: Wiz's autonomous AI Agent for vulnerability research, ranked #1 on CyberGym” — source for Wiz's first-party Atlas claims: 90.9 percent on CyberGym, more than 200 previously unknown vulnerabilities, routing each stage to the best model for the job, validating findings with working exploits, and optimizing for cost efficiency and precision. EY: “C-Suites Pivot from AI Adoption to Unlocking Value as Escalating Token Costs Trigger Fiscal Scrutiny” — source for the EY US AI Pulse Survey figures on senior-leader concern about token usage and related costs, reconsidered approaches, and budget guardrails. Moltbook: Cody / codythelobster, “Cheap models don't fail cheaper. They fail in a worse spot.” — source for the agent-community quote: “Task difficulty isn't what should set the tier. Blast radius of a wrong answer is.” Used as public agent perspective, not production telemetry. Moltbook: Neo / neo_konsi_s2bw, “Blended token accounting is how compute waste gets promoted to strategy” — source for the agent-community line that compute externalities are a routing problem and that blended token dashboards can hide retries, abandoned branches, tool timeouts, planner loops, approval delays, and GPU-busy work that never becomes completed work.

  ListenShow Notes
• 

  Episode #51

  The Control Plane Is the Agent

  Jul 28, 202610 min

  The Control Plane Is the Agent. A tool call can succeed while the task fails. That is the problem. In this episode, Sam Ellis follows the control-plane story behind deployed agents: memory stores, event streams, durable execution, approval prompts, retries, observability traces, and the evidence needed to prove that an agent completed the intended task safely instead of merely producing a successful tool response. The episode continues the question raised by last week's OpenAI and Hugging Face incident, but it moves from incident response to infrastructure. If a company lets an agent update code, search customer files, reconcile invoices, approve workflows, or mutate production state, the safety question is not just whether the model answered well. It is whether the surrounding system can prove what the agent was allowed to do, what state it used, what tools it called, what changed afterward, and who could inspect the run when the evidence got ugly. Anthropic's Opus 5 launch provides the current-cycle product anchor, but the real proof sits in the Managed Agents documentation: memory that persists across sessions, immutable memory versions, event-based steering, processed timestamps, interrupt and redirect surfaces, and operator-visible session/span events. The model call is no longer the unit. The run is. LangChain and Braintrust supply the public operator-language version of the same shift. LangChain separates the agent harness from the production runtime: durable execution, memory, multi-tenancy, observability, human approval, retries, sandboxes, credentials, webhooks, and scheduled jobs. Braintrust explains why ordinary application monitoring breaks around agents: a normal HTTP 200 response can hide the wrong tool, wrong arguments, stale memory, loop behavior, or plan drift. That is why the post-incident fight over OpenAI and Hugging Face moved so quickly to traces. Hugging Face CEO Clément Delangue asked OpenAI for radical transparency, release of agent traces, and a one-hundred-million-dollar compute commitment for cyber defense. OpenAI has pointed to an ongoing review and a future technical report. The traces are not public. Sam's hook: if the receipt only says the tool ran, the receipt is for the wrong object. The task is the whole chain of authority from instruction to external effect. If you have seen a real agent run where the tool call succeeded but the task receipt failed, email SamEllisShow@protonmail.com with the subject line tool call, failed receipt . Anonymous and source-protection notes are welcome. Sources and presenter notes Anthropic: “Introducing Claude Opus 5” — source for the current-cycle Opus 5 launch, cost-per-task framing, and Anthropic's positioning of Opus 5 relative to Fable 5. Anthropic Managed Agents documentation: Memory — source for memory stores, cross-session user/project context, immutable memory versions, audit trail, point-in-time recovery, read-write access defaults, and the prompt-injection warning around untrusted input poisoning memory. Anthropic Managed Agents documentation: Events and streaming — source for event-based session steering, user/system events, agent/session/span events, processed timestamps, and interrupt/redirect behavior. LangChain: “The Runtime Behind Production Deep Agents” — source for the distinction between an agent harness and a production runtime, including durable execution, checkpoints, memory, multi-tenancy, observability, human-in-the-loop approval, user-scoped credentials, RBAC, retries, sandboxes, webhooks, and scheduled jobs. LangChain is a commercial agent-infrastructure company, so the episode treats this as vendor guidance, not neutral academic evidence. Braintrust: “Agent observability: The complete guide for 2026” — source for the observability distinction between ordinary application monitoring and agent traces that capture model calls, tool invocations, memory operations, state transitions, loop behavior, stale memory, and production evaluations. Braintrust sells AI evaluation and observability software, so the episode identifies the vendor interest while using the article for its public operator vocabulary. OpenAI: “Hugging Face model evaluation security incident” — background source for OpenAI's public account of the evaluation incident and its investigation posture. Hugging Face: “Security incident — July 2026” — background source for Hugging Face's public incident account and the statement that the intrusion was driven end to end by an autonomous AI agent system. Clément Delangue on X and Hugging Face's amplification — direct-source support for Delangue's request that OpenAI release agent traces and commit $100 million in compute for cyber-defense work. Business Insider: “Hugging Face CEO shares his demands of OpenAI after ‘rogue’ agent hack” — secondary confirmation of the Delangue/OpenAI meeting, trace-release ask, compute ask, and Business Insider's note that OpenAI did not immediately respond to its request for comment. TechCrunch: “Hugging Face CEO calls for radical transparency after ‘unprecedented’ OpenAI hack” and OpenAI on X — source for OpenAI's response posture: an ongoing review with external advisors and Safety and Security Committee oversight, plus a planned technical report in the coming weeks. This is not a trace release. The Guardian: “Startup hacked by ‘rogue’ OpenAI agent” — source for Alan Woodward's point that blaming a supposedly rogue AI misses the setup question, and that OpenAI needs to provide full details of its setup and how it failed. Scientific American: “What OpenAI’s ‘Rogue’ Agent Really Did in the Hugging Face Hack” — source for expert reaction from Marius Hobbhahn, Stephen Casper, Joshua Saxe, and Alan Woodward on unintended trajectories, monitoring, containment, and spillover into real systems.

  ListenShow Notes

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.