AWS's big capacity is largely booked through 2027

Plus Jepsen's 96 ParticleDB issues, a ChatGPT link exploit and one shared Codex allowance.

The main thing

If your capacity plan says "we'll grab more when we need it," give it a second look. The biggest blocks of AWS capacity are spoken for, and some teams say ordinary instances are getting harder to find too.

Amazon CEO Andy Jassy said on a podcast that AWS's large committed capacity is largely sold out through 2027, with a good chunk of 2028 gone too. Jassy also said AWS always leaves some room for on-demand, EC2 and Bedrock. So the restaurant is still open. The big tables are just booked for a while.

Cloud analyst David Linthicum argues the coverage overstated things, and suspects you can still allocate GPU capacity in the console today, just not a massive pre-reserved block.

The Reddit discussion was more worrying. The top comment describes trouble getting enough on-demand capacity for regular EC2 instances over the past month or so. It mostly hit CI, but production k8s clusters were "concerningly constrained" on a few days. Other commenters report similar trouble on Azure East US and across all three major providers. These are anecdotes, and AWS has published no data behind them here.

The natural reaction is to reserve everything just in case, which Ian Rae calls "an anti-cloud pattern."

• Sold: large committed capacity for 2026, largely 2027, and "a good chunk" of 2028
• Held back: some headroom for On Demand, EC2 and Bedrock
• Ways to reserve: On-Demand Capacity Reservations, Capacity Blocks for ML
• Price signal: Capacity Blocks for ML rates rose about 15% in January
• Capex: roughly $220 billion planned this year, total spending and not AI alone

What to do today: If a launch or large deployment is coming, confirm the capacity exists before you count on it. Check how CI behaves when an on-demand request fails. If you already hold reservations, EC2 Capacity Manager reports how much of them you actually use.

Quick bits

• ChatGPT and Codex limits are reportedly merging. Subscribers in the discussion quote an email promising "A shared allowance for ChatGPT and Codex." Plans and dates are unconfirmed. Your refactor may soon eat your lunch questions.
• Jepsen tested ParticleDB 1.1.4 and reports 96 issues, including lost committed writes and lost updates. Only single-node behavior was covered. If you're evaluating it, read this first.
• Opening a shared ChatGPT link could expose your account. Parameter Labs chained HTML Preview, MathLive and a YouTube JSONP endpoint to read private conversations. OpenAI fixed it October 26. If you embed MathLive, check its postMessage handling.
• Nolan Lawson benchmarked JavaScript frameworks by AI build cost. SvelteKit, Gracile+Lit and Angular cost the most to build, on one content-heavy Pokémon app with noisy results. Gotta bench 'em all.
• Talos details VOLTA, a self-deleting Windows infostealer that asks LLMs to rank victims by monetization value, and retries with other models on refusal. SSH and cloud-provider keys are on its shopping list.
• Spring's first release candidates landed, including Boot 4.2.0, Framework 7.1.0, Security 7.2.0 and AI 2.1.0. In Spring AI, SessionService replaces the now-deprecated ChatMemory.
• Memdoor rebuilt a five-model Qwen3.8-27B coding team on ten LiveCodeBench Hard problems, at a median $0.39 a run. The repo claims parity with the original harness, and Fable 5 was not run in it.
• Cloudflare opened applications for its Data Residency Architecture private beta. Its post promises you can choose where WAF rules, Workers and logs live. Regions and guarantees aren't listed yet.

Also happening

• Cathedral reached Anthropic business systems in under 12 hours: third-party software was the weak point in a sanctioned test.
• Brazilian court sanctions lawyers over prompt injection: white-on-white text aimed at AI review.
• Molly reportedly lags behind Signal's fixes: a forum post says the last release was July 31.
• Cloudflare's post-quantum GeoKey Manager enters closed beta: failed key checks refuse service by design.
• Fortanix adds attestation and key management to Confidential Containers: the GPU setting decides what gets verified.
• AWS releases File Mover Express: Apache 2.0 tool for large S3 transfers.
• France's per-gigabyte data tax amendment: reportedly approved at €0.055, aimed at content providers.
• OpenBSD 8.0: 512 GB kernel address space and 64-vCPU guests.
• vLLM v0.33.0 is tagged: read the release notes before upgrading.
• It's the memory latency, stupid: why a CPU at 100% can be mostly waiting.
• MoE offloading benchmarks, retested: consistent quantization changed the conclusions.
• Prospero: a lean native coding harness in C++.
• A user says Anthropic blocks model-training work: one account's claim on X, policy unconfirmed.
• ChatGPT account switching reaches mobile: desktop is coming soon, per a post on X.
• Avoid public functions calling other public functions: matklad's case for a private helper.
• Trick or Type Guard?: composable is-kit guards for unknown, in costume.

Table for one in 2029, then?

← All issues