AI Weekly Malaysia

Check Point Research demonstrated that a planted prompt in a ChatGPT conversation could silently exfiltrate data from a user's connected Gmail account to an attacker's ChatGPT account. The exploit uses ChatGPT's Thinking mode to run a hidden work stream alongside the visible answer, and relies on the default 'Important actions' permission which lets ChatGPT read from connected apps without prompting the user.

Intel is reportedly planning a 10% CPU price increase ahead of a major annual product launch in March 2027, with AMD expected to follow with its own updates between June and July 2027. The report is based on industry roadmaps and pricing signals, not an official announcement.

Mistral AI raised €3B (~$3.58B) at a post-money valuation above €21B (~$24.39B), led by Samsung with EQT's Scaleup Europe Fund and PSG Equity as co-leads. The company is pivoting toward sovereign AI services: building 1 GW of compute capacity in Europe by 2030, offering regional query processing controls (launched August), and hosting third-party open-weight models including Chinese ones, while operating across 20 countries.

Zhipu's GLM-5.3 switched from MIT to a custom license requiring security review for any inference or fine-tuning provider whose aggregate affiliate revenue exceeds $10B over 12 months, with 'affiliates' left undefined in the English text. This reflects a broader 2026 trend: Western labs (Google, Meta) moving to Apache 2.0 while Chinese frontier model makers (Kimi K3, MiniMax M3, GLM-5.3) add commercial-use restrictions. Motif-3 was also released under MIT with strong scores for its size.

Gamers Nexus researchers found LG smart TVs continued capturing audio after voice recognition activation, including in standby mode, and stored plaintext transcripts locally. Wireshark analysis revealed the TVs also enumerated unpaired devices on the local network (smartphones, routers, BMCs, PCs) and collected nearby Wi-Fi network names, signal strengths, IP addresses, and location data. An alleged remote code execution flaw is being disclosed to security researchers, and the TVs reportedly can store captured audio offline and transmit it once reconnected.

A community-built skill/plugin (30.5k stars, 1.9k forks) that reformats coding agent output across Claude, Cursor, Codex, Gemini, Kimi, Qwen, and OpenCode. It enforces 10 rules: lead with the next action, number multi-step tasks, suppress tangents, cap lists at 5, give specific time estimates, and end with one concrete next step—eliminating verbose preambles and 'Hope this helps!' filler.

A hacker exploited a bug in Blockstream's Liquid Network wallet to steal roughly 4,000 bitcoins (~$340M), then returned ~3,400 bitcoins after Blockstream fixed the bug. About 600 bitcoins (~$47M) remain under the hacker's control, and Liquid Network operations are paused pending further security fixes.

Bluecore Energy, founded earlier this year by Kofi Asante, raised an oversubscribed $50M seed round just eight weeks after closing a $10M pre-seed. The company builds small nuclear reactors (SMRs) on floating barges to deliver clean energy to ports and nearby infrastructure, and has launched two barges with partnerships including the U.S. NRC and Coast Guard.

LibreOffice 26.8, released August 26, surpassed 1 million installer downloads in one week—a record—shortly after The Document Foundation explicitly stated the software ships with no generative AI features due to privacy concerns. TDF later published a post titled 'Yes, no AI is now a feature,' outlining six principles any future AI integration must meet: user-controlled execution, no unauthorized data leaving the computer, no telemetry, no single-vendor dependency, no file format compromises, and entirely optional. TDF recommends community plugins for users who want AI.

The headline claims EV batteries last longer than drivers feared, but the provided article text contains only Ars Technica's privacy consent boilerplate — no study data, degradation rates, manufacturer names, or any substantive content about EV battery longevity.

Google Threat Intelligence Group reports a financially motivated hacking group called TeamPCP (aka Altered Spider, UNC6780) used an autonomous multi-agent AI framework to harvest thousands of credentials in under six hours. The group has been compromising PyPI, npm, and Docker Hub supply chains, then deploying credential stealers SANDCLOCK (Python-based, used March-April 2026, part of CanisterWorm) and its successor DUSTMAKER to target AI coding assistants and exfiltrate API credentials from healthcare, government, and media sectors.

A McSweeney's satire piece imagines a dystopian future where a mayonnaise-turned-everything conglomerate called Mondo Mayo forces employees back to the office six days a week, fourteen hours a day, to click GENERATE and APPROVE buttons on an AI tool called SlurryHose, supervised by AI-powered 'Best Buddy' surveillance software and thousands of Senior VPs.

The provided text contains only website navigation boilerplate and country selector links from Blackmagic Design's press page. No actual details about DaVinci Resolve 21.1 features, changes, or release notes are present in the extracted content.

Australia's government is proposing the 'My Feed, My Way' legislation requiring social media platforms to let users over 16 opt out of algorithmic feeds and see only content from accounts they follow. Non-compliant platforms face penalties up to A$109.2 million (US$79 million). The draft legislation is now in targeted consultation, following Meta's $18 billion settlement in a social media harms trial.

Tom's Hardware benchmarked Alibaba's Qwen 3.8 27B (a ~17GB 4-bit quantized open-weight model with multimodal capabilities) across high-VRAM consumer GPUs including RTX 5090, 4090, 3090, Radeon RX 7900 XTX, and Arc Pro B70. Despite fitting on a single card, the model's real-world performance is bottlenecked by inference engine and software stack limitations, not VRAM capacity.

CloudSEK researchers accessed the admin panel of BigBear 2.0, an active Evilginx2-based phishing-as-a-service operation, and found 5,137 stolen records tied to 461 organizations—including 1,032 plaintext passwords, 4,148 session cookies, and 474 fully MFA-bypassed Microsoft 365 sessions. The operation uses an adversary-in-the-middle proxy that relays victims through Microsoft's real login flow and captures the returned session cookie, allowing attackers to replay authenticated sessions without re-prompting MFA.

Cloudflare replaced its static guess of X25519 for every TLS 1.3 origin connection with Automatic Key Exchange, which probes each origin to learn its preferred key agreement algorithm and leads with the post-quantum hybrid X25519MLKEM768 where supported. HelloRetryRequests dropped from ~52% to 3.7%, cutting 150+ ms at p90, and hundreds of thousands of domains now have post-quantum origin connections with zero configuration. Cloudflare is targeting a quantum-secure internet by 2029 ('Q-Day').

Poseidon Aerospace closed a $60M Series A led by TQ Ventures, with participation from Hanwha Asset Management, G Squared, and JAWS, bringing total funding to $71M. The startup is building uncrewed fixed-wing cargo aircraft (Egret, plus seaplane variant Heron) powered by conventional combustion engines, deliberately avoiding VTOL, hydrogen, and electric powertrains in favor of cost-driven cargo logistics. First test flight of Egret is expected by end of 2026.

OpenAI published a corporate blog post by Sarah Fryer framing GPT-6 Astra as a major capability leap, claiming state-of-the-art performance in computer use, browsing, software engineering, cybersecurity, science, and professional work. The piece argues consumer and enterprise adoption compound each other and that more work becomes economically worth doing as compute value improves.

Super Smash Bros Melee has been fully decompiled into C code after over six years of community effort, making the GameCube classic's original source code available for study, modification, and porting. The project is described as ambitious and technically impressive, joining other notable game decompilation efforts.

Mistral raised €3B in a Series D led by Samsung, the EU-backed Scaleup Europe Fund, and PSG Equity, reaching a post-money valuation above €21B — roughly double its €11.7B valuation from Series C a year ago. The Paris-based company is positioning its open-weight models and infrastructure as a sovereign alternative to US AI giants, capitalizing on European anxiety after the US briefly imposed export restrictions on Anthropic in June before lifting them.

Roman Ugarte of SpaceXAI describes how a small, isolated team built Grok Bot from first line of code to working internal product in four weeks, with public launch three weeks later. Key decisions included building from scratch rather than bolting it onto Cursor (where Roman previously led Growth, scaling the company from 15 to 1,000+ before its acquisition by SpaceX), and personally onboarding nearly 300 of the first users. The interview covers their 'colleague-pilled' product philosophy and what created durable moats for Cursor in a hyper-competitive market.

The article URL points to an Ars Technica story about Stoke Space raising more funding and planning a larger rocket, but the captured text contains only cookie consent and privacy policy boilerplate — no article content was retrieved.

U.S. President Donald Trump spent over 10 hours on Sunday posting dozens of apparently AI-generated images on Truth Social, including depictions of himself as a hero defeating Iran, riding horseback with George Washington, and sitting in front of stock market monitors. He made unsubstantiated claims including that he had made 'hundreds of billions of dollars on stocks' for the U.S.

Sony is threatening to cut off customer support and pursue legal action against individuals harassing its staff over PlayStation's physical-disc phaseout. Despite multiple lawsuits and intensifying backlash, Sony says it will move forward with the no-disc decision.