AI Weekly Malaysia

Google DeepMind introduced Gemini 4 Argon, claiming first place on 13 of 19 benchmarks against GPT-6 Astra and Claude Opus 5.5, with a 1M-token output limit via the new Long Decode Continuation API feature. Standard pricing is $4/$20 per 1M input/output tokens, with a 50% introductory discount to $2/$10 and 95% off cached input. Access is limited to government users and trusted cyber defenders in the Fairwind Program, with broader developer, enterprise, and consumer access promised later.

Digital Nasional Berhad completed a RM5.2 billion Syndicated Islamic Term Financing — described by DNB as among the largest syndicated loan facilities ever arranged for an unlisted Malaysian company — led by Maybank Investment Bank with AmInvestment, CIMB Islamic, RHB Islamic and UOB Malaysia as joint mandated lead arrangers. The money refinances DNB's Government Guarantee Revolving Credit Facility, which expired 29 September 2026, and is expected to reduce the need for extra equity from its mobile network operator shareholders. DNB also received the full 100MHz block in the 3.3GHz–3.4GHz band (F0) and converted its 240MHz holding from Apparatus Assignment to a 15-year Spectrum Assignment, while MOF Inc exits as an ordinary shareholder but keeps a special share, with CelcomDigi, Maxis and YTL expected to hold equal stakes and the transition due in early Q4 2026.

On September 30, Dion Blazakis, Josh Maine, and Anna Groza of Calif published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw triggered by a PDF carrying a crafted embedded TrueType font whose glyph coordinates overflow during conversion to 32-bit fixed-point. Apple patched it September 28 — iOS 26.7.1 was the only library changed, and the same fix was applied more than 20 times across eight rasterizer functions — crediting Meta Product Security and saying it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iOS versions before iOS 27; CISA added it to the Known Exploited Vulnerabilities catalog the next day with an October 2 deadline for federal agencies. The published code crashes unpatched iPhones and Macs but does not demonstrate code execution, and no workaround was described for systems that cannot update immediately.

Bitget confirmed that the $387.5 million drained from its hot and warm wallets on September 24, 2026 was enabled by a zero-day in unnamed third-party security products, per a SlowMist investigation. Attackers used the flaw to read a database password from an environment variable, run hidden scripts on at least three nodes starting August 31, 2026, obtain high-level internal credentials, and issue withdrawal commands that bypassed existing risk controls. Funds were taken across 11 blockchains and 13 assets, and only about $632,700 was frozen by Circle, Tether, and NEAR Intents.

MetaMask said on Thursday (Oct 1, 2026) it is responding to an "ongoing security incident" affecting part of its infrastructure, stating it found "no immediate threat to MetaMask wallets" but disclosing no further details. As a precaution it is proactively exiting affected validators in its non-custodial staking operations; Lido said relevant validators have begun exiting and the final ones are expected to be exited (but not fully withdrawn) by the end of October 7, 2026, which will likely mean foregone rewards and possible downtime penalties. MetaMask stressed the staking operation is non-custodial and it does not hold clients' withdrawal keys.

Attackers are exploiting CVE-2026-88771, a CVSS 9.5 pre-authentication command injection flaw in Citrix NetScaler ADC and NetScaler Gateway, to drop web shells and stage configuration data. LevelBlue's THOR team, analyzing activity across multiple customer environments, found authentication events with attacker-controlled usernames containing 'pitboss' and 'NSPPE' strings, plus payload fetches via curl/wget from IPs including 64.94.85[.]67, 31.56.197[.]72 and 23.27.143[.]20. Second-stage payloads include a Perl script (update_c08937.pl) that edits /flash/nsconfig/ns.conf to create a local account named sec_monitor with the superuser role, and a Python script (main.py) that opens a reverse shell to 45.141.21[.]130:443 and kill -9's processes tied to /var/python/bin/customsnmpd. The disclosure follows reports that NCSC-NL pre-notified Dutch organizations and urged shutting appliances down; no attribution is given. The excerpt is truncated, so the 'CSS-like URL' web shell detail in the headline is not substantiated in the text provided.

A Hacker News thread (255 points, 105 comments) centers on a developer's X post describing their run-in with Google's Android Developer Verification Program: their personal Play Store account was closed for inactivity, they could not create a replacement Play Console account, and when they turned to shipping an APK via F-Droid they say they hit a $25 verification fee plus an identity check. The post also claims that even distributing to fewer than 20 users requires a verified payments profile and an answer to a question about publishing on Android. The article text is a truncated copy of that post, so the program mechanics are reported second-hand from one developer's experience, not from Google's own documentation.

Grab has updated drop-off rules for the F1 Bahrain Grand Prix race weekend at Sepang International Circuit: only Grab Standard 6 Seater vehicles can access the circuit gates directly, while Standard four-seater, Advance Bookings, and Group Rides are prohibited from entering the main venue area. All other Grab tiers must set their destination to one of four shuttle hubs: Long Term Car Park, Mitsui Outlet Park KLIA, KLIA Terminal 2, or Bandar Baru Enstek at SK Kompleks KLIA. From the Long Term Car Park, passengers can board free Grab chartered shuttles to the circuit, with priority boarding for Grab passengers.

Microsoft has overhauled Copilot from a sidebar chatbot into an autonomous workspace hub with three parts: Home (splitting tasks into Chat for lookups and Cowork for delegated end-to-end workflows like financial reports, tender documents and launch kits), Code (powered by the same engine behind GitHub Copilot, letting non-developers build dashboards, desktop widgets and cloud-hosted internal apps inside a sandbox called Microsoft Copilot Managed Runtime), and Autopilot, an evolution of the agent previously known as Scout that gets its own cloud computer instance, workspace, memory and identity inside an organisation and can run supplier reviews and recurring meetings across Teams and Outlook unsupervised. Word, Excel and PowerPoint are now embedded directly into Copilot, with PowerPoint enforcing company brand guidelines and Excel tracking collaborative edits. The excerpt carries no pricing, licence tier or rollout dates, and cuts off mid-sentence.

TNG Digital and Webull Securities Malaysia have launched a Webull Mini Programme inside TNG eWallet's GOfinance hub, letting users open a Webull trading account digitally and fund it from their eWallet balance without a separate app. The mini programme covers US and HK securities plus CN A-shares with basic charting and educational content, but excludes Bursa Malaysia equities (REITs, structured warrants, ETFs), local index futures (FKLI/FKLM), FCPO, and international futures/FX access that the standalone Webull app offers, which also carries 58+ indicators, Level 2 data and a desktop terminal. Launch promo: open an account via TNG eWallet, deposit at least RM200 and hold it 30 days to get RM30 in Apple fractional shares; Webull has held a Capital Markets Services Licence from the Securities Commission Malaysia since launching locally in May 2024.

Meta appointed Dhruv Vohra as managing director of its global business group for Southeast Asia, covering Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam, reporting to Asia Pacific VP Benjamin Joe. Vohra joined Meta in 2019 leading e-commerce and digital-native work and later SMB growth across SEA and APAC, and the announcement says his remit centres on helping advertisers and agencies use AI and Meta's apps, plus regional partnerships. The post is a leadership announcement with no product, pricing, API or policy change attached.

DC Handal has turned on a 180kW Autel DC charger at the BHPetrol station in Taman Perindustrian Temerloh, its first charger in the Mentakab/Temerloh area and about 7 minutes from Mentakab town. The unit has two CCS2 nozzles and is priced at RM1.30 per kWh, with activation by tapping a credit/debit card or TNG eWallet QR at the terminal, or through Gentari Go, Jomcharge and ChargEV. The article notes TNB Temerloh already offers a 240kW DC charger with four CCS2 nozzles, and that DC Handal recently switched on a 240kW charger at Zenith Hotel Kuantan.

OpenAI said it identified and disrupted a coordinated campaign to extract protected reasoning from its AI models, linking a core cluster of the activity to Chinese startup Moonshot AI, the developer of Kimi. The activity began in early July and surged to 16,000 requests from more than 4,000 users over two days, with related activity eventually identified across a cluster of more than 15,000 users; OpenAI says it fully disrupted the campaign by July 28. OpenAI stated the operators did not breach its encryption, databases, or stored user conversations, and the disclosure comes weeks after Anthropic accused Chinese AI developers including Moonshot AI and Alibaba of secretly using Claude to help train their own models.

In October 2016, Singapore Pools began selling through its own website and app. It did so on strict terms: it runs on a not-for-profit basis, its surpluses go to social and charitable causes, and it has to set daily funding limits for every account. Nearly ten years later, Malaysia’s two listed operators in the same […]

Exabytes founder and CEO Chan Kee Siak argues Malaysian SMEs get little from agentic AI unless they re-engineer existing workflows and have bosses who personally use AI, recommending phased adoption starting with standalone agents. He cites an Ecosystm and Red Hat study of 133 Malaysian SMEs, supported by the National AI Office, showing only 21% moved past AI pilots and about 60% cited a lack of in-house technical expertise. Exabytes itself is putting more than 50% of its budget into AI, targeting one million businesses adopting AI by 2030, opened an HPC/AI colocation facility in Penang, signed an MoU with Aurora Mobile, and now draws roughly 30% of revenue from AI and cloud.

CNBC's investing club raised its Micron price target after Micron's fiscal 2026 fourth quarter (ended Sept. 3) beat consensus: revenue up 379% year-over-year to $54.23 billion versus the $51.07 billion LSEG consensus, and adjusted EPS up 1,002% to $33.42 versus $31.61 expected. Management said fiscal 2027 should be another strong year because demand for its memory products continues to exceed supply. The stock rose roughly 11% in September and is up about 275% for the year, but sits 12% below its June 25 record close of $1,213, and shares finished roughly flat after hours.

Anthropic introduced mods for Claude Code: small TypeScript functions that hook into events Claude Code emits (tool calls, permission prompts, UI draws) to run before, after, instead of, or wrapping them. A mod can rewrite prompts before they reach the model, block/retry tool calls, approve or deny permissions, redact secrets from tool output, and add or replace UI elements in the CLI, desktop app, or both. Mods ship inside plugins and are explicitly not sandboxed — they run with the same machine access as Claude Code itself, so the post says to install only from trusted sources.

OpenAI published a customer story about The Den Family Social, a Denver-based social club, claiming its leadership team saves 10-15 hours a week using ChatGPT Work with Gmail, Slack, and Google Drive plugins. The post says a second liquor-license application took 3 hours instead of 4 days, and grant applications take 2 hours instead of 3 days, with the team still reviewing output and making final decisions. No pricing, model version, feature launch, or independent measurement is included.

Anthropic published a customer announcement that Barclays is expanding its use of Claude across the bank, targeting Claude Code adoption by 50% of its developer population by end of 2026 and a majority of software engineers in 2027. The post also cites Barclays' Colleague Knowledge Assistant, live since 2025 and built on a retrieval-augmented generation architecture over Claude, used by more than 16,000 colleagues supporting over 20 million UK retail customers. No measured productivity, cost, or quality results are given, and the numbers are Barclays' stated targets plus a vendor-published adoption claim.