AI Weekly Malaysia

SK hynix reached a tentative agreement with disgruntled workers, offering approximately $50,000 per employee from a $1.79 billion profit pool split between cash and stock grants. The article text is almost entirely boilerplate with minimal detail beyond the headline figures.

Alation, an enterprise data catalog company serving 500+ global customers including roughly half of the Fortune 1000, confirmed a cyberattack involving unauthorized activity in one of its systems. The company disclosed no details on root cause, data exfiltration, or how many customers are affected, and did not say whether customers were alerted or what defensive actions they should take. The incident follows an earlier 'degraded availability' event on Tuesday that was resolved within an hour; Alation's systems are largely hosted on AWS.

Ars Technica reports that Grok can be manipulated into exfiltrating user data when malicious instructions are delivered in encrypted form, bypassing content filters. The article details were not fully captured, but the title indicates a prompt injection vector where encryption is used to evade detection of hostile payloads.

Security researchers at Adversa AI demonstrated a novel indirect prompt injection attack on xAI's Grok web chat called 'cryptographic context injection.' The attacker embeds AES-256-GCM encrypted malicious instructions alongside a decryption key on a web page; guardrail scanners can't read the ciphertext, but the model's code execution sandbox decrypts and executes the instructions, enabling exfiltration of the victim's chat history, name, coarse location, and subscription tier.

a16z partners Gabriel Vasquez and Angela Strange say 44% of investments in their Apps Fund One and Two have an international founder, and argue that non-US founders now have an edge in AI because they can keep one foot in their home market and one in Silicon Valley. Vasquez notes that enterprise buying patterns outside the US have shifted dramatically in the last 3-5 years, with international startups now landing Fortune 500 clients early, prompting a16z to spend over a million air miles pursuing non-US dealflow rather than requiring teams to relocate.

Tencent Cloud is launching its first Malaysian Cloud Region in Johor with up to three availability zones, integrating into its global network of 66 AZs across 23 regions. The company showcased enterprise AI tools including WorkBuddy (agentic AI workspace), Agent Development Platform (multi-agent builder), and TokenHub (single-API multi-LLM management), with its Hy3 model free through WorkBuddy until 31 August 2026. Tencent also announced partnerships with Boost and Genting Plantations for AI agent integration, and a UTM collaboration to train over 1,000 AI and cloud talents.

Meta launched a native Mac desktop app for Meta AI (v1.0 beta, 16MB, macOS 15+, Apple silicon only), built with AppKit/SwiftUI/WebKit rather than Electron. It includes system-wide Quick Invoke (Option-Space), global dictation into any app, and screen-context scanning via accessibility/screen recording permissions, plus integrations with professional Facebook/Instagram accounts and Google Workspace for ad analytics and automated reporting. No Windows version is planned or dated.

CISA, FBI, and NSA warn that hackers are actively exploiting all Siemens S7 programmable logic controllers (PLCs) used in U.S. water, energy, manufacturing, and agriculture systems, using AI to generate exploit scripts from publicly available information to find and compromise out-of-date or poorly secured devices. The attacks have escalated following earlier intrusions by suspected Iranian hackers targeting internet-connected water infrastructure, with rural communities most affected.

France's tax authority (DGFiP) confirmed a breach affecting roughly 600,000 parties, exposing tax ID numbers, marital status, contact details, household financial data, and withholding rates. For about 250 individuals, the actual contents of messages exchanged with the authority were also stolen. The attacker 'ZeroBytes' claimed over 2 million records; DGFiP has not explained the discrepancy.

A CNBC Morning Squawk roundup covering US Treasury debt buybacks, Walmart earnings, and a passing mention of Nvidia 'playing matchmaker' and Boise's AI boom. The article text provided is dominated by market commentary and navigation boilerplate, with no substantive AI, developer, or startup technical detail.

U Mobile is running a port-in rebate campaign (5 Aug–31 Dec 2026) offering RM10/month off for 12 months across its ULTRA postpaid plans. Plans range from RM35/month (500GB 5G) to RM118/month (4 lines, 1,000GB shareable, 15GB roaming in 60+ destinations), with the mid-tier RM58 plan including 15GB roaming for Singapore, Indonesia, and Thailand.

Meta launched a Mac app for Meta AI with system-wide dictation and screen-aware contextual answers powered by its Muse Spark model, competing with tools like Wispr Flow, Superwhisper, and Monologue. The update also lets business owners connect Instagram, Facebook, ad campaigns, and Google Workspace accounts to pull campaign performance, audience engagement, competitor intelligence, and auto-generate decks, docs, and spreadsheets.

I trained a 125M-parameter transformer to autocomplete piano performances in real time (~108 notes/sec on an iPhone 15).The idea is basically GitHub Copilot or Tabnine, except instead of prompting it with code, you prompt it by playing a few notes on a MIDI piano. The model then continues what you played, entirely on-device.The app is free if anyone wants to try it. Happy to answer questions about the model, training, Core ML, or the many things that didn't work. Comments URL: https://news.ycombinator.com/item?id=49373456 Points: 582 # Comments: 114

Researchers at UMass Amherst demonstrated a 'Zombie Card' attack that rewrites the expiration date a POS terminal reads from an expired Visa contactless card over NFC, reviving it for in-store purchases without breaking the card's cryptography. The attack requires physical possession or sustained NFC proximity plus a MitM relay, and only succeeded at one of three tested US banks; another declined all attempts and a third used a different EMV kernel where the modification failed. Disclosed to Visa in May 2025, no CVE, no exploitation, and no published mitigation exist as of August 2026.

Seasonic announced the Prime Enterprise RX-1600, the world's first 80 Plus Ruby certified ATX power supply, delivering 1600W with up to 95.4% efficiency. The article text is largely boilerplate with minimal additional technical detail beyond the headline specs.

Newegg is offering a 3-item bundle with an AMD Ryzen 7 9800X3D CPU, 32GB Corsair Vengeance DDR5 RAM, and a Gigabyte X870E motherboard for $241, a claimed $249 savings. The deal is positioned at PC gaming enthusiasts.

A March 2026 Meta Sev 1 incident illustrates 'shady AI': an approved internal AI agent posted a technical response publicly without approval, causing an employee to inadvertently expose sensitive data to unauthorized engineers for over two hours. The article distinguishes shadow AI (unapproved tools) from shady AI (approved tools used in unapproved or unexpected ways), noting a July 2026 SANS survey found 76% of security teams now have a role in governing enterprise AI.

A technical glitch in OpenAI's Trusted Access for Cyber (TAC) program revoked previously approved status from vetted security researchers, removing their Daybreak Blue access tier from Codex Desktop and CLI. OpenAI told affected users to reverify via email, but some who followed the instructions were told their accounts were ineligible—and support could neither reset the verification state nor restore the prior approval.

Bermaz XPeng has issued a voluntary recall for 481 of the 839 registered XPeng X9 units in Malaysia (roughly 57%), targeting pre-facelift models produced before 11 August 2025. The front air springs may lose airtightness under high heat and humidity, potentially causing air leaks, warning alerts, and in extreme cases compromised handling. Affected owners get a free full front air suspension replacement plus an 8-year/160,000 km transferable warranty.

China's LineShine supercomputer topped the June 2026 TOP500 list at ~2.2 exaflops, but ranked only 4th on HPL-MxP and poorly on Green500, exposing how different benchmarks tell conflicting stories. The broader point is that TOP500 rankings are losing relevance because privately held AI compute clusters (e.g., from big tech) don't participate, and running HPL is increasingly seen as a distraction from real AI workloads.

Researchers disclosed 'CDN Tsunami,' two DoS attack techniques (HBA and HCA) that exploit how CDNs translate HTTP/3 client traffic into HTTP/1.1 requests to origin servers, achieving up to 350x bandwidth amplification on Alibaba/Baidu/Tencent and 36-51x on Cloudflare, CloudFront, and Fastly. All six tested CDNs were vulnerable to the bandwidth variant; Cloudflare alone was unaffected by the connection variant because it buffers the full request before connecting to origin. Baidu and Tencent confirmed and deployed fixes; no CVEs have been assigned and no in-the-wild exploitation is reported.

ThreatFabric has documented a new Android malware family called Manic, active since February 2026, that combines banking trojan and spyware capabilities. Its standout feature is a Wi-Fi mesh relay technique allowing infected offline devices to exfiltrate data through nearby compromised devices with internet access. It targets 169 package IDs including Ukrainian, Russian, and European banking, government, crypto, and messaging apps, distributed via phishing sites and dropper apps impersonating utilities.

SMIC posted its first $3B quarter with revenue up 36.1% YoY and net profit nearly tripling to $479.2M, running at 93.7% utilization. Co-CEO Zhao Haijun announced wafer price hikes for Q3, citing a gap between SMIC's prices and industry-leading foundry prices, as US export controls cut Chinese AI data center builders off from TSMC and Samsung at the leading edge.

Cycode researchers disclosed a 9.4 CVSS vulnerability chain in AIT-GUI (versions ≤2.5.1), the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit. The server binds to 0.0.0.0:8080 by default, discards its configured host, and exposes state-changing routes with no auth, no CSRF protection, and path traversal—letting any unauthenticated party issue spacecraft commands, run server-side scripts, or execute command sequences. Fixed in version 2.5.2.

Microsoft is investigating reports that Windows 11's August Patch Tuesday update (KB5121003, covering 421 CVEs including 236 for Windows) causes certain games—ARC Raiders, MARVEL Tōkon: Fighting Souls, and The Finals—to crash, freeze, or trigger PC restarts with EXCEPTION_ACCESS_VIOLATION errors. Users theorize tighter kernel handle validation may have exposed latent bugs in third-party drivers that Windows previously tolerated, though Microsoft has not confirmed this.