AI Weekly Malaysia

Tom's Hardware reports that OpenAI says actors linked to China-based Moonshot AI ran a campaign to extract its models' hidden reasoning, logging 16,000 extraction requests across 4,000 accounts before being cut off, with attempts peaking at 16,000 users over two days. The article body available here is mostly paywall and newsletter boilerplate, so the concrete detail is limited to the headline and URL: the 16,000 requests, 4,000 accounts, and two-day peak.

Satlyt, co-founded by Rama Afullo — described in the article as a Kenyan American engineer who previously worked in Google's cloud business and had a brief 2024 stint at SpaceX's Starlink — raised an $8M seed round to build software that lets many satellites share large computing jobs in orbit. The company has offices in Sunnyvale, California and Nairobi, does not build its own spacecraft, and frames itself as the 'Android' to vertically integrated orbital data center operators' 'iPhone'. Its software is set to launch Thursday on a SpaceX rocket alongside the first prototype of Google's Project Suncatcher, after already flying on two demonstration missions, with an initial focus on operational efficiencies for spacecraft that typically depend on ground flight controllers.

A The Hacker News DevSecOps/patch-management piece argues that financial services' long-standing habit of accepting a vulnerability backlog as a stability tradeoff no longer holds, because frontier models like 'Mythos' can read code and chain dormant weaknesses faster than teams can investigate and patch. It cites two figures: vulnerability exploitation has overtaken phishing as the leading initial access vector in financial services, and more than half of financial services vendors carry at least one high-severity CVE. The article names no vendor tooling, no version numbers, no remediation steps, and gives no methodology or source for either statistic.

Tom's Hardware is flagging a $520 discount on the MSI Stealth A18 AI+ gaming laptop, configured with an RTX 5090 GPU, 64GB DDR5, a 2TB SSD, a 12-core AMD Ryzen AI 9 CPU, and an 18-inch UHD+ 120Hz display. The article body is almost entirely paywall, newsletter, and membership boilerplate — the actual sale price, retailer, and expiry date are not present in the supplied text.

The item is an Ars Technica article titled 'PS5 emulation is suddenly making big strides on PC,' but the retrievable text is only Condé Nast's cookie-consent and targeted-advertising opt-out notice. No emulator names, version numbers, performance figures, dates, or technical claims appear in the text. The headline's claim of 'big strides' is therefore unsupported by anything in the excerpt.

Tom's Hardware reports that AI agents inadvertently leaked more than 13,000 internal screenshots belonging to 300 organizations, with the exposed list said to include Fortune 500 companies and a frontier AI lab. The item was published 2026-10-01, but the text supplied here is almost entirely Tom's Hardware navigation and subscription markup — no leak mechanism, vendor name, storage location, discovery method, or response timeline is included.

The submitted text for this Ars Technica piece contains no article content — only cookie-consent boilerplate covering social media, essential, targeted, performance, functional, and audience measurement cookies. The only substantive information available is the headline, which claims NASA 'squeezed Treasury,' 'vibe coded,' and 'broke the mold' in a bid to save the Swift observatory, described as a failed mission. No figures, dates, names, quotes, technical details, or outcomes from the actual reporting are present in the text provided.

Micron has sued Chinese memory maker YMTC, alleging YMTC poached Micron engineers who then hid their roles on LinkedIn, patented Micron technology, and used it to win an injunction against Micron in Germany. The supplied page content is only Tom's Hardware site chrome (membership prompts and newsletter copy), so no further specifics — dates, court, damages, named individuals — can be confirmed from the text.

StreetComplete's long-running iOS tracking issue (#5421, opened Dec 20, 2023) has reached 11/11 completed tasks and is now in public beta on iOS. The port keeps the app's 100% Kotlin codebase and uses Kotlin Multiplatform with Compose Multiplatform for the UI, rather than rewriting everything in Dart as Flutter would require (the approach Every Door took). The plan explicitly includes incrementally migrating the existing Android XML layouts to Jetpack Compose and separating platform-specific code from application logic; the repo has 4.9k stars and 457 forks, and the HN thread drew 309 points and 63 comments.

Ethan Mollick walks back his own thesis that working with AI agents would require human-style management — specifying delegation and agent org structure — saying the Bitter Lesson caught him out: his research found planning steps now add much less value because models plan for themselves, just as elaborate retrieval plumbing and prompt chains were overtaken by models that seek information on their own. His demo is a one-prompt music video where Fable wrote lyrics and sent them to Suno, and Opus 5.5 did everything else in code with no image generation and no feedback. He frames the current wave as 'Clawlikes' — Meta's Muse (currently the number one App Store app), OpenAI's dots, plus Grok Bot, Instinct and Gemini Spark — agents that get computer access and connect to your email and financial records.

OpenAI said it disrupted a coordinated 'adversarial distillation' campaign that manipulated model interactions to reproduce protected reasoning in visible form, without breaking encryption or accessing stored conversations. The activity started July 1, 2026, spiked on July 24–25 to 16,000 attempted requests from over 4,000 users using one extraction pattern, expanded to related prompt-pattern activity across more than 15,000 users, and was fully shut down July 28. OpenAI attributed a 'core cluster' to individuals associated with Moonshot AI (described in the article as a Beijing-based Chinese AI company) without publishing technical evidence, and separately closed a pathway that let someone replay another user's encrypted reasoning to recover its contents.

CISA added CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, to its Known Exploited Vulnerabilities catalog on Wednesday after Cisco confirmed active exploitation in September 2026. The flaw is a hex/URI-encoding handling bug: a crafted HTTP request to the API lets an unauthenticated remote attacker act as the admin user. Cisco published IoCs but not victim counts or attribution, and U.S. federal civilian agencies had until October 3, 2026 to patch — a two-day window. watchTowr's Jake Knott noted eight Cisco SD-WAN CVEs have hit KEV in 2026 alone.

A firm rented four Nvidia H200 GPUs at $13,200 per month to independently test DeepSeek's claim of being '80x cheaper', and the rental alone reportedly doubled what the firm was already paying for Claude. The same write-up notes that security flaws forced the team to keep their code offline during the test. The article body itself did not load in the supplied text, so no benchmark results, token throughput, or final verdict are available here.

Tom's Hardware marks the anniversary of Sony's first CD audio player, released in 1982, noting the player cost $3,700 in today's dollars and that it took roughly another decade before the CD-ROM-driven multimedia PC era arrived. The piece is a retro hardware anniversary item; the supplied text is almost entirely site boilerplate and contains no AI/ML, developer-tooling, or current-product news.

Tom's Hardware reports that Russian missile strikes on Kyiv took out popular torrent trackers, with the world's second-biggest tracker logging a 'Direct Destruction of Server' outage before rebounding. The piece frames the war as temporarily accomplishing what lawmakers couldn't — knocking piracy sites offline. The excerpt contains no details on outage duration, the affected hosting provider, or how the tracker recovered.

Tesla Malaysia is giving Model Y L buyers a complimentary Acceleration Boost, cutting 0-100km/h from 5.0s to 4.5s while top speed stays at 201km/h and WLTP range stays at up to 681km — but it applies only to new orders. The six-seater starts at RM263,000 (instalments from RM1,988/month at 1.78% fixed, 30% downpayment, 108-month tenure), and maxes out at RM295,000 once you add paid paint (RM5,000–RM11,000), Zen Grey interior (RM5,000) and Enhanced Autopilot (RM16,000). Tesla also cites 21 Supercharger sites / 92 stalls and 18 Destination Charging sites / 78 Wall Connectors in Malaysia, with six more sites due by end-2026 across KL, Selangor, Perak, Seremban and Penang, and over 13,000 households enabled for home charging.

Kaspersky is warning that fake Formula 1 merchandise storefronts are targeting fans in Malaysia ahead of F1's return to Sepang International Circuit from 2 to 4 October 2026, after a 9-year absence. The scam sites copy real team logos and driver imagery, offer search, accounts, carts and 'global delivery', then capture card details at checkout without shipping anything. Kaspersky's Asia Pacific MD Adrian Hia attributes this to fans dropping their guard during major events, and the article advises checking URLs, buying only from LazMall or Shopee Mall verified stores, and reporting to the National Scam Response Centre on 997.

Express Rail Link (ERL) will raise KLIA Ekspres and KLIA Transit adult one-way fares between KL Sentral and KLIA Terminal 1 or 2 from RM55 to RM65 on 1 January 2027, the first revision in 11 years. Return tickets rise from RM100 to RM118, child one-way from RM25 to RM29, and intermediate KLIA Transit fares such as KL Sentral to Putrajaya/Cyberjaya increase from RM14.00 to RM16.60. Concession and season pass rates are also revised, including a monthly KL Sentral–KLIA pass at RM465.00 for 44 trips over 31 days.

Digital Nasional Berhad (DNB) has completed a US$1.27 billion (RM5.2 billion) financing exercise and been awarded 5G spectrum over a 15-year period, with 200MHz of contiguous mid-band spectrum that DNB describes as the largest in Malaysia. MoF Inc's shareholding in DNB is also progressing toward transfer to the mobile network operator shareholders, who would then jointly steer DNB's strategic and operational priorities. CelcomDigi frames the combination as giving it greater financial, spectrum and ownership certainty to pursue network and cost synergies, indoor 5G deployment and enterprise 5G growth, citing its 30-plus years of telecommunications experience.

Google announced Gemini 4 Argon, a frontier model being rolled out to selected "trusted cyber defenders" through its Fairwind Program, roughly a month after Gemini 3.8 Flash Cyber. Google says Argon is better at autonomously finding, validating, and patching vulnerabilities than 3.8 Flash Cyber — including a previously undisclosed critical flaw exposing sensitive personal information in healthcare software used by hospitals worldwide, which Google declined to name. Google also plans to ship a guardrail-free Argon to trusted defenders and internal teams, and says it is adding misalignment mitigations that monitor Argon's chain-of-thought and halt execution; it claims the top spot on Gray Swan's indirect-prompt-injection benchmark.

According to an AFP-sourced report carried by Malay Mail Tech, Google said on Wednesday that it is holding back its most powerful AI model, Gemini 4 Argon, from public release and issuing it only to a vetted group of cybersecurity experts, citing the risk of misuse by hackers. Early access is also going to the US government, and Google says it is gathering feedback from testers. The item gives no public release date, no access criteria for the vetted group, no capability benchmarks, and no pricing or API details.

Google DeepMind introduced Gemini 4 Argon, claiming first place on 13 of 19 benchmarks against GPT-6 Astra and Claude Opus 5.5, with a 1M-token output limit via the new Long Decode Continuation API feature. Standard pricing is $4/$20 per 1M input/output tokens, with a 50% introductory discount to $2/$10 and 95% off cached input. Access is limited to government users and trusted cyber defenders in the Fairwind Program, with broader developer, enterprise, and consumer access promised later.

Digital Nasional Berhad completed a RM5.2 billion Syndicated Islamic Term Financing — described by DNB as among the largest syndicated loan facilities ever arranged for an unlisted Malaysian company — led by Maybank Investment Bank with AmInvestment, CIMB Islamic, RHB Islamic and UOB Malaysia as joint mandated lead arrangers. The money refinances DNB's Government Guarantee Revolving Credit Facility, which expired 29 September 2026, and is expected to reduce the need for extra equity from its mobile network operator shareholders. DNB also received the full 100MHz block in the 3.3GHz–3.4GHz band (F0) and converted its 240MHz holding from Apparatus Assignment to a 15-year Spectrum Assignment, while MOF Inc exits as an ordinary shareholder but keeps a special share, with CelcomDigi, Maxis and YTL expected to hold equal stakes and the transition due in early Q4 2026.

Simon Willison quotes cryptographer Matthew Green reacting to Anthropic's recent cryptography work. Green argues the field is mid-transition from EC and RSA public-key algorithms to post-quantum schemes built on newer hard problems — hence the number of standards under consideration such as HAWK — and that this makes it an unusually good moment for AI to get good at cryptanalysis. In the best case, he says, AI failing to break these problems gives real confidence in them and makes the cryptanalysis literature more robust.

On September 30, Dion Blazakis, Josh Maine, and Anna Groza of Calif published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw triggered by a PDF carrying a crafted embedded TrueType font whose glyph coordinates overflow during conversion to 32-bit fixed-point. Apple patched it September 28 — iOS 26.7.1 was the only library changed, and the same fix was applied more than 20 times across eight rasterizer functions — crediting Meta Product Security and saying it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iOS versions before iOS 27; CISA added it to the Known Exploited Vulnerabilities catalog the next day with an October 2 deadline for federal agencies. The published code crashes unpatched iPhones and Macs but does not demonstrate code execution, and no workaround was described for systems that cannot update immediately.