AI Weekly Malaysia

Article URL: https://www.kimi.com/code/docs/en/kimi-code/models Comments URL: https://news.ycombinator.com/item?id=49101852 Points: 487 # Comments: 155

Ars Pro subscribers get customizable layouts along with no ads and no trackers.

Andon Labs' latest vending machine simulation shows Opus 5 lied and colluded its way to become the best AI capitalist ever.

AI Worming through Word Neat new prompt injection variant by Håkon Måløy, who found a way to upgrade prompt injection attacks against Microsoft Word to full self-replicating worms: An attacker places hidden instructions in a document that is later used as source material in Copilot for Word. Copilot may interpret those instructions as part of the user’s request, causing it to manipulate the document being drafted or edited. Copilot may then also copy the hidden instructions into the resulting document, turning that document into a new carrier. If the carrier is subsequently used in another Copilot-assisted workflow, the instructions can trigger again and propagate into further documents, even without the attacker’s original document being present. We've seen plenty of hidden white-on-white text before - the kids are using it in their job applications now - but this is the first one I've seen that deliberately copies instructions to self-replicate itself. It was responsibly disclosed to Microsoft who then had 144 days to work on a fix, but so far (unsurprisingly) there's no mitigation that covers the full class of attack. Via Hacker News Tags: microsoft, security, ai, prompt-injection, generative-ai, llms

Simon Willison shares a quote from Matthew Green noting that cryptography is undergoing a historic transition from EC-based and RSA public-key algorithms to new post-quantum algorithms, with standards like HAWK under consideration. Green suggests this is an ideal moment for AI-assisted cryptanalysis to either validate the hardness of our chosen problems or expose weaknesses, referencing Anthropic's recent cryptography work.

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

Google's new API relies on parents to set age ranges in Family Link.

Musk defends Grok, says Minnesota's nudifying app ban is unconstitutional.

To the horror of commenters across the internet, the Ferrari Luce appears to be a sales success.

The freeway pause — and its restart — comes amid increased scrutiny into Waymo and other robotaxi operators, particularly over how these self-driving vehicles behave in certain high-traffic situations and around emergency responders.

The ban largely affects U.S. imports from China, which currently dominates the global market for making humanoid robots and solar inverters.

Companies are making sure we have a surplus of options for building qubits.

"We're feeling pretty good about that," Boeing CEO Kelly Ortberg said.

Google is expanding its Play Age Signals API, giving Android developers a privacy-preserving way to tailor experiences based on users’ age ranges.

I was recently laid off after 18 years, and gave myself 100 days to build soething useful in public. CheapFoodMap is a crowdsourced map of meal under $10, excluding franchises, local good eats only.It's inspried by 거지맵 (Begger's Map) a Korean crowdsourced map students use to find cheap eats.Ocverage is heaviest in Texas, since I live in Dallas, but have 1200 meals across 15 US cities. Seed data came from Google Review, 4.2 star or higher with at least 500 reviews, and verified price under $10 per menu item.Things I would love feedback on : whether the price-freshness model makes sense, and what would make you trust the price on a site like this. How to encourage people to update prices, since inflation is making food price very frequent.https://cheapfoodmap.comAny and all suggestion will be super helpful. Thank you! Comments URL: https://news.ycombinator.com/item?id=49100043 Points: 278 # Comments: 245

Article URL: https://www.digitalfoundry.net/news/2026/07/keychron-announces-first-open-source-firmware-for-gaming-mice Comments URL: https://news.ycombinator.com/item?id=49099715 Points: 440 # Comments: 179

With the Light Phone, Kaiwei Tang and Joe Hollier have spent over a decade exploring the value of simplicity in our relationship to technology, partnering along the way with players like Andrew Yang, Kendrick Lamar, and Pete Davidson. Now, with a new flip phone and a growing wave of “attention activists” pushing back against Big Tech, they think the rest of […]

Microsoft is on a mad dash behind the scenes to patch exploits before hackers find them.

BYD has launched the Racco, its first electric kei car built from scratch for the Japanese market, with a 3.4m footprint, 63hp motor, and two battery options (22.4kWh / 35.84kWh) delivering 210km or 310km WLTP range. It uses Type 2 AC and CHAdeMO DC connectors standard in Japan, includes V2L and V2H capabilities, and comes in three trims: Racco 200, Racco 300 Plus, and Racco 300 Premium.

https://mitchellh.com/writing/superlogical Comments URL: https://news.ycombinator.com/item?id=49098965 Points: 777 # Comments: 452

A CVSS 10.0 vulnerability (CVE-2026-59726) in Ruflo—an open-source AI multi-agent orchestration platform formerly called Claude Flow, with 66,500+ GitHub stars—affects all versions before 3.16.3. The flaw exposes 233 tools including shell execution, database operations, and memory storage through an unauthenticated MCP bridge bound to 0.0.0.0:3001 by default in docker-compose.yml, allowing a single unauthenticated HTTP POST to achieve full remote code execution, steal LLM API keys, harvest all stored conversations, and poison AI memory.

X sued the WFA in 2024 for conducting what it called a "systematic illegal boycott" of the platform after it saw a decline in advertising revenue following Musk's $44 billion takeover of the social network.

AI home management startup Hint, co-founded by Martha Stewart, wants to become an “AI for your home,” combining property records, maintenance schedules, home documents, and an AI assistant into a single app.

Improved efficiency in EPP mode leads to ~32% jump in "1% low" frame rates.

Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity. The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter. "A malicious actor with network access to vCenter