AI Weekly Malaysia

Bitget confirmed that the $387.5 million drained from its hot and warm wallets on September 24, 2026 was enabled by a zero-day in unnamed third-party security products, per a SlowMist investigation. Attackers used the flaw to read a database password from an environment variable, run hidden scripts on at least three nodes starting August 31, 2026, obtain high-level internal credentials, and issue withdrawal commands that bypassed existing risk controls. Funds were taken across 11 blockchains and 13 assets, and only about $632,700 was frozen by Circle, Tether, and NEAR Intents.

MetaMask said on Thursday (Oct 1, 2026) it is responding to an "ongoing security incident" affecting part of its infrastructure, stating it found "no immediate threat to MetaMask wallets" but disclosing no further details. As a precaution it is proactively exiting affected validators in its non-custodial staking operations; Lido said relevant validators have begun exiting and the final ones are expected to be exited (but not fully withdrawn) by the end of October 7, 2026, which will likely mean foregone rewards and possible downtime penalties. MetaMask stressed the staking operation is non-custodial and it does not hold clients' withdrawal keys.

Attackers are exploiting CVE-2026-88771, a CVSS 9.5 pre-authentication command injection flaw in Citrix NetScaler ADC and NetScaler Gateway, to drop web shells and stage configuration data. LevelBlue's THOR team, analyzing activity across multiple customer environments, found authentication events with attacker-controlled usernames containing 'pitboss' and 'NSPPE' strings, plus payload fetches via curl/wget from IPs including 64.94.85[.]67, 31.56.197[.]72 and 23.27.143[.]20. Second-stage payloads include a Perl script (update_c08937.pl) that edits /flash/nsconfig/ns.conf to create a local account named sec_monitor with the superuser role, and a Python script (main.py) that opens a reverse shell to 45.141.21[.]130:443 and kill -9's processes tied to /var/python/bin/customsnmpd. The disclosure follows reports that NCSC-NL pre-notified Dutch organizations and urged shutting appliances down; no attribution is given. The excerpt is truncated, so the 'CSS-like URL' web shell detail in the headline is not substantiated in the text provided.

A Hacker News thread (255 points, 105 comments) centers on a developer's X post describing their run-in with Google's Android Developer Verification Program: their personal Play Store account was closed for inactivity, they could not create a replacement Play Console account, and when they turned to shipping an APK via F-Droid they say they hit a $25 verification fee plus an identity check. The post also claims that even distributing to fewer than 20 users requires a verified payments profile and an answer to a question about publishing on Android. The article text is a truncated copy of that post, so the program mechanics are reported second-hand from one developer's experience, not from Google's own documentation.

Grab has updated drop-off rules for the F1 Bahrain Grand Prix race weekend at Sepang International Circuit: only Grab Standard 6 Seater vehicles can access the circuit gates directly, while Standard four-seater, Advance Bookings, and Group Rides are prohibited from entering the main venue area. All other Grab tiers must set their destination to one of four shuttle hubs: Long Term Car Park, Mitsui Outlet Park KLIA, KLIA Terminal 2, or Bandar Baru Enstek at SK Kompleks KLIA. From the Long Term Car Park, passengers can board free Grab chartered shuttles to the circuit, with priority boarding for Grab passengers.

Microsoft has overhauled Copilot from a sidebar chatbot into an autonomous workspace hub with three parts: Home (splitting tasks into Chat for lookups and Cowork for delegated end-to-end workflows like financial reports, tender documents and launch kits), Code (powered by the same engine behind GitHub Copilot, letting non-developers build dashboards, desktop widgets and cloud-hosted internal apps inside a sandbox called Microsoft Copilot Managed Runtime), and Autopilot, an evolution of the agent previously known as Scout that gets its own cloud computer instance, workspace, memory and identity inside an organisation and can run supplier reviews and recurring meetings across Teams and Outlook unsupervised. Word, Excel and PowerPoint are now embedded directly into Copilot, with PowerPoint enforcing company brand guidelines and Excel tracking collaborative edits. The excerpt carries no pricing, licence tier or rollout dates, and cuts off mid-sentence.

TNG Digital and Webull Securities Malaysia have launched a Webull Mini Programme inside TNG eWallet's GOfinance hub, letting users open a Webull trading account digitally and fund it from their eWallet balance without a separate app. The mini programme covers US and HK securities plus CN A-shares with basic charting and educational content, but excludes Bursa Malaysia equities (REITs, structured warrants, ETFs), local index futures (FKLI/FKLM), FCPO, and international futures/FX access that the standalone Webull app offers, which also carries 58+ indicators, Level 2 data and a desktop terminal. Launch promo: open an account via TNG eWallet, deposit at least RM200 and hold it 30 days to get RM30 in Apple fractional shares; Webull has held a Capital Markets Services Licence from the Securities Commission Malaysia since launching locally in May 2024.

Meta appointed Dhruv Vohra as managing director of its global business group for Southeast Asia, covering Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam, reporting to Asia Pacific VP Benjamin Joe. Vohra joined Meta in 2019 leading e-commerce and digital-native work and later SMB growth across SEA and APAC, and the announcement says his remit centres on helping advertisers and agencies use AI and Meta's apps, plus regional partnerships. The post is a leadership announcement with no product, pricing, API or policy change attached.

DC Handal has turned on a 180kW Autel DC charger at the BHPetrol station in Taman Perindustrian Temerloh, its first charger in the Mentakab/Temerloh area and about 7 minutes from Mentakab town. The unit has two CCS2 nozzles and is priced at RM1.30 per kWh, with activation by tapping a credit/debit card or TNG eWallet QR at the terminal, or through Gentari Go, Jomcharge and ChargEV. The article notes TNB Temerloh already offers a 240kW DC charger with four CCS2 nozzles, and that DC Handal recently switched on a 240kW charger at Zenith Hotel Kuantan.

OpenAI said it identified and disrupted a coordinated campaign to extract protected reasoning from its AI models, linking a core cluster of the activity to Chinese startup Moonshot AI, the developer of Kimi. The activity began in early July and surged to 16,000 requests from more than 4,000 users over two days, with related activity eventually identified across a cluster of more than 15,000 users; OpenAI says it fully disrupted the campaign by July 28. OpenAI stated the operators did not breach its encryption, databases, or stored user conversations, and the disclosure comes weeks after Anthropic accused Chinese AI developers including Moonshot AI and Alibaba of secretly using Claude to help train their own models.

Exabytes founder and CEO Chan Kee Siak argues Malaysian SMEs get little from agentic AI unless they re-engineer existing workflows and have bosses who personally use AI, recommending phased adoption starting with standalone agents. He cites an Ecosystm and Red Hat study of 133 Malaysian SMEs, supported by the National AI Office, showing only 21% moved past AI pilots and about 60% cited a lack of in-house technical expertise. Exabytes itself is putting more than 50% of its budget into AI, targeting one million businesses adopting AI by 2030, opened an HPC/AI colocation facility in Penang, signed an MoU with Aurora Mobile, and now draws roughly 30% of revenue from AI and cloud.

CNBC's investing club raised its Micron price target after Micron's fiscal 2026 fourth quarter (ended Sept. 3) beat consensus: revenue up 379% year-over-year to $54.23 billion versus the $51.07 billion LSEG consensus, and adjusted EPS up 1,002% to $33.42 versus $31.61 expected. Management said fiscal 2027 should be another strong year because demand for its memory products continues to exceed supply. The stock rose roughly 11% in September and is up about 275% for the year, but sits 12% below its June 25 record close of $1,213, and shares finished roughly flat after hours.

Anthropic introduced mods for Claude Code: small TypeScript functions that hook into events Claude Code emits (tool calls, permission prompts, UI draws) to run before, after, instead of, or wrapping them. A mod can rewrite prompts before they reach the model, block/retry tool calls, approve or deny permissions, redact secrets from tool output, and add or replace UI elements in the CLI, desktop app, or both. Mods ship inside plugins and are explicitly not sandboxed — they run with the same machine access as Claude Code itself, so the post says to install only from trusted sources.

OpenAI published a customer story about The Den Family Social, a Denver-based social club, claiming its leadership team saves 10-15 hours a week using ChatGPT Work with Gmail, Slack, and Google Drive plugins. The post says a second liquor-license application took 3 hours instead of 4 days, and grant applications take 2 hours instead of 3 days, with the team still reviewing output and making final decisions. No pricing, model version, feature launch, or independent measurement is included.

Anthropic published a customer announcement that Barclays is expanding its use of Claude across the bank, targeting Claude Code adoption by 50% of its developer population by end of 2026 and a majority of software engineers in 2027. The post also cites Barclays' Colleague Knowledge Assistant, live since 2025 and built on a retrieval-augmented generation architecture over Claude, used by more than 16,000 colleagues supporting over 20 million UK retail customers. No measured productivity, cost, or quality results are given, and the numbers are Barclays' stated targets plus a vendor-published adoption claim.

Google launched Gemini 4 Argon on September 30, 2026, described as its most powerful model yet, with a specific focus on defensive cybersecurity work. It is not generally available: Argon is rolling out only to a select group of Google's cyber partners through its Fairwind Program, and Google claims it can autonomously find, validate, and patch critical software vulnerabilities. Google also says Argon handles coding, debugging, codebase migrations, and long-video or chart analysis, and cites the Vals benchmarking index to claim it beats OpenAI's GPT-6 Astra and Anthropic's Fable and Opus models.

Defense Secretary Pete Hegseth used a "State of the Force" address on Wednesday, September 30, 2026, to launch Project Meridian, a study of how future wars will be fought as technology advances. Elon Musk, Anduril founder Palmer Luckey, and former House Speaker Newt Gingrich will co-lead it under Defense Department CTO Emil Michael, with a 120-day deadline to submit findings and propose actionable solutions for developing, testing, and fielding advanced technology. Hegseth also announced an Autonomous Warfare Command to speed up development and deployment of autonomous systems and drones; the study is said to come through an unnamed partner organization, and the Pentagon declined to say more beyond the Secretary's comments.

In a Mad Money segment, Jim Cramer said 'market after market is getting frozen right now and that's killing stocks,' citing a 30-year U.S. mortgage rate around 7.5% (up from about 3% five years ago), slowing IPO and M&A activity, and new obstacles facing the data-center buildout. He named housing-exposed stocks Lennar, KB Home and Home Depot as examples of the drag, and argued investors should stay in the market anyway.

On Tuesday, Sept 29, 2026, President Trump hosted a White House lunch with executives from Alphabet, Meta, SpaceX, Nvidia, Palantir, Anthropic, OpenAI and others, and the outcome was a signed document calling for AI companies to self-regulate with the help of outside evaluators. The article states the industry is back where it started on AI safety, with Trump opposing government regulation and calling AI fears a "hoax," despite Anthropic CEO Dario Amodei and other researchers warning this month about extreme threats from the most powerful models. Tusk Ventures CEO Bradley Tusk noted that two weeks earlier almost all those same CEOs had said they should be regulated.

Latent Space's DevDay 2026 episode (its first DevDay pod) features OpenAI's Computer Use (CUA) team and API platform leads, pushing back on Dwarkesh Patel's June 27, 2026 argument that computer use progress has been slow because the domain is 'clearly verifiable.' The counter-frame offered is that 'grindability is just as important as verifiability,' with guest Ari Weinstein (Sky cofounder, now working on CUA) describing computer use as '180 degrees different' from months ago as agents learn to debug and recover from failures. Concrete shipped artifact referenced: Computer History in ChatGPT, released Aug 14, 2026, which lets ChatGPT learn from everything you do on your computer, with a timeline view for reviewing that history.

56k.rip is a browser project recreating the 1996 dial-up internet experience, submitted to Hacker News where it drew 240 points and 97 comments. Only the title, URL, and comment link were available; the article itself could not be read, so no details about how the simulation works, what it renders, or what stack it uses can be confirmed.

Dwayne A. Day's Space Review piece covers the recent declassification of a family of small NRO electronic-intelligence subsatellites — URSALA, RAQUEL, FARRAH, GLORIA and CARRIE — that rode as 'hitchhikers' off the sides of large HEXAGON photo-reconnaissance satellites. The first flew in 1963, and twenty HEXAGON satellites launched from California between 1971 and 1986 with one failure; the suitcase-sized spacecraft spun rapidly and swept antennas over the ground to record radar and other signals for later downlink. Significant material, including previously secret space shuttle payloads, was released only in the two months before the March 2025 article.

Blue Origin CEO Dave Limp said at the Trump administration's "Hello, America" tech summit in Washington, D.C. that the company's first-ever outside funding round is "oversubscribed" and has not yet closed. The Wall Street Journal reported last week that Blue Origin raised $10 billion at a $140 billion valuation, with Jeff Bezos contributing $2 billion in the current raise and $30 billion invested since founding. Limp also said the plan is for New Glenn to return to flight before the end of this year, following the Cape Canaveral rocket explosion in May.

Simon Willison visited the Museum of the City of New York and saw 'He Built This City: Joe Macken's Model' — a 50 x 27 feet model of the city that Joe Macken built over a 21-year period out of balsa wood and cardboard. He says it exceeded his high expectations and that the exhibition closes on 12 October. This is a personal blog note, not developer or AI news; the only other content on the page is sponsorship and site navigation.

The fetched page contains only Ars Technica's cookie-consent boilerplate (GDPR opt-out notice, social media/essential/targeted/performance/functional/audience measurement cookie categories) and no article body. Nothing about the Chicxulub crater, the dinosaur-killing impact, or any scientific finding is present in the supplied text. The only hard data points are the URL, the title, and the timestamp 2026-09-30T21:54:12+00:00.