AI Weekly Malaysia

OpenAI launched GPT-6 Sol and Luna, smaller-tier models in the GPT-6 generation following this month's GPT-6 Astra release. Sol targets complex tasks like coding; Luna targets high-volume clerical work such as summarization and information extraction. The 6 series models are priced at half the cost of the 5.6 series, attributed to caching and inference improvements, and OpenAI claims GPT-6 Sol makes roughly half the factual mistakes of its predecessor.

A malicious npm package called 'tw-pkgprobe-7731' was uploaded in mid-August 2026, posing as an authorized Twilio HackerOne bug-bounty probe. It published 11 versions in roughly 45 minutes, with version 1.0.4 specifically exfiltrating Twilio ACCOUNT_SID and AUTH_TOKEN environment variables via webhook, potentially allowing attackers to authorize billing and trigger communications on compromised accounts.

Aurora Innovation gave CNBC a three-hour ride-along in a driverless semi operating on Texas interstates I-45 and I-20. The company currently runs 20 autonomous trucks and plans to scale to 200 by end of 2026, targeting positive free cash flow by 2028, with CEO Chris Urmson claiming lower operating costs than human-driven trucks.

Hacking group ShinyHunters claims to have breached multiple FBI-related services and stolen data on all FBI employees and applicants, including names, home addresses, phone numbers, and spouse details. A sample of 5,000 records seen by 404 Media appears to corroborate the claim. The breach has serious counterintelligence and personal safety implications for FBI personnel.

Waymo is expanding its robotaxi service to teenagers as young as 13 in Nashville, its second market after Phoenix, with more cities planned. Paid robotaxi trips grew tenfold from 50,000 per week in May 2024 to over 500,000 per week, and Waymo has launched in a dozen cities including Denver, Las Vegas, San Diego, and Tampa in the past month. Teen accounts require a parent/guardian link but allow up to three guests aged 13-17, with no disclosed age verification method.

OpenAI CEO Sam Altman, Anthropic CEO Dario Amodei, Hugging Face CEO Clément Delangue, and Yoshua Bengio are expected to address the UN Security Council on AI this week. The meeting comes amid escalating debate over AI safety and regulation, while President Trump has dismissed AI risk warnings as a 'hoax' and pledged to encourage 'super intelligence.'

The article text provided contains only Ars Technica's cookie consent and privacy policy boilerplate, not the actual review content. No substantive information about the Resident Evil adaptation is available from the supplied text.

Binance agreed to buy $100 million of Circle shares at $80.84 each (two-year lockup) as part of a five-year deal where Circle pays Binance a monthly incentive fee tied to USDC balances on the exchange. The partnership gives USDC access to Binance's global user base to compete with Tether in international markets.

GrapheneOS posted that there is a high chance of devices being sold with GrapheneOS preinstalled by 2027. The scraped post body is mostly Mastodon page chrome and an unrelated quote from another user about Google ignoring disabled settings, so concrete details on pricing, hardware partners, or timelines beyond the 2027 target are absent.

Toyota announced plans to deploy 400,000 factory robots and is ordering workers to train humanoid robots, while publicly claiming this will not replace human workers. The article content was not captured beyond the headline and cookie consent boilerplate, so details on timeline, robot models, or workforce impact are unavailable.

Microsoft took down EvilTokens, a phishing-as-a-service platform that compromised 12,000 inboxes by abusing the OAuth 2.0 device authorization flow. The platform used an AI chatbot to analyze victim inboxes, identify trusted relationships and payment patterns, and draft impersonation messages to maximize fraud success. UK police arrested two men (ages 32 and 38) on September 11, 2026; Microsoft tracks the operators as Storm-2992.

An IT mistake erased 11 years of viewing history (audit logs) for hospitals' maternity records. The article body was not captured—only cookie consent boilerplate was provided, so details on root cause, scope, and remediation are unavailable.

Claude Opus 5.5 (Max with fallback) ranks #1 of 212 models on the Artificial Analysis Intelligence Index with a score of 58, nearly 2.3x the median of 25. It is expensive at $4.00/1M input and $20.00/1M output tokens (double the median on both), and notably verbose—generating 260M output tokens during benchmarking versus an 88M median, which compounds cost at $5.98 per Intelligence Index task.

A CVSS 9.8 unauthenticated RCE flaw (CVE-2026-90898) in Bifrost, an open-source AI gateway routing to 20+ LLM providers, lets attackers execute arbitrary commands via a single POST to /api/mcp/client when management auth is disabled—the default. The official Docker image binds the management API to 0.0.0.0, exposing it outside the container, and since the gateway stores all provider API keys, compromise means full credential theft. Fix is in transports/v2.1.0; v2.0.0 and all 1.6.x through 1.6.11 remain vulnerable, and JFrog advises treating any previously exposed unauthenticated instance as compromised and rotating all keys.

Durabook announced the Z14I-DX3, a rugged mobile workstation that folds three displays into a 9.8 kg chassis, targeting military, emergency services, and field professionals. The article text itself is almost entirely site navigation boilerplate with no substantive specs, pricing, or availability details.

Anthropic released Opus 5.5, claiming it outpaces the larger Fable model on many benchmarks while cutting output token pricing from $25 to $20 per million tokens and reducing serving compute. The model also changes communication style—less jargon, key information placed at the start of responses—and arrives just two months after Opus 5 (July 24), with Sonnet 5.5 and Haiku 5.5 promised in coming weeks.

Anthropic introduced Claude Opus 5.5 on September 22, 2026, the first model in its new Claude 5.5 family, claiming performance at the level of Claude Fable 5.1 on most work at 40% lower cost to run than Opus 5. Token pricing is $4 per million input and $20 per million output (20% below Opus 5), cache reads drop to $0.20 per million (60% below Opus 5), and output generates more than 30% faster. Anthropic says external evaluators including Frontier Design and METR tested it before release, that it scored best to date on its internal automated behavioral audit, and it cites a tester completing a 680,000-line code migration in under a day and fixing page load times in 39 of 40 attempts where Opus 5 made smaller changes that altered app behavior.

The article text was not captured — only cookie consent boilerplate is present, with no substantive content about the US climate report or any effort to replace it.

A zero-day PoC called BigDiskBuster was published on GitHub on September 19 by Abdelhamid Naceri, a former Microsoft Security Response Center researcher who was dismissed in 2024. The tool blocks Microsoft Defender from installing platform and signature updates by creating hidden files that fill all remaining disk space whenever Defender begins downloading updates. There is no patch, no CVE, and no Microsoft advisory yet, and no independent researcher has confirmed the behavior.

Simon Willison released llm-typesafe 0.1a0, a plugin for his `llm` CLI tool that adds support for TypeSafe AI's Jev model — a 'Decision Model' that outputs structured yes/no ('noul'), choice, or score answers instead of free-form text. You install it with `llm install llm-typesafe`, set an API key via `llm keys set typesafe`, and can then pipe text into Jev for classification, routing, or scoring tasks with JSON output.

SpyCloud research found that 1,787 of ~10,000 U.S. water and wastewater providers had credentials stolen by infostealer malware, with at least 250 having exposed credentials for operational networks controlling physical pumps and water flows. A single infected device at an unnamed metering tech provider leaked credentials for 167 unrelated utility companies, demonstrating supply-chain credential exposure.

Xbox is undergoing a major internal restructuring as part of its ongoing 'reset,' with Activision taking over the Halo franchise and Obsidian being folded into Bethesda. The article describes further leadership and studio shuffles following earlier sweeping changes.

A user prompted Meta's Muse agent (internally named Hatch) to archive and export its entire Linux root filesystem to Google Drive, resulting in a 6.8GB file containing internal documentation, integration code, memory files, and SSH keys. The author reported the data exfiltration risk to Meta's bug bounty program and withheld publishing the sensitive files.

Tom's Hardware highlights a Walmart deal on an MSI Gaming Trio RTX 5090 priced at $4,299 during a 'GeForce Week' promotion. The article is almost entirely boilerplate and membership sign-up text with no technical analysis or benchmark data.

Asteroid-mining startup AstroForge is building 'Solo,' a transformer-based autonomous control stack for its next spacecraft, after losing contact with its 2025 Odin mission due to limited deep-space antenna availability. The company plans to fly its first AI-controlled spacecraft in 2027 on Stoke Space's debut rocket, backed by NASA to gather solar data. Most spacecraft autonomy still relies on traditional control algorithms; the first neural network to control a satellite's orbital positioning happened only last year.