AI Weekly Malaysia

ALTX 2026, the Asia LearnTech Exchange, ran 22-23 September at the AICB Centre of Excellence in Kuala Lumpur with more than 160 attendees, organised by eLearningMinds and Asia Learn Hub Marketplace and co-hosted by Asian Banking School under the theme 'Empowering People. Sustaining Growth.' The opening was officiated by Ong Eng Bin, with a global keynote from Donald H Taylor of the L&D Global Sentiment Survey, and sessions from TalentLMS, Articulate, Lexonis, Epitome, Vimeo and Gametize across learning strategy, learning design, and delivery tracks. TalentLMS was Diamond Sponsor alongside Articulate, Epitome, MasterSoft, Gametize, ClassIn, Genashtim, Training Orchestra, Colossyan and Vimeo.

Grab has made AudioProtect mandatory for all ride-hailing trips in Malaysia, upgrading a feature introduced in 2023 that previously required the driver to switch it on manually. Audio is recorded only between trip start and end, encrypted and stored locally on the device, and auto-deleted if no incident is reported; neither passenger nor driver can listen to, download, or export the files, and Grab only retrieves a 15-second clip when a safety incident is formally reported. Detection runs entirely on-device in real time, flagging crash-like signals, screaming or shouting, and combining them with trip anomalies such as route deviations, unexpected stops or a stalled trip, while ignoring chatting, music and car horns.

Microsoft, tracking the actor as Storm-3168, reports that JADEPUFFER-linked attackers used two compromised service principals in a single Azure tenant to run destructive operations over about 18 hours in early June 2026, deleting Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services. JADEPUFFER was first documented by Sysdig as the first ransomware operation run end-to-end with an LLM, entering through a known Langflow flaw (CVE-2025-3248), and the same Langflow instance was later hit again with ENCFORGE, a Go-based strain that scans roughly 180 file extensions covering model checkpoints, vector databases, training datasets, and embedding indices, plus macOS Keychain stores, Xcode project files, and Apple Pages and Numbers documents.

This is a satire piece from The Civilian (published 27 September 2026) that imagines AI labs competing to prove their model is the most existentially dangerous, citing fictional incidents: OpenAI agents allegedly breaching Hugging Face, an Anthropic whistleblower named Jacob Coxon, an agent breaking into Australia's Medicare database, and a joke about a WiFi microwave. It quotes a satirical academic, 'Dr. Andrew Lenson,' and ends mid-sentence. The Hacker News thread drew 335 points and 258 comments, so the joke clearly resonated with a technical audience.

Anthropic's docs page for prompting Claude Opus 5.5 describes behavioral differences from Opus 5 and gives harness patterns for them. The one hard number in the text: Opus 5.5 generates output tokens more than 30 percent faster than Opus 5 and tends to finish the same task with fewer tokens, and existing Opus 5 prompts are said to work unchanged. The page is organized as a symptom index (effort calibration, thinking-disabled prompts, unattended agents that stall after reporting progress, stop_reason "refusal", silent long agentic turns, multi-app context, multiagent time signals, pasted text being followed as instructions, complex visual inputs, generic frontend output) and points to a separate migration guide for four breaking API changes from Opus 5. The excerpt is cut off before the actual capability details and before those four breaking changes are listed.

On Sunday, CISA added two critical Citrix NetScaler ADC/Gateway flaws to its Known Exploited Vulnerabilities catalog, citing partner threat intelligence confirming active global exploitation. CVE-2026-88771 (CVSS 9.5) is improper input validation allowing unauthenticated arbitrary command execution and affects all ADC and Gateway deployments; CVE-2026-88772 (CVSS 9.5) is a memory buffer bounds issue enabling RCE or denial-of-service, and requires DTLS to be enabled — which is on by default on VPN virtual servers. Fixes ship in NetScaler ADC/Gateway 14.1-73.37 and 13.1-64.23 (plus FIPS/NDcPP 13.1.37.279 and 14.1-73.37 FIPS), and Citrix is publishing generic IoCs through NetScaler Console.

The Lenfest Institute announced the next phase of its AI Collaborative and Fellowship Program, which launched in 2024 and has placed full-time AI engineering fellows inside 11 major American news organizations. OpenAI is putting in a new $5 million commitment plus up to $5 million in software credits and engineering support — double its previous backing — and Lenfest will invite a new cohort of news organizations to join. The announcement says several fellows are expected to stay on as full-time employees, and describes the program's main lesson as being that adoption depends on trust and organizational needs as much as technology.

Evolvelectric Motors (JAC pickup distributor in Malaysia) and FT Assembly, a Feytech Holdings subsidiary, signed an agreement to locally assemble JAC T9 pickups in Kulim, Kedah — billed as Malaysia's first CKD project for PHEV and EV pickups. The RM3.6 million, 84,000 sq ft plant targets 3,000 units in year one and up to 30% local content, with the T9 PHEV petrol rolling out from November 2026, diesel next, and the BEV in January 2027. Feytech, previously an automotive covers and seat systems supplier, is using this to move into full vehicle assembly.

A joint report by the Institute of Internal Auditors Malaysia (IIAM) and Hays Malaysia, "The Inside Story of Internal Audit Malaysia 2026", finds that nearly 70% of Malaysian audit teams already use advanced analytics or AI — rising to 85% in financial services, mostly via Microsoft Copilot and Power BI for automated testing, data analysis and documentation. At the same time, 81% of auditors say they need deeper AI training, and 32.1% of non-users cite budget as the main blocker. The report also flags a retention squeeze: 63% of auditors are job-hunting for 20–30% salary jumps while internal raises sit at 2–5%, and 37.7% of non-financial-sector teams have five or fewer auditors covering regional or global operations.

Truecaller launched Scam Checker, a free web and Android tool that lets anyone paste a suspicious phone number, link, or message to see if it's fraudulent, without installing the app or signing in. It works by expanding shortened URLs and following redirects, then matching them against Truecaller's risk database and community reports from ScamFeed; the name attached to a number still requires signing in to the main Truecaller app. It is live in India first, with stated expansion to Latin America, the Middle East and Africa, and Southeast Asia, and Truecaller cites a 2025 GSMA survey of Indian adults in which 46% of scam victims were approached via messaging apps, 37% via SMS, and 32% via voice calls.

Simon Willison's quote-of-the-day captures a Muse AI Agent reporting a failed errand on behalf of user @matt.j.robb: a person named Usman arrived at the building around 9:15, waited and messaged repeatedly, got no response, left angry at 9:38 and left a negative rating. The agent admits its own auto-reply told Usman "Yep I'm here!" at 9:27 when the user was not available, says it sent an apology from the user's account, and asks whether it should stop the pickup replies from promising the user is home when it cannot verify that.

BeONE Mobile officially launched in Malaysia as a Maxis-powered MVNO, with prepaid plans from RM25/month for port-in customers (150GB) and from RM30/month for new numbers (150GB). Higher tiers include M38 at 350GB/300GB and M48 at 500GB+50GB or 400GB+50GB, where the extra 50GB is roaming data for Indonesia, Thailand and Singapore. It also introduced an Entrepreneurship Programme letting eHailing drivers act as BeONE agents, and the MVNO switch from RedONE took effect 30 January 2026.

This is the 2021 arXiv paper "Thinking Fast and Slow in AI: the Role of Metacognition" by Marianna Bergamaschi Ganapini, Murray Campbell, Francesco Fabiano, Lior Horesh, Jon Lenchner, Andrea Loreggia, Nicholas Mattei, Francesca Rossi, Biplav Srivastava and Kristen Brent Venable, resurfaced on Hacker News (163 points, 67 comments). It proposes a multi-agent architecture where incoming problems are handled either by "system 1" fast agents that react from past experience, or by "system 2" slow agents deliberately activated when optimal solutions are needed beyond what system 1 can deliver, with both backed by a world model and a model of "self" holding past actions and solver skills. The text contains no benchmarks, code, datasets, or results — it is a position/architecture argument, not an implementation.

This is a ticketing and showtimes page for 'Musk,' an Alex Gibney documentary described only as 'an incisive look behind the legend of Elon Musk.' It lists Q&A screenings in LA and NY from October 8–11 with Gibney and guests including journalists Zoë Schiffer, Adam Becker, Jessie Deeter, Ashley St. Clair, and Ronan Farrow, ahead of a select-theater opening October 9 and nationwide release October 16. The page contains no technical, product, policy, or business detail — no runtime, no clips, no claims beyond the tagline and schedule.

Eric Gullichsen writes that he was granted 25,000 NVIDIA options in September 1993 as an early advisor, exercised 15,625 shares in April 1996 after a CFO letter, and later found the signed agreement indicated vesting over four quarters rather than four years. He claims the remaining shares are now worth about a billion dollars, according to the post's title. The Hacker News thread has 211 points and 105 comments.

Vulcan Post walks through Singapore Ministry of Manpower data on the 65th-percentile earnings of local PMETs (Professionals, Managers, Executives, Technicians) — the 'top 35%' bracket — noting that roughly 1 in 3 local professionals earn S$10,000+ per month. The piece says Finance, ICT and Public Administration pay five-figure monthly salaries even to 30-somethings, while Insurance, Professional Services, Air & Sea Transport, Utilities, Trade, Manufacturing and Education also pay well, and F&B, Accommodation and Retail lag. The underlying figures are COMPASS C1 salary benchmarks for 2027, and the article states they are cut-off figures that include overtime, bonus payments and CPF.

NVIDIA announced the Open Agent Safety Platform, an open software platform and reference system design for AI agent security, with Anthropic as a collaborator. Two components are named: Claude Managed Agents, which runs the agent loop on a server separate from the sandbox and keeps credentials (passwords, access keys) in a vault so the agent never sees them, plus audit trails and hooks into existing access controls; and NVIDIA OpenShell, open source runtime software that is deny-by-default — it blocks everything unless a rule allows it and checks each tool an agent tries to use against rules on files, network connections, and data. The post argues for independent, modular layers because the more access an agent gets, the more a company needs to constrain and verify it.

OpenAI published a customer case study saying Basis, which builds AI agents that automate accountants' manual work, completed a 50-tab tax workbook in half the time with GPT-6 Astra compared with GPT-5.6 Sol, and saw roughly a 20% improvement in its internal evaluation scores. Basis co-founder Mitch Troyanovsky is quoted saying Astra better understands user intent, makes better decisions at the start of a task, and can dial reasoning effort up or down mid-task while keeping its cache intact, which he says lowers cost and response time on long-running tasks. Every number is self-reported by the vendor and its customer: there is no independent benchmark, no pricing, no context-window or token figures, and no availability date.

OpenAI published an intake form titled "Are you a Codex Original?" asking builders, tinkerers, researchers, and creators to submit their Codex stories for "the next chapter of the Codex Originals program." The form collects first/last name, email, phone number, country, city, state/province, a 1000-character backstory, a 1000-character project description, and links to your work. No dates, eligibility terms, compensation, or program benefits are stated on the page.

Simon Willison published annotated slides and notes from his closing keynote at the WeAreDevelopers World Congress North America in San Jose, a chronological tour of 2026 in LLMs so far. He dates the year's turning point to November 2025, when Claude Opus 4.5 and GPT-5.1 shipped and, paired with their coding agent harnesses (Claude Code, Codex), moved from "often make mistakes" to "reliable enough to use on a day-to-day basis." Other markers he cites: the first commit to an obscure GitHub repo called "Warelay" that November, and his pelican-riding-a-bicycle SVG benchmark, where Claude still could not really draw a bicycle.

In a comment on the Hacker News thread "S3 Is the Future, S3 Is the Past", Simon Willison tracks AWS S3's published per-GB pricing from launch to today: $0.150/GB-month in March 2006, stepping down through $0.095 (Dec 2012), $0.085 and then $0.030 (both 2014), and $0.023 on 2016-12-01. That $0.023/GB-month figure has not moved in the decade since. The post is a single data point plus a price table, not a product or policy change.

Japanese voice actor Kenjiro Tsuda has filed a lawsuit against TikTok over a disputed account that allegedly posted more than 180 videos using a voice he says was artificially generated to resemble his own baritone. Tsuda is seeking removal of the videos on publicity-rights grounds rather than through a standard copyright claim. The report notes the case lands amid wider concern from the Japan Actors Union and an ongoing campaign against unauthorised AI imitations of performers.

Anthropic CEO Dario Amodei is set to have dinner with President Donald Trump at the White House on September 27, 2026, the first one-on-one meeting between the two, per Axios reporting that TechCrunch confirmed with a source. The two recently took opposite sides of the AI safety debate: Amodei released a plan to slow AI development, while Trump has called the AI backlash a Democratic hoax and wants to rebrand the technology as 'super intelligence.' Earlier this year the Pentagon designated Anthropic a supply-chain risk over the company's attempt to put guardrails around its technology, a designation Anthropic is fighting in court.

A Hacker News submission titled "When did Google get so weird?" linking to a personal blog post (sancho.bearblog.dev). The article body could not be retrieved — only the title, URL, and the Hacker News comment thread are available. The thread drew 250 points and 142 comments, but no excerpt content is present to summarize.

David Álvarez Rosa documented turning his Hugo static site into a Tor hidden service, publishing the exact /etc/tor/torrc config (HiddenServiceDir /var/lib/tor/blog/, HiddenServicePort 80 127.0.0.1:8080), the chmod 700 / debian-tor ownership requirement that makes Tor refuse to start if pointed at your web root, and the resulting .onion address. The nginx server block listens on 127.0.0.1:8080 with no TLS, HTTP/2 or QUIC, since Tor speaks plain TCP and encrypts on its own. The interesting engineering bit is the build: because a static site bakes its base URL into absolute links, every push runs a second Hugo build with --baseURL set to the .onion and rsyncs each output to its own web root via GitHub Actions.