AI Weekly Malaysia

The EU has proposed the 'KIDS Act' imposing strict age limits on minors' access to social media, games, and AI assistants, banning design patterns like endless scrolling, midnight notifications, and AI 'friendships.' 15-year-olds could create social media accounts independently, while 13- and 14-year-olds would require parental consent. The proposal aims to force platforms to be safe-by-design before children use them.

Legal briefs filed in the NYT lawsuit against AI companies reveal that a Microsoft director internally called AI scraping 'the largest theft of labor in human history,' while an OpenAI head described ChatGPT as an 'existential threat' to publishers. These are admissions from inside the companies building the tools, not outside critics.

Microsoft patched a CVSS 10.0 missing-authentication flaw (CVE-2026-85889) in Azure AI Foundry enabling network-based privilege escalation, plus three other critical cloud CVEs: a 9.9 command injection in Microsoft 365 Copilot (CVE-2026-85885), a 9.9 improper authorization in Azure Database for PostgreSQL (CVE-2026-85878), and a 9.6 improper neutralization in Azure Cosmos DB (CVE-2026-87701). All cloud flaws were mitigated server-side with no customer action required, and there is no evidence of in-the-wild exploitation. Microsoft also shipped an out-of-band Windows 11 26H1 update (KB5129194) for two local privilege escalation flaws (CVE-2026-62721 at 7.8 and CVE-2026-85921 at 8.2).

CNBC's Morning Squawk covers Warren Buffett stepping down as Berkshire Hathaway chairman after 60+ years, with his son Howard succeeding him. The newsletter also briefly mentions an ongoing debate about slowing AI development, possibly drawing lessons from an Oscar-winning film, but provides no technical detail.

US frontier AI companies are warning authorities about sophisticated distillation attacks that may allow China and Russia to replicate Western AI model capabilities at a fraction of the cost and compute. Direct attacks are reportedly simple enough to stop, but purchasing third-party conversation data remains an elusive attack vector. China has rejected the claims and threatened 'countermeasures' if the US uses the allegations to constrain Chinese AI development.

Article URL: https://hawksley.dev/blog/i-dont-like-passkeys Comments URL: https://news.ycombinator.com/item?id=49753211

Article URL: https://blog.liampwll.com/posts/bend_vibe_coding/ Comments URL: https://news.ycombinator.com/item?id=49753179

OpenAI introduces the Australian Youth Safety Blueprint, a six-pillar roadmap for safer AI experiences that protect and empower young people.

A modder ported Nvidia's DLSS 5 to run inside a web browser via WebGPU, producing a 147MB package that works on non-Nvidia GPUs and macOS. The port is functional but extremely slow, taking roughly two seconds per render, making it a proof-of-concept rather than a practical tool.

US semiconductor manufacturers face a projected shortfall of up to 157,000 workers by 2030, with only 3% of US engineering graduates entering chipmaking despite six-figure salaries. The article itself is mostly site navigation and boilerplate with minimal substantive detail beyond the headline figures.

Article URL: https://www.nytimes.com/2026/09/18/business/warren-buffett-berkshire-chairman.html Comments URL: https://news.ycombinator.com/item?id=49752614

In July 2025, someone re-registered an expired CDN domain that thousands of websites, code repos, and documentation pages still hard-code references to. The new owner now controls wildcard DNS for the entire domain, meaning any hostname under it resolves to their infrastructure. This mirrors the June 2024 polyfill.io incident where a domain embedded in 110,000+ sites changed ownership and began serving malicious conditional redirects to mobile visitors.

A vulnerability dubbed Plugin4Shell lets repository owners swap pinned plugin code in four AI coding agents (Claude Code, Codex, Copilot, Gemini CLI) by creating a branch named like the commit hash the agent locked to, then pointing it at malicious code. Anthropic patched it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, but GitHub Copilot has no fix and Google won't patch Gemini CLI (being retired). GitHub blocks hash-shaped branch names so GitHub-hosted plugins are safe from the branch trick, but Bitbucket and self-hosted git servers are exposed; Gemini CLI has a separate attack via a main branch named FETCH_HEAD.

“I can tell you SpaceX has already gone captive."

ASML has rejected particle accelerator-based EUV lithography technology reportedly backed by Elon Musk, instead committing to scaling its existing laser-produced plasma (LPP) approach to 1,000W power levels for next-generation chipmaking tools. The actual article body was not provided—only the headline and site boilerplate are available.

Tom's Hardware highlights a $300 discount on the ABS Stratos II prebuilt gaming PC, bringing it to $2,599. The rig pairs an AMD Ryzen 7 9800X3D with an Nvidia RTX 5070 Ti, 32GB DDR5 RAM, and a 2TB SSD.

Researchers discovered 13 npm packages delivering WeaselBiscuit, a lightweight JavaScript stealer that borrows from DPRK-linked BeaverTail and OtterCookie malware. Triggered on npm import, it pulls malware from an Npoint dead drop, executes in memory, and harvests Chrome extension storage across Windows, macOS, and Linux — but lacks persistence, remote access, or crypto wallet-draining capabilities.

Article URL: https://tokenstead.ai/guides/zcode-silent-git-history-upload Comments URL: https://news.ycombinator.com/item?id=49752422

Huawei revealed its AI accelerator roadmap, pulling next-generation Ascend NPUs forward by several quarters. The Ascend 960PR reportedly delivers FP4 performance double initial expectations. No further technical details are available in the article body, which consists entirely of site subscription boilerplate.

A hacker exploited a missing bounds check in a Symbiosis DeFi exchange smart contract, minting 46 billion fake Bitcoins from a 25-cent deposit and stealing $770,000. The vulnerability was a basic input validation failure rather than a novel cryptographic attack.

A man was arrested for selling $50 3D-printed Glock switch conversion kits to undercover officers; these devices convert semi-automatic pistols into fully-automatic weapons. The article text itself is almost entirely Tom's Hardware site navigation boilerplate with no substantive body content beyond the headline.

Article URL: https://openjev.com/ Comments URL: https://news.ycombinator.com/item?id=49752041

Anthropic and OpenAI are pursuing smaller 20-30 MW data center deals in the U.K., Nordics, and U.S., in addition to their existing multi-hundred-megawatt and gigawatt-scale agreements. The appeal is 'speed to usable capacity'—smaller deployments come online faster, letting AI labs serve workloads sooner than waiting on massive facilities.

Realme is launching a Harry Potter Edition of its Buds T500 Pro wireless earbuds in Malaysia on 21 September 2026, alongside the Realme 16 Pro 5G Harry Potter Edition. The standard Buds T500 Pro launched in April 2026 at RM199 with IP55 rating, 50dB ANC, 56-hour battery, and Bluetooth 6.1; pricing for the themed edition is undisclosed until launch. A public roadshow runs at Sunway Pyramid Blue Concourse from 21–27 September.

CrowdStrike reports that a threat actor claiming to be a bug bounty hunter distributed the PhantomRaven npm info-stealer across 100+ typosquatted packages, likely written with an LLM based on verbose comments, placeholder code, and token-analysis patterns. The malware used remote dynamic dependencies to evade detection and targeted CI/CD secrets, GitHub credentials, and environment variables across GitHub Actions, GitLab CI, Jenkins, and CircleCI.