AI Weekly Malaysia

Google's Threat Intelligence Group is tracking three suspected Russian cyber-spy groups (UNC6293, UNC7005, UNC5976) that have added OAuth phishing to their toolkit, targeting under 100 individuals per campaign in academia, aerospace, defense, government, and think tanks across Europe and the US. UNC6293, linked to APT29/Cozy Bear, now requests victims share either the full callback URL or the verification code after a legitimate OAuth login to an external provider, allowing attackers to hijack the token exchange without needing passwords.

Article URL: https://mathstodon.xyz/@maxpool/117128107757895678 Comments URL: https://news.ycombinator.com/item?id=49382041 Points: 189 # Comments: 209

AI data-labeling startup Micro1 grew its gross annual run rate from $100M to $500M in eight months, retaining 60-70% for a net run rate of $150M-$200M. The company hires domain experts on contract and is increasingly generating synthetic data (e.g., automated video descriptions) that can be resold to multiple customers at 80-90% gross margins. Founder Ali Ansari publicly stated Micro1 does not sell data to Chinese model makers, contrasting with competitors whose off-the-shelf data sales to Chinese developers have drawn criticism, citing Kimi K3 as evidence of the risk.

Anthropic's Applied AI team published a playbook for restructuring the SDLC around agentic coding tools like Claude Code, arguing that code generation is no longer the bottleneck. The post claims the real bottlenecks have shifted to planning, review/testing, and deployment—steps still running at human speed—while traditional approval gates and controls designed for human-paced development now mismatch reality.

Hugging Face researchers tested 11 popular open-source ASR models and found several high-scoring systems reproduce benchmark reference transcripts even when the audio contradicts them, words are silenced, or the audio supports multiple readings. They introduce three probes—including a consensus disagreement test using VoxPopuli's known transcription errors—to quantify 'benchmaxxing,' where models exploit benchmark-specific patterns rather than genuinely improving transcription. Some models appeared to detect subtle acoustic cues indicating which benchmark they were on.

Promptwatch tracking data shows ChatGPT Search fanout queries containing the site: operator jumped from ~0.3-0.5% to 16-17% around August 8, aligned with the GPT-5.6 rollout. Simon Willison notes OpenAI's search tool likely uses a search(query, recency, domains) shape rather than directly encouraging site: usage, and that OpenAI continues to obscure its system prompts.

https://twitter.com/OpenRouter/status/2090544970923184269, https://xcancel.com/OpenRouter/status/2090544970923184269 Comments URL: https://news.ycombinator.com/item?id=49381896 Points: 245 # Comments: 195

Google has moved Antigravity, its DeepMind-originated agentic AI coding assistant, into Gemini Enterprise subscriptions with enterprise governance controls. Admins now get project-level budget caps, token pooling across users, audit logging, file-access restrictions (deny access outside working folders), terminal execution controls (ask-first, sandbox, or auto-proceed), and browser/website access limits—all from a single console. Antigravity is also now available as an extension for VS Code, Visual Studio, JetBrains, and Zed, alongside its own desktop app, CLI, SDK, and IDE.

Sasha Orloff, founder and CEO of Puzzle (a Startup Battlefield alum), shares fundraising lessons from raising over $1B across multiple companies, emphasizing that VCs want founders who deeply understand their own financials—not perfection. He recounts nearly losing a term sheet because his data room wasn't ready, and breaks down which metrics (revenue quality, runway, margins, sales efficiency, profitability) matter at each stage from pre-seed through Series B+.

Micron CEO Sanjay Mehrotra told CNBC's Mad Money that AI has fundamentally shifted the memory industry's boom-and-bust dynamics, demanding higher-performance, lower-power memory for AI systems. The comments came alongside Micron's planned $250B U.S. manufacturing and research investment, including two fabs in Boise, Idaho, with the first expected to produce wafers by mid-2027.

Ramp's expense data from 70,000+ U.S. businesses shows Anthropic holding ~44% market share vs OpenAI's ~40% as of July 2026, but OpenAI is growing faster in Q3 to date. Anthropic first overtook OpenAI in May 2026 (41% to 39%), and the back-and-forth suggests enterprise AI spending is volatile rather than sticky. Ramp economist Ara Kharazian noted that 'GPT-5.6 Sol' is increasingly the choice for developers.

CNBC's Jim Cramer warned of a disconnect between stock prices and company fundamentals, citing consumer worries, elevated oil prices from Iran tensions, and the 30-year Treasury yield hitting 5.33%—a level not seen in nearly two decades. He spoke from the construction site of Micron's new semiconductor fab in Boise, Idaho, which will produce AI memory chips.

OpenAI launched an Apple Messages plug-in for ChatGPT that lets users sort, analyze, edit, draft, send, and delete text messages via the chatbot. The plug-in runs locally on the user's machine and OpenAI says it doesn't create an index of all messages, though specifics remain unclear. It also works with Codex and ChatGPT Work for professional use.

The article title references a US distributor of China's most popular humanoid robots pivoting after a US ban, but the actual article text is unavailable — only cookie consent boilerplate was captured.

Europe has cancelled planned upgrades for the Ariane 6 rocket. The article body was not captured beyond cookie consent boilerplate, so details on which upgrades were cut, timelines, and rationale are unavailable from the provided text.

The article content failed to load; the provided text is only Ars Technica's cookie consent and privacy policy boilerplate. No substantive content about the 9/11 documentary or its subjects is present.

Go v1.27, released August 20 2026, expands generics to support methods (not just functions and types as in v1.18), lets developers set values for deeply nested struct fields directly without intermediate steps, and improves type inference so explicit type arguments are no longer needed for generic functions in slice literals, channel sends, or type conversions. The article notes tension between Go's original readability-first design philosophy and these newer abstraction-heavy features that save keystrokes but add mental overhead.

The Enhanced Group, a telehealth company that IPO'd at a $1.2 billion valuation, posted a $62 million net loss in Q2 after hosting the 'Enhanced Games'—a competition allowing performance-enhancing drugs. Only $17.7 million in revenue came in, mostly from event sponsorships rather than its core telehealth business, casting doubt on whether the games will recur annually.

Matt Pocock released /wayfinder, a skill that acts as an orchestrator layer for the planning stage of AI agent workflows, particularly for greenfield projects where the end state is unclear. It splits planning into multiple threads, handles prototyping and research, and consolidates everything into a central document so you can produce detailed specs to hand off to AFK (Away From Keyboard) agents for overnight execution.

Liquid Death and former NFL player Jason Kelce ran a satirical campaign suggesting people's urine could cool AI data centers, but the article notes that recycled wastewater—including treated sewage and urine—is already used to offset potable water demand in data center cooling. Experts from Ecolab and the WateReuse Association confirm that treated wastewater is a real, growing practice, though you wouldn't use raw urine directly.

A compromised maintainer account published malicious versions of three widely used Rust crates (arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9) on crates.io on August 20, 2026, injecting a typosquatted dependency (proc-macro1) whose build script downloaded and executed a remote payload during compilation. The malicious versions were live for 86-107 minutes before removal; the Rust Security Response Team unyanked earlier safe versions and advises pinning arrayref at 0.3.9 or earlier, with no patched version or CVE assigned yet. RustSec advisories state no evidence of actual usage of the malicious versions.

Article URL: https://blog.curiousquail.com/im-upset-again-about-a-co-creator-of-rss-being-prosecuted-for-something-meta-is-doing-with-little-consequence/ Comments URL: https://news.ycombinator.com/item?id=49379550 Points: 1659 # Comments: 388

A threat actor impersonated a crypto news outlet on X, messaging security researchers around Black Hat and Def Con 2026 about a fake conference. They sent a legitimate Google Doc with a fake 'encrypted' sidebar built using Google Apps Script, tricking targets into entering a provided decryption key that initiated malware installation — an infostealer on macOS and a repurposed remote desktop tool on Windows. Huntress published the full writeup after one of its researchers played along to observe the attack chain.