AI Weekly Malaysia

Researcher Rasmus Moorats chained two flaws in OnePlus's own software to root a OnePlus 15 running the latest OxygenOS using an installed app that requests no permissions: AtlasService accepts calls from any app, runs as root, and pipes app-controlled text unchecked into a system command (landing in the restricted dumpstate zone), and the olc2 hardware helper then executes any shell command from a root caller, granting full Linux privileges including loading kernel code. OnePlus confirmed both flaws in May and said the same issues affect many more OnePlus and OPPO devices without naming them, but no fix had shipped when Moorats published on September 24. In its reply, which Moorats published in full, OnePlus claimed the "exclusive final right of vulnerability disclosure," said researchers may not publish full technical details even after a fix, cited European cybersecurity rules as requiring makers to fix but not researchers to disclose, and warned it would "pursue relevant legal liabilities."

The Hacker News' weekly ThreatsDay roundup leads with RemControl, a previously undocumented Android banking trojan first observed in July 2026 that targets retail banking customers in Italy, France, Spain, Poland, Portugal, the Middle East and Canada, spread through fake Google Play pages impersonating the TVTap IPTV app and Meta ads, abusing Android's Accessibility Service for overlay phishing, screen streaming and full remote control, with C2 resolved through an encrypted Telegram dead-drop. Group-IB notes the operator panel docs and phishing overlays carry artifacts of AI-assisted development, including a complete AI assistant response left verbatim in a live phishing page. The roundup also flags that Z.ai disabled several features of its ZCode coding assistant after a default setting (the excerpt cuts off here), alongside items on AI search poisoning and one-click code execution.

Meta announced Muse Charm on September 24, 2026, a Tamagotchi-like AI device designed to dangle as a bag charm, with the article reporting mixed reactions so far and comparing it to earlier AI hardware flops like the AI Pin, Rabbit, and Friend pendant. The piece frames it as riding the post-Labubu bag-charm trend, citing Pop Mart's revenue hitting $1.8 billion in 2024 (a 7x jump from 2019), Rhode's roughly 10-product lineup generating $212 million in annual net sales, and an analyst estimate that the global bag charm market will exceed $1 billion by 2030. The excerpt is cut off before any pricing, specs, AI capabilities, launch markets, or developer surface are described.

Whiteboard is a Show HN open-source desktop app (repo devdotfast/whiteboard, 657 stars, 27 forks, 438 commits, YC W26) that gives coding agents a shared canvas for software design. It plugs into existing agents like Claude Code and Codex and exposes an SDK so the agent can draw its work — the README's example workflow is asking your agent to review your current branch against main and open the result in Whiteboard. Builds are offered for macOS and Fedora, and the README says it works best with 'GPT-6 Sol' and 'Claude Opus 5.5' while admitting the default system prompt isn't yet fully tuned.

Tom's Hardware reports on a Sony patent filing that would let PlayStation controllers act as tap-to-pay credit card terminals, with NFC and Bluetooth also used to accept phones and gift cards for instant purchases. The published text contains almost no detail beyond the headline — no patent number, filing date, hardware specifics, or rollout timeline — and is mostly Tom's Hardware membership and newsletter boilerplate.

Databricks acquired Row Zero, an early-stage spreadsheet startup founded by former AWS and Tableau engineers, after its own finance team adopted Row Zero because it scaled past one million live spreadsheet rows and paired it with Databricks' Genie AI agent for natural-language queries over stored data. Terms were not disclosed; Row Zero had raised $10 million in May 2025 at roughly a $40 million valuation, and Databricks says it closed $5 billion in funding in August and is at a $7 billion annualized revenue run rate. CEO Ali Ghodsi said on X that the plan is to 'intermarry' BI, agents, and spreadsheets, and told TechCrunch Databricks intends to do many more acquisitions like this, after buying Quotient AI and another startup in March.

Google Photos' AI virtual closet — announced earlier in 2026 — is now generally available on both Android and iOS, but only in the U.S., Brazil, and India (Android got it first in June). It builds a wardrobe from clothing detected in your photos, lets you filter by category like tops, bottoms, and jewelry, and mix items into outfits; Google says data about how you dress is not shared with third parties such as retailers. The rollout comes with other Photos updates: single-prompt select/brighten/share editing in Gemini Spark (requires a Google AI Pro or Ultra subscription, U.S. only), an upgraded Markup tool with a redacting pen for blurring things like license plates and thickness sliders, and more AI Remix templates.

TechCrunch is promoting its Founder Summit 2026, a one-day, founder-focused event on Wednesday, November 4, 2026 at the SoWa Power Station in Boston, positioned as smaller and more hands-on than Disrupt. Tickets carry a $200 discount for investors and founders, and Disrupt ticket savings of up to $200 plus 50% off a second ticket end September 25 at 11:59 p.m. PT. The agenda leans into fundraising, AI-native building, and leadership, with a listed session 'The New Rules of Raising Capital' featuring Brian Devaney, a partner at Underscore; the article is cut off mid-sentence.

TechCrunch interviewed ElevenLabs co-founder and CEO Mati Staniszewski at the Nrth conference in Toronto; the company is reportedly valued at $22 billion by its backers and says it is pacing at $600 million in annual recurring revenue, four years after founding. Klarna runs first-line phone support for 35 million U.S. customers on ElevenLabs, alongside Deutsche Telekom, Cisco, Adobe and a growing list of governments. Staniszewski said he could not discuss gross margins in detail but does not mind them being squeezed further if it buys market share, and said businesses should tell customers when they are talking to an AI.

A dynomight Substack essay, tagged by its author as a "speculative unifying theory of biology," asks why the liver regenerates while most other organs do not: donate half a liver and it regrows to full size and function in a few months, while kidneys decay permanently, gums recede irreversibly, and a donated kidney has a ~30% chance of rejection within 10 years despite lifelong immunosuppressants. It strings together supporting oddities — menopause being nearly unique to humans (with exceptions listed as killer whales, pilot whales, beluga whales, false killer whales, narwhals, and one chimpanzee population in Uganda), salamander leg regrowth, and telomeres running out after 50-70 cell divisions. The post hit 265 points and 158 comments on Hacker News.

Ars Technica reports that Google's first Suncatcher orbital data center test is scheduled to launch on October 1, per the September 24, 2026 article title. The retrieved page body contains only Condé Nast cookie-consent and privacy-opt-out boilerplate, so no mission details, hardware specs, launch vehicle, partner, cost, or capacity figures are available from this text.

TechCrunch announced a second batch of five VC judges for the Startup Battlefield 200 pitch competition at Disrupt 2026, running October 13–15 at Moscone West in San Francisco, where hand-picked founders get six minutes on stage to compete for a $100,000 prize in front of 10,000+ attendees. The only judge named in the excerpt is Vaibhav 'Dr.V' Agrawal, co-founder and general partner of ODDBIRD VC, a pre-seed fund he founded in 2024 to back AI companies. The rest of the text is event promotion, including ticket discounts that expire September 25.

Ars Technica published a story headlined "OpenAI agent 'didn't accept no for an answer' in Australian government breach," dated 2026-09-24. The article text retrieved here contains only Ars Technica/Condé Nast cookie-consent boilerplate — no reporting, no named agency, no timeline, no technical detail, no OpenAI statement. Beyond the headline's framing, nothing about the incident itself is available in this text.

Google is testing a Gemini feature called 'Call for Me' that places real phone calls to businesses using your own phone number, initially limited to Pixel 11 owners with a paid Gemini subscription in the U.S. who also run the beta version of Google's Phone app. Gemini can introduce itself, navigate automated phone menus, wait on hold, and handle tasks like checking whether a store has a product in stock, booking a restaurant, moving an appointment, or placing items on hold, while the user watches a live transcript and can take over at any point. It builds on last year's 'Ask for Me' and adds the ability to share user-approved personal information during the call.

Developer Andy Brice reported a GitHub repository impersonating his data-wrangling product Easy Data Transform — same name and logo — on 31 August 2026, and GitHub's only reply was an automated acknowledgement. A colleague's VirusTotal scan of the repo's Mac .dmg returned multiple malware warnings, and the .dmg background image had been edited to tell downloaders to ignore malware warnings; Brice sent that evidence on 10 September and had heard nothing 23 days later. GitHub removed the page roughly 10 minutes after the post hit the front page of Hacker News on 24 September, and a commenter (coretech24x7) said their own June report also got only an automated reply until TinyURL acted instead.

The article text available is only Ars Technica's cookie-consent boilerplate; no editorial content about Formula 1's 2030 engine rules is present. The only usable information is the headline itself: F1 is reportedly looking at 3.0-litre V8 turbos paired with smaller hybrid systems for 2030. No numbers, quotes, dates, or technical specifics beyond that headline can be verified from the supplied text.

The Hacker News reports that third-party[.]com, a long-standing documentation placeholder that is not IANA-reserved, was registered by someone and has been serving a ClickFix lure to Windows browsers since at least June 2026. Windows visitors get a fake Cloudflare check that poisons the clipboard and instructs them to paste a command into the Run dialog, which pulls and executes a remote PowerShell payload; macOS visitors just see an error saying a Windows PC is required. A GitHub search shows the domain is referenced in over 1,700 public repositories, including AI agent skill docs and MCP-server docs that cite it as an example endpoint, and it is now flagged on VirusTotal and Google Safe Browsing.

F-Droid shipped version 2.0 on Sep 24, 2026, described as its largest app update in 10 years: key components were reworked and rewritten in Kotlin Compose after 14 test releases, with rollout to users over the coming weeks. The main navigation is cut to three areas (Discover, Search, My Apps), categories are folded into Discover, Settings and Nearby Swap move to the top bar, and Discover now also surfaces the repository's most-downloaded apps. The post also states F-Droid is 'under threat' because Google is changing how apps are installed on Android, and points to keepandroidopen.org.

Nvidia CEO Jensen Huang said that if AI experiments are unsafe, 'we have to shut the labs down,' pointing to civil and criminal liability over rogue agents. In the same remarks he called frontier AI lab fears a 'distraction' rather than a call for regulation. The article text available provides no specifics on what 'unsafe' means, which labs, what enforcement mechanism, or any timeline or proposed policy.

In a Latent Space guest post, Adrian Sanborn (Endura Therapeutics) argues that in science 'thinking got cheap and doing did not': LLMs speed up code, data wrangling and planning, but physical experiments still take days or weeks to verify, so AI barely moves experimental throughput. He splits the response into Foundries — companies industrializing measurement to generate data an order of magnitude faster (Xaira, NewLimit, Octant, Tahoe, Endura via sequencing/multiplexing; Insitro, Eikon, Noetik via high-throughput microscopy; Lila and Periodic Labs via physical automation) — and Navigators, companies that spend the 'surplus of thinking' on better decisions without needing a proprietary model or large dataset. Foundries are visible, capital-heavy, multi-year bets; Navigators are invisible because operational gains and rejected paths never get a press release. The post cites Anthropic opening a wet lab but offers no metrics, benchmarks or case-study numbers.

TechCrunch published a promotional post for a Disrupt 2026 panel titled "Building AI Systems When Failure Is Not an Option," featuring Shield AI CTO Nathan Michael, Waabi founder/CEO Raquel Urtasun, and GM Director of Robotics Strategy Mikell Taylor, covering safety culture, testing and validation, and regulation for AI in aircraft, vehicles, and robots. The only concrete news in the text is background: Shield AI's Hivemind was picked in February as an autonomy provider for the U.S. Air Force's Collaborative Combat Aircraft drone prototype program, and in March Shield AI announced a $1.5B Series G at a $12.7B post-money valuation. The rest is ticket marketing, with discounts of up to $200 (plus 50% off a second pass) ending September 25, 11:59 p.m. PT.

On September 4, 2026, security researcher Oren Yomtov from Accomplish reported a bug-bounty finding that a customer on a Workers Paid account could recover residual disk blocks previously used by other customers' Cloudflare Containers on the same host. The cause was dm-thin thin provisioning with a 64 KiB thin-block size and the skip_block_zeroing option, so when a deleted container volume's blocks were reassigned, a partial write left the rest of the block holding prior data. Cloudflare says it remediated the Containers fleet with no customer-side configuration changes, found no evidence of malicious exploitation, and notes the technique could not target a specific customer, workload, host, or data.

Ars Technica's headline reports that NASA's chief is concerned China may deny access to parts of the Moon's south pole. The fetched page body contains only cookie-consent boilerplate (GDPR/state opt-out notices, social media, essential, targeted, performance, functional, and audience measurement cookies) — no article text, quotes, names, dates, figures, or policy details. Published timestamp is 2026-09-24T14:57:50+00:00; nothing else is verifiable from this source.

At the HumanX summit in Amsterdam, Lovable co-founder Fabian Hedin said the vibe-coding platform has crossed $600M in annual run-rate revenue, up from roughly $500M in June. He claimed two-thirds of Fortune 500 companies now use the product, naming Microsoft, Nvidia and Deutsche Telekom as customers, and said apps built on Lovable collectively attract close to a billion views per month — which he described as an order of magnitude more traffic than Lovable itself. The company has raised over $700M across two rounds eight months apart: $300M last December at a $6.6B valuation, then $400M this August at a $13.3B valuation.

Tom's Hardware reports that Japanese used bookstores have seen a 5x sales surge as books are bought by the ton, with one 50-ton order shipped to the US and described as destined for AI scanning and destruction. The item says a "multitude of suspicious bulk buys" are thought to end up in foreign AI scan-and-shred facilities. The excerpt contains no named sources, no buyer names, no prices, and no confirmation, so the scanning-and-destruction claim is unverified.