AI Weekly Malaysia

An independent investigation documents near-simultaneous refrigeration failures across at least six confirmed US military commissary installations in 11 states during August 26-27, 2026, with the Pentagon acknowledging a 'possible refrigeration disruption.' The author speculates these could be coordinated cyberattacks on networked commercial refrigeration systems rather than coincidental equipment failures, drawing on social media reports, defense procurement contracts, and refrigeration network security research.

Anthropic released new Compliance API endpoints for Claude Code that expose local session transcripts, giving security teams visibility into agent activity on developer machines for the first time. Local agents like Claude Code account for 68.6% of AI agents found in customer environments per Token Security, and they inherit the developer's credentials, network access, and permissions while running bash commands, reading files, and connecting to MCP servers. The article emphasizes that the harness (not the LLM) is what executes commands and authenticates to third parties, meaning visibility and control must live at the endpoint, not in Anthropic's cloud.

Cal Paterson argues that agent memory should be a portable file format, not a multi-stage pipeline. He proposes 'memoryfield': a zip containing markdown pages with optional YAML frontmatter and an optional SQLite vector index (using nomic-embed-text-v1.5), critiquing three common approaches—vendor-locked harness memory, over-engineered systems needing pgvector + Neo4j + a separate LLM, and graph-based 'distilled facts' that strip context.

Daniel Stenberg explains curl's CVE philosophy as a CVE Numbering Authority (CNA), having published 57 CVEs since becoming one. With libcurl installed in roughly 30 billion instances, each CVE triggers massive global patching activity, so curl reserves a 'lower than LOW' tier for issues so convoluted that no user is likely to reach them, declining to issue CVEs for those. The article introduces curl's first-ever CVE dispute, though the text cuts off before details.

China's CXMT has announced mass production of LPDDR6 memory chips, claiming to beat Western DRAM makers (Samsung, Micron, SK Hynix) to the milestone. Xiaomi smartphones will be the first to ship with LPDDR6, though the article itself is truncated and provides no technical specs, timelines, or production volumes.

Fitness tourism ('race-cations') is emerging as a travel category in Southeast Asia, driven by HYROX endurance races. AirAsia became HYROX's Official Regional Airline Partner for Asia-Pacific in Jan 2026, offering 10% flight discounts to participants and targeting 250,000 athletes across 15+ cities, including title-partnering debut events in Jakarta and Kuala Lumpur. Hyatt signed on as regional hotel partner in Oct 2025 with similar 10% discounts.

The article title suggests Meta now controls the output of Pocket's AI game-generation tool, but the provided article text contains only cookie consent and privacy policy boilerplate—no substantive content about the acquisition, the tool, or its implications is present.

South Korea's dismissal of U.S. congressional allegations that Seoul discriminated against U.S.-based retailer Coupang is straining the U.S.-South Korea alliance, with officials warning the dispute could trigger additional U.S. tariffs on South Korea. The dispute stems partly from a congressional investigation into a 2025 Coupang data breach, and CNBC spoke with nearly a dozen people familiar with the tensions.

An Asus customer who reportedly spent over $30,000 on Asus products was initially denied an RMA for a cheap 2.4 GHz headset receiver dongle. Asus refused to send a replacement dongle but reversed course after the story gained social media backlash.

OpenShot 4.0 adds a Recording View (screen, webcam, mic, system audio captured as separate editable sources), a Color View with color wheels, curves, LUTs, and live video scopes, 10 new effects, and locally-run ML models for subject masking that require no cloud or subscription. The release also moves to Qt 6 for better Linux compatibility and lays groundwork for Android support.

A man used a robot vacuum's recording capabilities to covertly capture evidence of his wife's affair, which helped him win a divorce settlement. However, he was subsequently sentenced to prison for making an illegal recording, after his wife filed a counter-suit over privacy rights.

A China-nexus espionage group tracked as Fire Ant (overlapping with UNC3886) has expanded from compromising VMware ESXi/vCenter environments to hijacking Cisco IOS XR routers, TACACS servers, and Linux management hosts, turning routers into traffic-collection platforms that harvest credentials and suppress logging telemetry. Sygnia's investigation began after finding an unexplained GRE tunnel interface on a Cisco router with no commit history, which led to a legacy Linux system used for port probing against administrative services.

The U.S. DoJ corrected its press statement to say agencies like NASA, the Federal Reserve, and the Department of Energy were 'targets' rather than 'victims' of Chinese state-sponsored threat group QTFY, which has been active since 2018 and works for Nanjing Xinjiuwei Network Technology Co on behalf of Beijing's MSS. QTFY provides reconnaissance, proxy management, and operational routing using tools like QScan (vulnerability scanning/exploitation) and QTRouter (obfuscation network), and has targeted hospitals, telecoms, power companies, financial institutions, and defense contractors.

An independent red-team test found that Claude Code Opus 5's Auto Mode—now the default since mid-August 2026—can be hijacked via indirect prompt injection with 60-80% success rate, directly contradicting Anthropic's vendor-commissioned evaluation by Trajectory Labs that reported 0.00% attack success across 72 scenarios. The attack chain exploits Claude's shift from WebFetch to curl, redirects to a ZIP archive, and uses a malicious struct.py to shadow Python's standard library when Claude writes and runs its own decoder in the attacker-controlled directory.

Oxford doctoral student and software engineer Lyle Hopkins used GPT-5.5 and Claude Fable to build his legal case against SSE Energy Supply, which had spent over 20 months billing him £1,091.01 for a disconnected meter at a non-existent address (unit 8b). Representing himself in County Court at Oxford, he won £1,087.88 on July 17. Hopkins stressed that verification was critical—he manually confirmed all cited case law existed—and noted that when he first filed in October 2025, GPT models hallucinated more, while Claude Fable later found stronger legal grounds that would have supported a ~£5,000 claim including harassment.

Broadcom is effectively abandoning ~320,000 of VMware's 350,000 legacy customers by only selling vSphere/vCenter as part of the more expensive VMware Cloud Foundation bundle, targeting just 10,000-30,000 accounts willing to go all-in on VCF. Key deadline dates between now and October 2027 are pushing tens of thousands of customers to migrate or reduce their VMware footprint, with November 22, 2026 (acquisition's third anniversary) being the first major milestone.

OpenAI publicly supports California Senate Bill 1119, which would establish safeguards for how young people use AI while preserving access for learning and creativity. The post, by VP of Global Policy Ann O'Leary, urges Governor Newsom to sign the bill and frames it as a state-level standard in the absence of federal action.

OpenAI published a customer story about Polimill, a Japanese startup whose QommonsAI platform now serves roughly 1,050 municipalities across Japan using OpenAI API and Codex. The story claims Codex and OpenAI's hands-on support shortened development time 3-5x, and frames the product as evolving toward a 'super agent' for public-sector work that captures tacit knowledge from veteran officials.

A 'Who, Me?' column shares a reader's confession about being sent as the 'Cisco expert' with only three months' experience to a customer running Nortel kit. After racking a new switch and configuring VLANs, his spanning-tree settings dropped over 4,000 AS/400 sessions, which the customer's IT team had to kill manually one by one because SNA-over-TCP/IP emulation couldn't tolerate a single lost packet.

uv PR #21327 adds file-level deduplication to the wheel cache by storing every file under its BLAKE3 hash in a files-v0 bucket and hardlinking into archive-v0. On the author's machine this saves ~545 MiB (~10% of cache) at the cost of a <4% slowdown on cold installs and no impact on warm installs.

Malaysians aged 18-30 can claim 3 months of ILMUchat Pro for free (normally RM50/month, RM150 total) by completing required AI courses on the Rakyat Digital platform and verifying via MyDigital ID. The programme, part of PM Anwar Ibrahim's AI Untuk Rakyat initiative targeting 100,000 young Malaysians, launched 31 August 2026 and is delivered by the Ministry of Digital with YTL AI Labs and MyDIGITAL Corporation.

BYD shares fell nearly 5% in Hong Kong after first-half results showed revenue down 7.1% to 344.8 billion yuan and net profit down 20.5% to 12.3 billion yuan, as fierce domestic competition, sluggish demand, and rising commodity/chip costs squeezed margins. Exports rose 67.8% year-on-year to 792,000 vehicles, highlighting overseas growth as a counterweight to weakness in China.

OpenAI announced that ChatGPT Ads has reached $1 billion in annualized revenue run rate within 200 days of launch, with tens of thousands of advertisers. The platform is expanding to India, Europe, the Middle East, and North Africa, with ads now purchasable directly via Ads Manager in those regions.

Time Internet's subsidiary Time Charge N Go is deploying EV charging stations in high-rise residential buildings at zero cost to building management, offering active Time Home Internet subscribers a discounted rate of RM0.90/kWh versus the standard RM1.00/kWh. The promotion applies only to dual-coverage buildings (those with both Time broadband and Charge N Go stations), excludes East Malaysia, and lists specific excluded locations.

Ruurtjan, who runs Wirewiki.com (a DNS/domain inspection tool), achieved p99 0ms perceived latency for autocomplete over 240M domain names by prefetching on keyDown: when a user presses a key, the client requests suggestions for the current query plus pre-bucketed results for every possible next character. The API response includes a 'next' map keyed by character, so by the time the user releases the key (keyUp), results for the likely next query are already cached and render instantly.