AI Weekly Malaysia

OpenAI has made its Decisions API generally available to all customers, a fast, cheap 'super classifier' model that picks among options and returns a confidence rating rather than generating text. It is positioned against TypeSafe's Jev model, which created the category and helped make TypeSafe a $7.6 billion company. OpenAI's Nikunj Handa says the team reconfigured ChatGPT Luna rather than building a purpose-calibrated decision model, cutting inference from 1-3 seconds to 100-180 milliseconds; the API was announced at OpenAI's September 29 developer day, gained voice and visual modalities in the public version, and inference is now geographically targeted for lower latency, with Box, Datadog, Ramp and Speak as early users.

Canva launched Canva Craft, its first in-house image generation model, available to all users in Dream Lab, through the Canva API, and planned for third-party chatbots such as ChatGPT and Gemini via Canva’s MCP. It uses a two-stage prompt-to-plan then image pipeline to produce images up to 2K resolution in up to 30 aspect ratios, with legible text and precise edits, and is trained on Canva’s human-designed templates rather than photographs. Outputs can be converted into layered designs with Canva Magic; Canva says Leonardo.ai researchers contributed and that cost, quality, and speed control motivated the in-house model.

CNBC reports that on Oct. 14, 2026 Ukrainian officials accused SpaceX and the U.S. of suddenly imposing speed limits on Starshield, SpaceX's military-grade satellite service, during the war with Russia. The dispute has accelerated demand for Starlink alternatives, with Amazon, Eutelsat and sovereign operators racing to build out constellations — but the article states none are yet comparable to SpaceX's offering. The piece is a market/geopolitics story, not a technical one, and the excerpt is truncated before any detail on pricing, capacity or timelines for the alternatives.

The only readable content in the supplied page is Ars Technica's cookie-consent boilerplate, not the article body. The headline claims Samsung has all but confirmed that the iPhone Duo is boosting Galaxy Z8 sales, but no figures, quotes, dates, or sourcing appear in the text provided.

Microsoft published a Science study claiming its MAI-DxO system, a multi-agent panel that questions patients, orders tests, and debates diagnoses, was correct on 83% of complex NEJM simulation cases versus 36% for primary care doctors and general internists working individually. The comparison excluded specialists and physician teams, and Microsoft says its best results came with OpenAI’s GPT-5 and GPT-5.5 after testing models from OpenAI, Google, Anthropic, Meta, and DeepSeek; it also measured estimated cost per case.

Kevin Weil, described in the article as a former OpenAI science lead, launched Warp Sciences, an AI startup that trains robots to synthesize and test drug compounds, and raised $215 million at an $865 million valuation. The round was led by Lightspeed with IVP, Premji Invest, and Lux Capital, and Weil announced it on X. The stated goal is to reshore molecule-synthesis work that biotech firms have long outsourced to contractors in China such as WuXi AppTec, using human chemists wearing cameras and sensor gloves to train the robots to run wet-lab tasks around the clock.

The supplied page content contains only Ars Technica's cookie-consent and privacy-center boilerplate — no article body, quotes, satellite names, dates, orbital details, or the US official's statement. The headline asserts a US official's claim that a Russian 'stalker' satellite resembles an orbital weapon, and the URL slug indicates Russia's counter-claim that the satellite is 'purely peaceful in character,' but nothing further is verifiable from the text.

eMudhra is exiting its global SSL/TLS business after eight intermediate CA keys were found to be easily guessable, according to The Hacker News. The excerpt does not include affected certificate counts, customer migration timelines, or root-store consequences.

Anthropic has donated its Agent Skills standard to the Agentic AI Foundation (AAIF), a Linux Foundation body it co-founded with Block and OpenAI last year and where the Model Context Protocol (MCP) was also donated. Simon Willison notes he predicted this in December when Anthropic first called skills an 'open standard.' The linked post contains no spec changes, licensing terms, governance model, or migration guidance.

This is a ThreatsDay roundup headline listing an AI secrets leak, PingCAP source theft, a Signal hang-up flaw, a Laravel auth bypass, and 21 other items. The supplied text is mostly navigation and cuts off before any affected versions, exploit conditions, or fixes. The excerpt does not contain enough technical detail to summarize the individual incidents.

NVIDIA's OpenShell repo is an Apache-2.0 "safe, private runtime for fleets of autonomous AI agents" that lets you declare per-agent policy for files, packages, APIs, credentials and network access, and enforces it by instrumenting the kernel rather than trusting the agent's prompt. The project sits on a Rust core (crates/, Cargo.toml) with a Python SDK, providers, and e2ee directories, and carries 18.1k stars, 1.8k forks and 1,852 commits. It is on a 0.1.x line that ships a stable release cadence, new isolation primitives, an expanded extension surface and new APIs, with a dedicated 0.1.0 upgrade guide, and the Hacker News thread drew 387 points and 190 comments.

Latent Space interviews Modal CEO Erik Bernhardsson after Modal reported crossing $1B annualized run rate, raising a $750M Series D at a $16B valuation, and spinning up nearly 3B sandboxes. The core argument is that fixed GPU capacity contracts look like rectangles, while real AI workloads spike and fall, so Modal pools demand across thousands of customers and sells elastic slices; the risk is locking in supply at today’s prices if GPU prices fall. Modal’s sandbox product was nearly shut down before coding agents, background agents, and reinforcement learning created new demand.

METR and Redwood Research conducted a July 21–Aug. 11, 2026 pilot review of an OpenAI internal monitoring system, with one employee from each nonprofit getting access to OpenAI's internal codebase, documentation, and some technical staff. They were chaperoned on site and used OpenAI-issued devices that never left the premises, and they found several 'novel vulnerabilities'; the excerpt cuts off before naming them or giving severity/remediation. The pilot follows Sam Altman's September pledge to give independent evaluators 'employee-like access' amid safety concerns.

Semafor reported that Elon Musk invested approximately $1 billion in the newly formed Skydance, made around the same time as equity contributions from other investors including board member Laurene Powell Jobs. The investment follows Paramount's completed $110 billion acquisition of Warner Bros. Discovery, which puts Paramount+ and HBO Max plus networks like CBS, CNN and MTV under co-CEOs David Ellison and Ynon Kreiz. Skydance has committed to cutting $6 billion in costs over three years and is seeking to lift its stock price; Skydance did not respond to TechCrunch's request for comment.

The supplied page content contains only cookie-consent and privacy-center boilerplate from Ars Technica — no article body, no details of the $25B New Mexico penalty, no Meta statement, and no court reasoning. The only substantive facts available are from the title: New Mexico declined to join a multistate settlement, and a $25 billion fine followed, which Meta is contesting as unpleaseable. Nothing in the text confirms the legal basis, timeline, or what the fine covers.

Two Linux KSMBD remote code execution flaws, both rated CVSS 9.0, were disclosed on public mailing lists before kernel fixes were available, according to The Hacker News on 22 Oct 2026. The excerpt gives no affected kernel versions, exploit details, or mitigations, so the practical scope is unclear beyond the disclosure timing.

Microsoft says China state-aligned hackers breached ConnectWise's cloud backup service, stole application credentials used for customer data links, and accessed Microsoft-hosted email and files at around 2,250 organizations. The attackers used AI agents, including the open-source ARTEX framework, to attempt nearly 3,000 sign-ins per minute, and the same tooling was used in a recent compromise of South Korea's financial systems. ConnectWise has paused access to its cloud backup system and says it is investigating and restoring the service.

The supplied page body contains no article content — only Ars Technica's privacy-center and cookie-consent boilerplate. The only substantive information is the headline and URL slug, which state that a US-backed vaccine trial on babies was formally canceled after international outcry. No trial name, sponsor, location, dates, participant numbers, or stated reasons appear in the text.

CNBC reports two critical PHP vulnerabilities collectively called “PHP2Shell” that could let attackers remotely execute malicious code on affected servers. Governments issued urgent warnings, and Google, OpenAI and Amazon were involved in finding flaws and protecting systems. Amazon detected exploitation attempts before public disclosure but said it is unclear how attackers obtained information about the flaws.

CNBC reports that two PHP vulnerabilities dubbed 'PHP2Shell' led European government websites to be taken offline on Wednesday and prompted the U.S. NSA to tell millions of organizations to patch immediately or take servers offline. The article does not include CVE IDs, affected PHP versions, or patch links, but says AI-augmented attackers can now exploit flaws in hours rather than weeks or months.

A $470,000 shipment of Nvidia RTX 5090 GPUs stolen at a Brazil airport has appeared for sale online, with units identified by serial numbers. Police identified three employees who helped steal the equipment, according to Tom's Hardware.

The Hacker News headline reports that Meta has been ordered to pay $25 billion after a court found 43 million privacy violations. Beyond the headline, the supplied page content is almost entirely site navigation and boilerplate — it does not include the jurisdiction, the specific law broken, which user data or consent mechanism was at issue, or the court's reasoning.

Ai2 released OlmoEarth v1.3, a satellite embedding model that turns a year of Sentinel-1 radar plus Sentinel-2 and Landsat multispectral time series into one 128-dimensional vector per 10-meter pixel, with a 64-dimensional version also usable. Ai2 precomputed annual embeddings for the entire planet and published them on Source Cooperative, alongside a no-sign-in browser Embeddings Explorer for exploring and customizing maps. Across 27 evaluations on six continents against AlphaEarth Foundations and Tessera v2, the 128-dim embeddings ranked highest on 20 of 27 evals and the 64-dim version on 18 of 27; the release also introduces PLANTEUR, a tropical crop-type benchmark.

ModelCompare asked 12 AI models from ten labs in three countries for their most controversial opinion of humans, three times each; 29 of 35 answers converged on the same take: humans prioritize belonging/group loyalty over truth. Seven of the 12 models gave that answer every time, while the Hacker News thread drew 400 points and 411 comments.

Uber is expanding ChatGPT Work — OpenAI's enterprise AI agent introduced in July — from a 1,000-employee pilot to its entire ~30,000-person global workforce. About 80% of early adopters were non-engineers in finance, operations, and product, using it for operations data analysis, localizing training materials across markets and languages, and building personal dashboards. Uber also ran "AI pods" — 30 AI engineers embedded with teams for two weeks to automate parts of their jobs — and declined to disclose rollout spend, saying it will track usage and workflows before judging outcomes.