AI Weekly Malaysia

A judge ruled that Nine PBS owns the 50TB of archival TV data sitting on Iron Mountain servers, clearing the station to retrieve 70 years of content after its hosting provider went under. The case establishes that the station, not the defunct host, holds ownership of its own data.

Nvidia has disclosed a $21 billion stake in SpaceX, per an Ars Technica report from August 2026. The article body was not accessible (only cookie consent boilerplate was captured), so details on deal structure, timing, and strategic rationale are unavailable.

Wiz's autonomous AI security agent 'Red Agent' discovered and exploited a GitHub Actions script injection vulnerability in Snowflake's public repo (snowflakedb/snowflake-connector-net) five days after it went live. The vulnerability was introduced by PR #1218, co-authored by 'Copilot Autofix powered by AI,' which replaced a sanitized input pattern with direct string expansion of GitHub issue titles into a run: block—yet GitHub's AI-assisted security review flagged nothing. The exploit let an unauthenticated attacker execute arbitrary commands on a GitHub Actions runner and exfiltrate a token to access Snowflake's internal Jira.

Germany's Bundeskartellamt concluded proceedings against Apple after the company committed to changing its App Tracking Transparency Framework (ATTF), which had imposed stricter consent-prompt requirements on third-party apps than on Apple's own apps. Apple must now align consent requests more closely and give third-party app providers more freedom to combine consent prompts sensibly. Apple maintains ATTF is privacy-protective but offered binding commitments under Germany's abuse-of-dominance provision for large digital companies.

A community-maintained guide provides step-by-step instructions for disabling intrusive AI features in consumer software like Adobe Acrobat, Android/Gemini, Amazon, and Apple Intelligence. It covers specific settings menus and toggles to turn off generative AI, voice assistants, and data collection features across major platforms.

Windows 11's Release Preview Channel now includes a movable taskbar (top, left, right, or bottom), compact icon mode, Start menu size customization, and the removal of WMIC from Features on Demand. Admin protection via just-in-time elevated privileges is also present, disabled by default but configurable through Intune or Group Policy.

A Hacker News thread sparked by GitHub's recent reliability issues surveys practical alternatives, with commentaries recommending Forgejo, Gitea, GitLab, CodeBerg, and bare-bones setups like gitolite + CGit depending on whether you need CI, issue tracking, or just repo hosting. CodeBerg is flagged as explicitly hostile to LLM-related content, which may matter for AI-focused teams.

Memory prices have risen 500% over 12 months, reaching up to 10x the lowest ever tracked prices, with 128GB of DDR5 now costing $3,399. The article tracks this as a sustained price climb rather than a short-term spike.

DuckDB v2.0 ('Cyanoptera') is coming this fall with a major version bump driven by a new SQL parser, new default storage format, reworked C API, and breaking changes. Headline features include DuckDB-as-a-server via the Quack extension (now stable), the new CONNECT statement for remote database sessions with SQL pushdown to PostgreSQL and MySQL, triggers, a VARIANT type, and asynchronous I/O.

The article URL points to an Ars Technica story about the only known trebuchet casualty in history, but the extracted text contains only cookie consent and privacy policy boilerplate—no article content was captured.

A Hacker News post reports GitHub is experiencing an outage blocking pull request access, with 288 upvotes indicating broad impact. GitHub's own status page at the time falsely showed everything as operational.

This is a GitHub status page entry for a resolved incident with GitHub.com, but the article text contains only the page's subscription UI boilerplate (country code dropdown for SMS/email alerts) and no incident details, timeline, root cause, or impact description.

A weekly cybersecurity recap covering active exploitation of VMware vCenter CVE-2026-59310 (CVSS 9.8, directory traversal) by a suspected China-nexus APT deploying Babuk-derived ransomware as a forensic smoke screen, a macOS Screen Sharing auth flaw CVE-2026-65400 (CVSS 9.8) exploited for crypto mining, and a SANS survey showing 78% of security practitioners now use AI in their strategy (up from 50% last year) while only 36% have a formal AI risk program. The title also references MCP attacks and browser hijacks, but the excerpt cuts off before those details.

Uber is investing in and partnering with Zipline to add drone delivery to Uber Eats, targeting one million drone deliveries per day by end of 2029, with first deliveries starting in Zipline's existing markets by end of 2026. Uber is replicating its autonomous-vehicle platform strategy—onboarding many partners rather than building in-house—having committed over $10B to dozens of AV providers, though its relationship with Waymo is deteriorating and expected to end in 2028. Zipline's drones are pitched as enabling 5-10 minute order fulfillment.

The UK Health Security Agency awarded Capita a £31M contract to build an omnichannel public health contact center (Single Service Centre) starting November, with potential to scale to £350M during a COVID-scale pandemic. This comes despite Capita's widely criticized failures administering the Civil Service Pension Scheme, where the UK government withheld £10M in payments and called in an independent auditor after service disruptions left retirees struggling financially.

America's largest electricity grid operator is proposing that new data centers consuming 50MW or more must bring their own on-site power generation or face being first in line for blackouts during supply shortages. The rule targets the massive power demands of AI-driven data center expansion and shifts the burden of grid reliability onto the largest new consumers.

Wispr, maker of AI dictation tool Wispr Flow, raised $280M Series B at a $2B valuation led by Menlo Ventures, bringing total funding to $361M. The company launched a new speech model called Canto to cut error rates from 30% to under 10% after user complaints about quality dips, and is expanding into meeting note-taking, competing with Granola, Fireflies, and Read AI.

Import AI 469 covers DiG-bench (Discovery in Games), a new benchmark of 70 text-based games where rules and objectives are hidden and must be uncovered through interaction, designed by researchers from Oxford, Princeton, MIT, Inria, KAUST, Swiss AI Lab, and Thinking About Thinking (including Juergen Schmidhuber). Most games are kept private to prevent contamination, all are human-beatable but difficult, and current frontier models cannot solve them — measuring whether AI can infer environmental mechanics through curiosity-driven exploration rather than being told the rules.

Data breaches at two shipping companies exposed the names, home addresses, emails, and phone numbers of thousands of Trezor and SafePal hardware wallet customers. The wallet devices themselves were not compromised, but the stolen shipping data puts crypto holders at risk of physical 'wrench attacks'—which CertiK says rose 75% in 2025 with over $40 million stolen—and targeted phishing.

The article text provided contains only Tom's Hardware website boilerplate and navigation elements; no substantive content about the Asus ROG Edition 20 gaming PC build was included.

CNBC's Morning Squawk covers Berkshire Hathaway adding $17 billion to its Alphabet stake in Q2, making Alphabet Berkshire's third largest holding. The newsletter also mentions hedge fund Situational Awareness loading up on AI stocks before a sharp pullback forced a portfolio sale, alongside routine market and regulatory items.

Gartner forecasts agentic AI workflow costs will rise more than fivefold by end of 2028 because complex agent workflows consume far more tokens than chatbots, outweighing per-token price drops. Routing a single task to an agentic reasoning model increases inference costs at least fivefold, and usage-based billing models make runaway costs worse. Gartner separately predicted 40% of organizations will demote or decommission AI agents due to these and other problems.

Roboflow benchmarked OpenAI's new GPT-5.6 lineup (Sol, Terra, Luna) on vision tasks and found Sol is a major leap for object detection, scoring 46.2 mAP@50 versus GPT-5.5's 13.8. The models perform best when prompted to return absolute XYXY pixel coordinates; using the wrong format (e.g., normalized YXYX like Gemini 3.5 Flash) drops performance by ~15 mAP points. Sol still occasionally hallucinates bounding boxes in random layouts unrelated to actual objects.

Yana Welinder, solo founder of AI-native fashion brand Yana Bana, used ChatGPT Images 2.0 and Codex with computer use to go from hand-drawn sketches to CAD files, product photos, vendor outreach, and a live Stripe-connected pre-order site—without hiring engineers. Her core technique is treating prompts as detailed technical specs covering silhouette, fabric behavior, movement, and sound, and using Codex to operate unfamiliar 3D design software like CLO 3D.

MCP servers, the middleware that lets AI agents connect to external tools and data, are becoming a major security blind spot by holding plaintext credentials, API tokens, and service account keys in configuration files. The article identifies three core exposure vectors: plaintext config files, over-permissioned access, and prompt injection—often before security teams even know the server is running. Because MCP turns AI agents into active identities with non-human credentials, a leaked secret grants attackers the ability to take action, not just read data.