AI Weekly Malaysia

Claire Vo abandoned Claude for months due to its rambling, hedging, and preachy disclaimers, moving her daily work to OpenAI's Codex. After a week of testing Claude Opus 5.5 — which Anthropic claims is 40% cheaper than Opus 5, faster, and built on a 'fundamentally different alignment approach' — she ran four long-running agentic tasks, a ChatPRD homepage redesign, an SVG benchmark, and frontend prototyping, concluding Opus 5.5 is now her go-to for frontend work, though Codex still wins in some areas and two annoyances remain.

Bloomberg reports that the Pentagon acknowledged overreliance on AI contributed to a US military missile strike that destroyed an Iranian school. The investigation traces the failure through the military's 'kill chain' decision pipeline, where automated systems played a role in target identification or confirmation without sufficient human scrutiny.

Trail of Bits argues SAML is a 'fractal of bad design' rooted in 2002-era committee-driven XML protocol design, combining four competing XML security protocols into one. The core vulnerability is its reliance on XML signature validation, which is so complex that most implementations simply wrap libxmlsec, a C codebase few audit, making the protocol fragile and overdue for replacement by OpenID Connect (OIDC).

ShinyHunters claims to have breached the FBI by exploiting an Oracle PeopleSoft HR server, then pivoting into an Amazon-hosted government cloud to steal terabytes of data on thousands of agents and applicants. 404 Media verified a sample of stolen names, addresses, and phone numbers; the hackers say the attack is not financially motivated but aimed at forcing the FBI to retract a report about the group.

Check Point disclosed a CVSS 9.8 path traversal zero-day (CVE-2026-93616) in its Security Management Server web service, exploited in targeted attacks on July 23 before a fix shipped September 22. The flaw lets unauthenticated attackers upload and execute scripts on the server that controls firewall policies. Check Point also reported active exploitation attempts since September 12 against a VPN flaw (CVE-2026-85102) fixed September 9, targeting Spark small-business firewall customers.

Andreessen Horowitz is launching The Horowitz Andreessen Academy in San Francisco, a tuition-free one-year program for ~50 high school graduates selected on 'proof of work' (what they've built, shipped, or earned). The for-profit venture has raised $42 million, plans to expand to a two-year program in 2028 charging elite-private-university tuition, and offers access to 200 mentors from ten corporate partners including OpenAI, Anthropic, Nvidia, Replit, and Stripe. It is not accredited and grants no degree or transferable credits.

Tom's Hardware highlights an Amazon deal on a Samsung P9 512GB microSD Express card at $99 (33% off), pitched as storage expansion for the Nintendo Switch 2. The article body is almost entirely site navigation and membership boilerplate, with no substantive technical detail beyond the price and capacity.

Simon Willison surfaced a TikTok quote from @therealcornpop arguing that AI-written video scripts are obvious not just because of familiar 'AI-isms' (the 'it's not X, it's Y' pattern, rule of three, broken staccato punctuation) but because they lack a definitive personal voice and genuine opinions about the subject matter.

WordPress patched a critical unauthenticated vulnerability (CVE-2026-87902, CVSS 9.2) on September 22 in version 7.1.2, affecting all versions from 4.7.0 through 7.1.1. The flaw allows an attacker with no account to make a site load a PHP file outside theme folders via path traversal in template file selection, potentially enabling code execution on servers where a suitable PHP file already exists.

OpenAI introduced GPT-6 Sol and Luna, two cheaper models in the GPT-6 family, with API prices cut 50% versus GPT-5.6 promotional pricing. Sol is priced at $2/$10 per 1M tokens (input/output) and Luna at $0.10/$0.50. OpenAI claims Sol at xhigh effort outperforms Claude Opus 5 at max effort on AutomationBench at 9% of Opus 5's cost per task.

OpenAI launched GPT-6 Sol and Luna, two cost-efficient models trained with similar methods to the flagship GPT-6 Astra. API prices are cut 50% versus GPT-5.6 promotional pricing: Sol drops to $2/M input and $10/M output, while Luna drops to $0.10/M input and $0.50/M output. On AutomationBench, GPT-6 Sol at xhigh effort reportedly outperforms Claude Opus 5 at max effort at 9% of Opus 5's cost per task.

OpenAI launched GPT-6 Sol and Luna, smaller-tier models in the GPT-6 generation following this month's GPT-6 Astra release. Sol targets complex tasks like coding; Luna targets high-volume clerical work such as summarization and information extraction. The 6 series models are priced at half the cost of the 5.6 series, attributed to caching and inference improvements, and OpenAI claims GPT-6 Sol makes roughly half the factual mistakes of its predecessor.

A malicious npm package called 'tw-pkgprobe-7731' was uploaded in mid-August 2026, posing as an authorized Twilio HackerOne bug-bounty probe. It published 11 versions in roughly 45 minutes, with version 1.0.4 specifically exfiltrating Twilio ACCOUNT_SID and AUTH_TOKEN environment variables via webhook, potentially allowing attackers to authorize billing and trigger communications on compromised accounts.

Aurora Innovation gave CNBC a three-hour ride-along in a driverless semi operating on Texas interstates I-45 and I-20. The company currently runs 20 autonomous trucks and plans to scale to 200 by end of 2026, targeting positive free cash flow by 2028, with CEO Chris Urmson claiming lower operating costs than human-driven trucks.

Hacking group ShinyHunters claims to have breached multiple FBI-related services and stolen data on all FBI employees and applicants, including names, home addresses, phone numbers, and spouse details. A sample of 5,000 records seen by 404 Media appears to corroborate the claim. The breach has serious counterintelligence and personal safety implications for FBI personnel.

Waymo is expanding its robotaxi service to teenagers as young as 13 in Nashville, its second market after Phoenix, with more cities planned. Paid robotaxi trips grew tenfold from 50,000 per week in May 2024 to over 500,000 per week, and Waymo has launched in a dozen cities including Denver, Las Vegas, San Diego, and Tampa in the past month. Teen accounts require a parent/guardian link but allow up to three guests aged 13-17, with no disclosed age verification method.

OpenAI CEO Sam Altman, Anthropic CEO Dario Amodei, Hugging Face CEO Clément Delangue, and Yoshua Bengio are expected to address the UN Security Council on AI this week. The meeting comes amid escalating debate over AI safety and regulation, while President Trump has dismissed AI risk warnings as a 'hoax' and pledged to encourage 'super intelligence.'

The article text provided contains only Ars Technica's cookie consent and privacy policy boilerplate, not the actual review content. No substantive information about the Resident Evil adaptation is available from the supplied text.

Binance agreed to buy $100 million of Circle shares at $80.84 each (two-year lockup) as part of a five-year deal where Circle pays Binance a monthly incentive fee tied to USDC balances on the exchange. The partnership gives USDC access to Binance's global user base to compete with Tether in international markets.

GrapheneOS posted that there is a high chance of devices being sold with GrapheneOS preinstalled by 2027. The scraped post body is mostly Mastodon page chrome and an unrelated quote from another user about Google ignoring disabled settings, so concrete details on pricing, hardware partners, or timelines beyond the 2027 target are absent.

Toyota announced plans to deploy 400,000 factory robots and is ordering workers to train humanoid robots, while publicly claiming this will not replace human workers. The article content was not captured beyond the headline and cookie consent boilerplate, so details on timeline, robot models, or workforce impact are unavailable.

Microsoft took down EvilTokens, a phishing-as-a-service platform that compromised 12,000 inboxes by abusing the OAuth 2.0 device authorization flow. The platform used an AI chatbot to analyze victim inboxes, identify trusted relationships and payment patterns, and draft impersonation messages to maximize fraud success. UK police arrested two men (ages 32 and 38) on September 11, 2026; Microsoft tracks the operators as Storm-2992.

An IT mistake erased 11 years of viewing history (audit logs) for hospitals' maternity records. The article body was not captured—only cookie consent boilerplate was provided, so details on root cause, scope, and remediation are unavailable.

Claude Opus 5.5 (Max with fallback) ranks #1 of 212 models on the Artificial Analysis Intelligence Index with a score of 58, nearly 2.3x the median of 25. It is expensive at $4.00/1M input and $20.00/1M output tokens (double the median on both), and notably verbose—generating 260M output tokens during benchmarking versus an 88M median, which compounds cost at $5.98 per Intelligence Index task.

A CVSS 9.8 unauthenticated RCE flaw (CVE-2026-90898) in Bifrost, an open-source AI gateway routing to 20+ LLM providers, lets attackers execute arbitrary commands via a single POST to /api/mcp/client when management auth is disabled—the default. The official Docker image binds the management API to 0.0.0.0, exposing it outside the container, and since the gateway stores all provider API keys, compromise means full credential theft. Fix is in transports/v2.1.0; v2.0.0 and all 1.6.x through 1.6.11 remain vulnerable, and JFrog advises treating any previously exposed unauthenticated instance as compromised and rotating all keys.