AI Weekly Malaysia

A terminated employee at a 1,000+ person company retained active credentials for several days because HR and IT each assumed the other would revoke access. The ex-employee deleted files, locked out other accounts, and corrupted a database, causing hundreds of thousands of dollars in damage and weeks of project delay. Recovery was slow because the person who damaged the systems knew them best.

Polars 2.0 release candidate is out, with the biggest change being that LazyFrame collect() now defaults to the streaming engine instead of the in-memory engine, expecting ~5x performance improvements and lower memory usage. Row order is no longer guaranteed for joins, group_by, and unpivot unless you set maintain_order=True, and stricter schema validation is emphasized with collect_schema() for early error detection.

Eli-Shaoul Khedouri, CEO of Intuition Machines, argues that standard sandboxes and VMs are insufficient to contain frontier AI models, and proposes 'data diodes'—hardware enforcing one-way network flow via optical fiber—to prevent AI breakouts. The hCaptcha team describes a concrete architecture: isolated training zones with optical ingress diodes for vetted artifacts only, a second diode sending telemetry to a seL4 receiver/scrubber, and immutable snapshots of PyPI, GitHub, and npm registries plus mocked APIs.

Security researcher Chaotic Eclipse released a PoC called FalconFlank, a zero-day privilege escalation exploit abusing CrowdStrike Falcon Sensor's Office malicious macros remediation on fully updated Windows 11 25H2 and Windows Server 2025. This follows the same researcher's recent PoCs for Kaspersky endpoint security (HardBreacher) and an unpatched Microsoft Defender zero-day (ShieldBreak, CVE-2026-69414) that grants SYSTEM privileges.

Xiaomi launched the Mijia Front Load Washer Dryer Pro in Malaysia with 12.5kg wash / 8kg dry capacity, touchscreen, dual auto-dosing, steam hygiene, and Xiaomi Home app integration. Retail price is RM3,399 but an introductory price of RM2,399 is available from 9 September 2026 via Xiaomi's site, stores, Shopee, Lazada, and TikTok. A compact standalone 8kg washer was also announced for the same date.

Xiaomi Malaysia launched three budget wearables — Redmi Watch 6 Lite (promo RM249), Redmi Watch 6 Active (promo RM159), and Xiaomi Smart Band 11 Active (promo RM119) — available now through Xiaomi Stores, mi.com, Shopee, Lazada, and TikTok Shop until 30 September 2026. The Watch 6 Lite includes built-in GNSS and 5ATM water resistance; the Active variant has IP68 rating and a 9.9mm body.

French Finance Minister Roland Lescure warned that Europe's AI ambitions cannot depend on a single company like Mistral, emphasizing the need for a diversified AI ecosystem amid US-China tensions. He acknowledged Mistral's significance but pointed to a consortium-led state-of-the-art model development initiative as part of broader European efforts, while noting Mistral's expansion plans including a new data center.

CISA added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including a CVSS 10.0 SSRF and a 7.8 OS command injection in SonicWall SMA 1000, a 9.8 improper authentication flaw in JFrog Artifactory allowing unauthenticated admin access under default config, a 6.5 HTTP request smuggling issue in Kludex Starlette, a 10.0 unauthenticated workflow execution flaw in Kestra OSS, and an 8.8 improper authentication bug in Berri LiteLLM's MCP Streamable HTTP endpoint that lets an unauthenticated attacker establish an authenticated MCP session with an arbitrary Bearer token.

Edotco Group, which operates over 3,000 towers and managed sites in the Philippines since 2019, has appointed Sunil Issac as country managing director to lead its next growth phase there. The Philippines is now a priority market for Edotco, aligned with the country's National Digital Connectivity Plan and rising data demand.

Meta's Muse Spark 1.3 launched claiming frontier-level performance matching GPT-5.6-Sol, ranked #3 globally per AAII, with open weights promised soon and a pricing model offering 90%+ discounts if users opt in to training on their data. Separately, Stanford replaced 85% of its Fall 2025 software engineering curriculum with agent-focused topics including context engineering, MCP portals, and parallel background agents, alongside a new CS329Z course on building agents from scratch.

Uber and British start-up Wayve launched London's first commercial robotaxi service on September 3, 2026, with human safety supervisors still behind the wheel. The phased rollout starts with a limited vehicle fleet, as fully driverless operations await regulatory approval. Wayve is now ahead of Waymo (Alphabet) and Baidu (Lyft partnership) in the London market, with plans to expand to Tokyo and other cities.

Unifi TV is granting free access to all 73 channels—including HBO, Cinemax, SPOTV, and beIN SPORTS—from 31 August to 30 September 2026, available to anyone in Malaysia including non-Unifi customers via the Unifi TV 2.0 app with no payment or subscription required. From 1 October 2026, a permanent lineup of 22 free channels (16 free-to-air plus six premium including DEGUP HD, Dunia Sinema HD, and Al Jazeera) will remain, with promotional users auto-transitioned.

Boost Bank and Parkson Credit Sdn Bhd have partnered to offer digital financial services—including personal loans, insurance, and savings/current accounts—to underserved Malaysians via streamlined digital onboarding. Parkson Credit CEO Danny Poh and Boost Bank CEO Puan Fozia Amanulla framed the alliance as combining consumer financing experience with digital banking channels to improve financial accessibility.

Macrokiosk, an enterprise solutions platform company, has adopted FutureK, a hybrid employee medical benefits solution from Heydoc Health, for its workforce. The partnership was formalized at Macrokiosk's Founders' Theatre in Kuala Lumpur and covers preventive care, everyday health management, and mental health support.

Broadcom beat Q3 FY2026 estimates with $29.59B revenue (up 86% YoY) and $3.32 adjusted EPS, but shares fell 5% on weak Q4 guidance of $34.8B versus the $35.03B analysts expected. The company designs custom AI chips for Google, Meta, and OpenAI, and has recently added Apple and OpenAI as new customers.

OpenAI released GPT-6 Astra, their first model to reach the 'Critical' cybersecurity capability threshold under their Preparedness Framework, meaning it can autonomously discover unknown security flaws and develop exploits across well-protected systems without human guidance at each step. OpenAI reports it is significantly more robust against jailbreaks than GPT-5.6 Sol, including over longer trajectories, and includes adjustable refusal boundaries for high-risk users.

Funes is a single-binary memory layer for coding agents (Claude Code, Codex, pi, Hermes) that indexes session traces locally into a Lance dataset using a pinned local embedding model, then exposes recall and get tools so agents can retrieve past decisions during new sessions. It combines vector and BM25 search with cross-encoder reranking, indexes incrementally, and can optionally sync to a private Hugging Face dataset you own.

A fully open recipe for fine-tuning LiquidAI's LFM2.5-350M model with GRPO via the TRL library to improve structured-output compliance, evaluated on the IFStruct benchmark. The training runs in ~500 samples and 100 steps on a free-tier Colab or Kaggle GPU, lifting IFStruct scores from 22.6% to 29.7%. Evaluation is done locally via llama.cpp on a MacBook Pro M5 Max with 36GB unified memory.

Sergio Paniego reproduces Surya Narreddi's viral watercolour-painting LLM project using TRL and OpenEnv, training a Qwen3.5-35B-A3B model with LoRA and GRPO to write p5.brush JavaScript that generates watercolour art. The entire pipeline runs on Hugging Face infrastructure—Jobs for training, Spaces for the RL environment and scorer model, Inference Providers for the pairwise judge—and all artifacts, scripts, and a hand-rated reference pool are published openly.