AI Weekly Malaysia

TechCrunch Disrupt 2026 exhibit table bookings close September 18 at 11:59 p.m. PT. The $12,500 package includes a 6′ x 30″ table for all 3 days (Oct 13–15 at Moscone West, SF), 10 team passes, lead generation via the Disrupt app, VC access, and press-list access. The event expects 10,000+ founders, investors, and operators.

The article title announces new experts joining Google's AI & Economy research team, but the provided text contains only site navigation boilerplate and no substantive content about who joined, what they will work on, or what the team's research priorities are.

Ning Xu of Tsinghua University captured tiny cilia beating in airways of a child with rare respiratory disorder.

Hackers reportedly breached OpenAI by leveraging Claude tools, gaining access to employee accounts and OpenAI's internal codebase. As proof of the intrusion, the attackers submitted a 'harmless' pull request within the company's repositories.

The article title claims researchers used Claude to hack OpenAI, but the provided text contains only cookie consent boilerplate with no substantive content about the research, methods, findings, or impact.

An AI developer used vibe coding to port NVIDIA's DLSS 5 neural rendering onto Intel Arc 140T integrated graphics, achieving 360p at 10 frames per second. The result is a proof-of-concept far below playable performance, but notable as an AI-assisted coding experiment on non-NVIDIA hardware.

Article URL: https://arxiv.org/abs/2609.20804 Comments URL: https://news.ycombinator.com/item?id=49753878

Control Resonant's warped Manhattan cityscape pushes graphics cards to the max thanks to path-traced lighting effects and full support for Nvidia's DLSS 4.5 technologies. We put it to the test to see how it performs on 28 graphics cards from Nvidia, AMD, and Intel.

U.S. companies and Washington accuse Chinese AI labs of using 'distillation'—training models on the outputs of more advanced, expensive models—to close the AI gap, calling it theft. But Cohere CEO Aidan Gomez and other analysts push back, arguing China's progress isn't solely from distillation and that restricted access to key technology has driven genuine innovation.

Prusa Research makes its large CORE One a tiny bit better in a very important way.

Google announced a collaboration tied to New York Fashion Week involving a product or initiative called 'Google Flow,' but the article body is almost entirely site navigation boilerplate with no substantive technical detail, feature list, pricing, or API information.

OpenAI and Anthropic are both pushing ahead with IPOs despite internal safety warnings, with Anthropic potentially going public later this year. Recent resignations, including former employee Jacob Coxon, underscore growing concerns about AI risks, while investors remain divided on whether going public helps or hinders safety oversight.

The EU has proposed the 'KIDS Act' imposing strict age limits on minors' access to social media, games, and AI assistants, banning design patterns like endless scrolling, midnight notifications, and AI 'friendships.' 15-year-olds could create social media accounts independently, while 13- and 14-year-olds would require parental consent. The proposal aims to force platforms to be safe-by-design before children use them.

Legal briefs filed in the NYT lawsuit against AI companies reveal that a Microsoft director internally called AI scraping 'the largest theft of labor in human history,' while an OpenAI head described ChatGPT as an 'existential threat' to publishers. These are admissions from inside the companies building the tools, not outside critics.

Microsoft patched a CVSS 10.0 missing-authentication flaw (CVE-2026-85889) in Azure AI Foundry enabling network-based privilege escalation, plus three other critical cloud CVEs: a 9.9 command injection in Microsoft 365 Copilot (CVE-2026-85885), a 9.9 improper authorization in Azure Database for PostgreSQL (CVE-2026-85878), and a 9.6 improper neutralization in Azure Cosmos DB (CVE-2026-87701). All cloud flaws were mitigated server-side with no customer action required, and there is no evidence of in-the-wild exploitation. Microsoft also shipped an out-of-band Windows 11 26H1 update (KB5129194) for two local privilege escalation flaws (CVE-2026-62721 at 7.8 and CVE-2026-85921 at 8.2).

CNBC's Morning Squawk covers Warren Buffett stepping down as Berkshire Hathaway chairman after 60+ years, with his son Howard succeeding him. The newsletter also briefly mentions an ongoing debate about slowing AI development, possibly drawing lessons from an Oscar-winning film, but provides no technical detail.

US frontier AI companies are warning authorities about sophisticated distillation attacks that may allow China and Russia to replicate Western AI model capabilities at a fraction of the cost and compute. Direct attacks are reportedly simple enough to stop, but purchasing third-party conversation data remains an elusive attack vector. China has rejected the claims and threatened 'countermeasures' if the US uses the allegations to constrain Chinese AI development.

Article URL: https://hawksley.dev/blog/i-dont-like-passkeys Comments URL: https://news.ycombinator.com/item?id=49753211

Article URL: https://blog.liampwll.com/posts/bend_vibe_coding/ Comments URL: https://news.ycombinator.com/item?id=49753179

OpenAI introduces the Australian Youth Safety Blueprint, a six-pillar roadmap for safer AI experiences that protect and empower young people.

A modder ported Nvidia's DLSS 5 to run inside a web browser via WebGPU, producing a 147MB package that works on non-Nvidia GPUs and macOS. The port is functional but extremely slow, taking roughly two seconds per render, making it a proof-of-concept rather than a practical tool.

US semiconductor manufacturers face a projected shortfall of up to 157,000 workers by 2030, with only 3% of US engineering graduates entering chipmaking despite six-figure salaries. The article itself is mostly site navigation and boilerplate with minimal substantive detail beyond the headline figures.

Article URL: https://www.nytimes.com/2026/09/18/business/warren-buffett-berkshire-chairman.html Comments URL: https://news.ycombinator.com/item?id=49752614

In July 2025, someone re-registered an expired CDN domain that thousands of websites, code repos, and documentation pages still hard-code references to. The new owner now controls wildcard DNS for the entire domain, meaning any hostname under it resolves to their infrastructure. This mirrors the June 2024 polyfill.io incident where a domain embedded in 110,000+ sites changed ownership and began serving malicious conditional redirects to mobile visitors.

A vulnerability dubbed Plugin4Shell lets repository owners swap pinned plugin code in four AI coding agents (Claude Code, Codex, Copilot, Gemini CLI) by creating a branch named like the commit hash the agent locked to, then pointing it at malicious code. Anthropic patched it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, but GitHub Copilot has no fix and Google won't patch Gemini CLI (being retired). GitHub blocks hash-shaped branch names so GitHub-hosted plugins are safe from the branch trick, but Bitbucket and self-hosted git servers are exposed; Gemini CLI has a separate attack via a main branch named FETCH_HEAD.