AI Weekly Malaysia

Mark Pesce argues that Alibaba's Qwen3.8-27B, released mid-August 2026 and described as near-frontier-level, has been compressed by the local AI community to run on laptops including M4 MacBook Airs, making capable AI effectively free. He contends this shifts the security landscape: with frontier AI soon running on hundreds of millions of smartphones, attack volume will scale beyond human defenders, making AI defensive swarms the only viable response. The piece references recent incidents including a $600K METR API key theft and OpenAI's $1B commitment to cyber defenders as evidence the threat is already materializing.

Gartner VP Craig Lawson argues that Anthropic's Mythos and similar AI bug-hunting tools have driven a record volume of CVEs in 2026—Microsoft alone shipped 970+ patches last week—but may exhaust the backlog of flaws in established codebases, leading to fewer and less severe CVEs by 2027. He cites AI-found CVEs in OpenBSD as evidence that even historically secure code is being scrubbed, and predicts AI will let organizations run daily red-team exercises instead of costly annual external engagements.

Attackers are actively exploiting a critical arbitrary file upload flaw (CVE-2026-27540, CVSS 9.8) in the WooCommerce Wholesale Lead Capture premium plugin, affecting versions up to 2.0.3.1. Wordfence has blocked over 100,000 exploit attempts since June 2026 that upload PHP web shells via the unauthenticated 'wwlc_file_upload_handler' AJAX action.

Malaysia's next-generation MyKad launches 17 September 2026 with 53 security features including a dynamic hologram, polycarbonate body, UV elements, QR code, and a new dual-interface chip supporting both contact and NFC contactless reads. Notably, JPN has confirmed the new MyKad will no longer include Touch 'n Go functionality, breaking a long-standing payment use case.

A critical JWT bypass vulnerability (CVE-2026-5430, CVSS 9.8) in WSO2 API Manager is under active exploitation, with watchTowr honeypots capturing forged admin-privilege tokens on September 13, 2026. The flaw allows authentication bypass when a token is signed with an unsupported algorithm that the service accepts anyway, enabling full account takeover. It affects WSO2 API Manager 4.1.0–4.6.0, API Control Plane 4.5.0–4.6.0, Traffic Manager, and Universal Gateway, with fixes available via specific update levels.

JDK 27 ships with compact 64-bit object headers enabled by default (JEP 534), down from 96-bit, yielding 22% less heap space and 8% less CPU on SPECjbb2015 benchmarks. It's a short-term non-LTS release with four production-ready JEPs and five previews, none requiring immediate code changes. Amazon and SAP already run compact headers in production, and Oracle confirmed no JDK support for Intel Macs after this release.

South Korean universities offer company-linked degree programs with financial support and guaranteed job pathways to Samsung Electronics and SK Hynix. Applications to Samsung-linked contract departments rose 6.5% and SK Hynix-linked programs rose 12.7% for the 2026 admission cycle, as AI demand keeps traditional degrees relevant despite broader skepticism.

Grab is acquiring a 60% controlling stake in Singapore-based BNPL platform Atome Financial for $1.49 billion in cash, with plans to buy the remaining 40% roughly two years later. CFO Peter Oey called consumer lending the 'next frontier' for Grab's financial services expansion. Grab shares closed 3.64% lower on Nasdaq following the announcement.

BYD Malaysia announced a Hibiscus Red Malaysia Day Special Edition of the BYD Sealion 7 Performance AWD, limited to 16 units and priced at RM197,800 under a year-end deal (RRP RM203,800). The 2026 refresh includes a 91.39kWh 800V Blade LFP battery, 600km NEDC range, and 230kW DC fast charging.

The article URL points to an Ars Technica story about how chimpanzees teach their offspring to use tools, but the retrieved content contains only cookie consent and privacy policy boilerplate—no substantive article text was captured.

Anthropic is opening its fifth Asia-Pacific office in Singapore in October 2026, hiring across finance, sales, applied AI, marketing, and research, with Dale Finlay (ex-Google Cloud) appointed as ASEAN GM. Singapore ranks second among 121 countries in Claude.ai usage relative to population, 5.81x higher than expected, with strong enterprise demand in financial services and government.

Apple introduced 'Apple Reference Image,' an opt-in mode for iPhone 18 Pro and Pro Max that creates securely timestamped reference images to verify photographic authenticity against AI alterations. It uses dedicated secure hardware and Private Cloud Compute to protect image integrity and photographer privacy, contrasting with the C2PA standard's post-capture metadata approach which is vulnerable to editing chain compromises.

Meta CEO Mark Zuckerberg publicly aligned with Nvidia CEO Jensen Huang's stance against slowing AI development, arguing that market incentives—specifically liability for harm—will push companies to prioritize alignment. He framed trust and alignment as competitive differentiators for agents and models, contrasting with Anthropic CEO Dario Amodei's more cautious position.

TypeSafe AI, a $40M-funded startup led by former OpenAI researcher and RLHF co-inventor Diogo Almeida, released 'Jev' — a model that returns typed probabilistic decisions (JSON with confidence scores) instead of natural language. It uses question primitives called Choice, Score, and Noul, and is built on an architecture called Reinforcement Learning for Calibrated Decisions (RLCD). The demo plays Doom using structured game-state input, but the real target is business workflows like customer service routing.

Leading AI companies including OpenAI are collaborating on a self-regulatory standards body for AI safety, inspired by a proposal from Google DeepMind's Demis Hassabis. Some executives support slowing AI development, but concerns remain about the industry writing its own rules.

Former Google DeepMind researcher Bilal Chughtai has publicly warned that advanced AI could become uncontrollable and pose existential threats, joining other AI insiders calling for slowing development. The article provides no specific technical evidence, policy proposals, or concrete safety findings beyond the general warning.

At Salesforce's Dreamforce conference, Nvidia CEO Jensen Huang argued against new AI regulation, framing AI safety as 'an engineering problem, not a legal one' and saying existing laws plus market forces are sufficient. He claimed companies should simply not release products they aren't confident in, and that innovation speed and safety are a 'false choice.'

OpenAI CFO Sarah Friar told CNBC's Jim Cramer that OpenAI would slow down frontier development if its researchers advised it, framing safety as a business decision she manages as CFO. Her comments come amid renewed debate about AI risks, with Anthropic's Dario Amodei, Elon Musk, and Sam Altman reportedly agreeing on calls for an industry-wide slowdown.

Anthropic is merging Claude Cowork (async long-running tasks) and chat into a single interface, eliminating the need to choose where a task goes. Claude Docs and Claude Slides are new today in beta on paid plans, with Claude Design now accessible inside any conversation; outputs can be edited inline, presented directly, or downloaded as PowerPoint or PDF. Rollout starts on Pro and Max plans over the next few weeks, with Enterprise admins controlling activation.

Elon Musk, speaking at the All-in Summit in Los Angeles, proposed that leading AI labs (OpenAI, Anthropic, Google, Meta) and several Chinese companies should run a 'test harness' on each other's models before public release, so competitors grade each other's safety rather than self-evaluating. This comes as Anthropic, OpenAI, and other AI leaders spent the weekend warning about AI harms, while President Trump dismissed regulation concerns as a 'hoax.'

Google released Gemini 3.8 Live and 3.8 Live Extended Thinking, two new speech-to-speech models comparable to OpenAI's GPT-Live family. Simon Willison built a zero-library browser UI that connects directly to Google's WebSocket endpoint (wss://generativelanguage.googleapis.com/ws/...BidiGenerateContent) using the Web Audio API for bidirectional voice conversation, including mid-speech interruption.

Salesforce CEO Marc Benioff used a Mad Money interview at Dreamforce to warn AI companies not to repeat social media's mistakes, citing past harms to individuals and companies. His comments follow Anthropic CEO Dario Amodei's weekend essay urging frontier AI labs to slow model development so safety measures can catch up.

NASA's Roman Space Telescope has sufficient propellant for a 22-year mission lifetime, roughly double the agency's original expectations. The article text itself was not accessible—only cookie consent boilerplate was captured.

A US political and industry split has formed over AI safety regulation, with Trump, Nvidia's Jensen Huang, and David Sacks opposing new rules, while Anthropic's Dario Amodei, OpenAI's Sam Altman, and Elon Musk call for slowing frontier model development. The debate was sparked by Anthropic researcher Jacob Coxon resigning over safety concerns, followed by an Anthropic alignment lead estimating a greater than 10% chance of AI killing all humans.

John Wang breaks down the engineering constraints of the US Strategic Petroleum Reserve, which must store 714 million barrels of crude oil securely for decades while allowing rapid release during supply disruptions. The article walks through why naive approaches like external floating roof tanks (requiring ~1,130 tanks across 45,000 acres, roughly the size of Washington D.C.) fail on vulnerability and cost, and why even underground steel-lined concrete tanks like the Navy's Red Hill facility at Pearl Harbor have limitations.