AI Weekly Malaysia

Researchers demonstrated that encrypted chain-of-thought blocks returned by OpenAI, Anthropic, and Google APIs are portable across sessions, users, and models. By replaying a stronger model's encrypted trace into a weaker, jailbroken sibling from the same provider, they extracted the stronger model's hidden reasoning in plaintext without directly attacking the stronger model or triggering anti-distillation safeguards.

A new surveillance approach reportedly combines roadside cameras with phone and Bluetooth signal detection to link individual devices to vehicle license plates, potentially creating far richer tracking profiles than plate readers alone. Details are limited to the excerpt.

Tom's Hardware benchmarks the AMD BC-250, a repurposed PS5 APU originally sold for crypto mining, now finding a second life as a budget Linux gaming board. A full BC-250 build costs around $400-500 versus over $1,000 for Valve's Steam Machine, delivering comparable performance at roughly half the price by unlocking 40 CUs and eight Zen 2 cores.

OpenAI launched GPT-5.6-Cyber, a cybersecurity-focused model with reduced refusals for dual-use tasks like exploit-chain development and privilege escalation. It completes 95% of advanced cyber requests versus 1.5% for GPT-5.6 Sol, and is available through a new 'Daybreak Red' access tier for authorized security research. Notably, it performs worse than the base model on open-ended vulnerability discovery and proof-of-concept development due to producing shorter, less detailed outputs.

Nvidia released Nemotron 3.5 Lightning, an open-source AI model it describes as 'lightweight' and capable of running on a single GPU on a laptop or desktop. It's Nvidia's first open-source model since CEO Jensen Huang publicly defended open-source AI on X in late July, aligning with other tech leaders urging the U.S. government to support open models. The model is free for companies to download.

Spotify will begin labeling AI-generated artists with 'AI Persona' profile badges starting mid-September 2026 and will exclude their music from editorial and algorithmic recommendations by default. Spotify won't rely solely on self-disclosure — it will proactively review profiles with photorealistic AI-generated identities, prioritizing those that have met pre-defined audience thresholds. Users who explicitly follow an AI Persona will still receive their recommendations.

Cloudflare's H1 2026 DDoS report covers Jan-Jun, mitigating 23.2M network-layer attacks and 29.64T HTTP DDoS requests (~5,343 attacks/hour). 935 attacks exceeded 1 Tbps with a 519% QoQ surge in Q2, DNS floods rose to 40% of network-layer attacks, and Operation PowerOFF targeted 75,000 DDoS-for-hire users across 21 countries.

England is on track to become one of the first countries to eliminate hepatitis C, having already treated over 100,000 people since 2015 and met the 80% treatment target. Deaths have fallen 36% in a decade, with 8-12 weeks of antiviral tablets curing over 95% of cases. Around 50,200 adults still live with the virus in England as of 2024.

Amazon SVP of Devices and Services Panos Panay is scheduled to speak at TechCrunch Disrupt 2026 (October 13-15, San Francisco) about post-smartphone hardware directions, including the generative AI revamp of Alexa (Alexa+), which rolled out across several U.S. access tiers earlier this year. The article is primarily a conference ticket promotion with no technical detail beyond naming Panay's prior work on Surface devices and Windows 11 at Microsoft.

Spanish police caught a suspected digital certificate fraudster after his real-time deepfake face-swap software glitched for barely a second during a live video identity check, exposing his real face. He had made 38 attempts to impersonate 30 people, using forged documents, household spotlights with colored bulbs to simulate ID holograms, VPNs, and deepfake tools to bypass a certificate authority's visual verification. Certificates were fraudulently issued on multiple occasions before the glitch led to his identification.

OpenAI's head of ethics has departed the company less than a year after joining, according to the Financial Times. The article is behind a paywall, so details on reasons, timing, or replacement are not available from the provided text.

Anthropic will watermark all text and files generated by models released after August 2, 2026, to comply with the EU AI Act's Transparency Code. The watermark travels with copy-pasted text and may persist through some editing, though Anthropic hasn't clarified how much editing removes it. Watermarking applies across Claude API, Claude, Claude Code, Claude Cowork, and Claude Tag, with file watermarking using the C2PA open standard.

Researchers from the University of Birmingham and Fuzzware found that a malicious SIM card can execute attacker-chosen code on cellular modems via a 'RUN AT' interface, present in 9 of 26 devices tested. Six of eight cellular modules accepted the command—including five Quectel parts pulled from an EV charger, industrial router, and car telematics unit—while only 3 of 18 phones did (OPPO Find X5, OPPO Reno 14 F 5G, ASUS Zenfone 9). All nine vulnerable devices run Qualcomm communication processors; Qualcomm has built a hardened config that disables the interface by default for future devices, but neither Qualcomm nor Quectel has published a public advisory.

Tom's Hardware reviewed the second-generation DeepCool AK620 and AK400 air coolers, noting they are quiet and powerful, with aesthetic options including a woodgrain finish or a digital display. The article body was not available beyond the title and site navigation boilerplate.

Mozilla revoked the OpenPGP subkey used to sign Firefox and Thunderbird Linux downloads after an unencrypted copy was accidentally committed to a private internal repository. The revocation certificate uses reason code 2 ("key material has been compromised"), which invalidates all past signatures—not just future ones—meaning older tarballs stop verifying once the revocation is imported. No evidence of external access exists, but Mozilla rotated the key ~7 months early anyway; the new subkey (fingerprint 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3) is valid until August 5, 2028.

The FCC is drafting a proposal to ban imports of new-model optical transceivers manufactured in China under the Secure Networks Act. Chinese manufacturers hold approximately 56% of global manufacturing capacity for these components in 2026, which are critical for hyperscaler AI interconnects that determine AI cluster performance, latency, and efficiency.

A $580 million undersea cable project was rerouted after fan pressure to avoid a Harry Potter filming location associated with the character Dobby's grave. The new route will instead pass near a Bronze Age burial site.

Tom's Hardware highlights a US retail bundle at $970 combining an AMD Ryzen 7 9800X3D, 32GB DDR5 RAM, a Gigabyte X870 motherboard, and a free 240mm AIO cooler. The deal is positioned toward gaming PC builders.

Mozilla revoked a GPG private subkey used to sign Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private GitHub repo accessible to a small number of employees. Audit logs showed no evidence of unauthorized access, but Mozilla did not disclose how the key landed in GitHub or how long it was exposed. Users manually verifying GPG signatures or running Firefox via Mozilla's RPM repo on Fedora 42 or earlier, RHEL, Rocky, AlmaLinux, openSUSE, or SUSE must manually remove the old key and import its replacement.

Security researchers created a fake DeFi startup called Ballena Azul, advertised developer jobs, and hired three suspected North Korean operatives who submitted forged identity documents—including one edited with Google Gemini and carrying a SynthID watermark. The operatives cleared interviews, signed contracts, and were given work VMs with access to source code, illustrating how the hiring process itself is the attack vector.

The article text was not properly extracted—only cookie consent and privacy policy boilerplate from Ars Technica is present. The title and URL suggest it covers a newly disclosed 'Pass-ta-key' attack against passkeys that the author characterizes as 'mostly a nothingburger,' but no technical details, findings, or recommendations are available in the provided text.

A US House member is pushing the government to enforce Biden-era export controls that would require chipmakers to conduct adequate due diligence on their customers. The article itself is mostly boilerplate with minimal substantive detail beyond the headline.

Tom's Hardware highlights a deal on a Hoto 25-piece electric screwdriver set at $30 (40% off), featuring a 1,500 mAh battery and 25 bits marketed at PC builders and hobbyists. The article body is almost entirely Tom's Hardware membership boilerplate with no substantive review or testing data.

Nvidia is partnering with six investment firms to create $500 billion in AI infrastructure funds, aimed at providing long-term financing at attractive rates for AI buildout. The article text itself contains almost no further detail beyond the headline and a one-line description.

Japanese authorities arrested the initial seeder on Nyaa, a popular anime torrenting site, using a new identification tool that anti-piracy group claims works without monitoring the torrent swarm. The article text provided is almost entirely site boilerplate with no technical detail on how the tool actually works.