AI Weekly Malaysia

On Meta's Q3 2026 earnings call, Mark Zuckerberg said the Muse AI app has passed 10 million users, roughly 25% of people who set it up use it daily, and more than a quarter of engaged users who shop through the agent had an average purchase size above $200. Muse uses Plaid's connector for agentic shopping, and Zuckerberg said Plaid reported activity levels it hadn't seen on any other service. Meta says Muse Secure VM protects user data, a Muse Confidential VM that hides content even from Meta is forthcoming, and Meta forecasts Muse will eventually earn more revenue per user than Facebook, Instagram, WhatsApp and Messenger combined, which currently sits at several hundred dollars annually.

OpenAI says it has spent recent months aligning safety policies across customers and partners that provide access to its models, and is updating its Usage Policies effective November 20, 2026 to make requirements clearer for developers. Partners hosting or reselling OpenAI models — including via reseller partners — must keep safeguards consistent with OpenAI's, investigate potential violations, and coordinate on enforcement so restrictions carry across services. The post names GPT-6 Astra as an example of expanding model capability and cites Private Safety Processing as a case of adding safeguards while giving customers control over sensitive data, but does not spell out which specific policy rules changed.

Flapping Airplanes, a year-old AI lab, announced a $1B Series A co-led by Index and Lux at a reported $6B valuation — nine months after a $180M seed from GV, Sequoia and Index that valued it at $1.5B, a 4x jump. The founders (Aidan Smith and brothers Asher and Ben Spector) describe their work as a 'megakernel framework' that can run entire training runs, serve inference, and play video games in a single GPU kernel, and claim it can overlap memory-bound inference with compute-bound training. The excerpt contains no benchmarks, no code release, and no independent verification of those claims.

Tesla said it began producing Optimus humanoid robots at its Fremont, California factory in Q3 2026, calling them the first production-quality bots it has manufactured. The same quarter brought a 43% profit drop: revenue was $28.04 billion versus $28.09 billion a year earlier, EV deliveries were 486,532, energy storage fell 16% to $2.8 billion on tariff-related refunds, and services grew 33% to $4.6 billion as spending rose on Optimus, AI, and autonomous driving.

Recursive released Flint, a free Apache 2.0 coding model on Hugging Face that runs on a laptop and uses a mixture-of-experts design with 40B total parameters but only 2.5B active per task. The company says its Eureka Machine automated research system helped build Flint from scratch in under four months, and that the model can run offline to keep code private and avoid per-token cloud fees. Recursive emerged from stealth in May with $650M at a $4.65B valuation, led by CEO Richard Socher.

Claire Vo tested Claude Duet — Anthropic's phone-based personal agent that inherits your Claude plugins and connectors and is pitched at small business owners and busy professionals — on inbox and Slack triage, a sales pipeline, a Google Docs sales deck, a launch video, and finding Warriors tickets. She calls it the most polished agent launch she's seen (onboarding, task lists, first-class artifacts, Slack-style channels) but says it stalls on real work. Her specific complaints: a "proactive" agent that never nudges you, model latency that kills synchronous use, no desktop app, and single-player only with no multiplayer support — which keeps it out of her working stack.

Automattic has begun layoffs over at least the past week, hitting communications, social, WordPress.com, and the VIP enterprise business, with insiders expecting more cuts. The cuts follow a failed September board attempt to oust CEO Matt Mullenweg that led to complete board turnover and departures of the CFO, interim CFO, and Chief Legal Officer; interim CFO Jeremy Klaperman left earlier this month and comms director Megan Fox said her role was eliminated. TechCrunch also reports Mullenweg shared a departed exec’s spouse health information and COBRA details in internal Slack, shocking employees.

A New Mexico court ordered Meta to pay $25 billion in penalties in a data privacy case tied to the Cambridge Analytica scandal. A Santa Fe jury had found Meta liable for misleading state citizens about how it safeguards and collects user data, concluding there were over 43 million violations of the state's unfair practices act, each carrying a civil penalty of up to $5,000. The judge said Facebook 'did not conduct the comprehensive investigation that it promised' after the Cambridge Analytica revelations.

GM announced its fourth-generation EV platform at its GM Forward event in New York on Oct. 21, 2026, centered on a new central computing platform and electrical architecture that will connect acceleration, steering, braking, active safety, and software. GM says the overhaul debuts in 2028 with Cadillac. The article quotes Sterling Anderson, GM's executive vice president, global product, and chief product officer, describing vehicles as context-aware spaces, but gives no compute specs, APIs, pricing, or supplier details.

The extracted page contains only Ars Technica's cookie-consent and privacy-center boilerplate, not the article body. The only substantive information available is the headline: a piece arguing that Apple Music's new "human-crafted" branding matters in an AI era. No dates, figures, quotes, campaign details, or technical claims are present in the text supplied.

A New Mexico judge ordered Meta to pay $25 billion to the state after a two-week trial in which a jury found 43 million violations of New Mexico's consumer protection laws, each carrying a $5,000 penalty, according to the New York Times. The case touched on Meta's handling of a third-party app tied to the Cambridge Analytica breach, its data privacy policies, and its misinformation mitigation efforts. Meta Chief Legal Officer C.J. Mahoney said the company will appeal, calling the ruling an attempt to 'impose a tax on speech.'

Tom's Hardware reports that Intel has begun installing production tools at its Fab 62 site in Arizona, gave an update on its delayed Ohio fab, and confirmed High-NA EUV lithography will reach high-volume manufacturing in 2028. The item is headline-level only: the page text available is navigation and subscription boilerplate, with no tool counts, wafer-start figures, Ohio timeline dates, or spending numbers.

Walmart announced Agent Gateway, an MCP server that lets approved AI agents search Walmart and Sam's Club inventory and make purchases on a user's behalf, unveiled by Walmart President and CEO John Furner at the Masters of Scale Summit on Oct. 21, 2026. Walmart says the gateway can shop a customer's usual brands without sharing personal information or purchase history directly with the agent, and includes technology to distinguish agent-initiated purchases from direct customer orders. The move contrasts with Amazon, which recently began blocking AI agents from making purchases for shoppers, and follows Walmart's earlier integrations with Meta's Muse, ChatGPT, and Gemini.

Anthropic's Claude Duet is a research-preview 'proactive agent' powered by Opus 5.5, pitched as a morning-brief assistant that keeps working while you're away, sets up meetings, builds dashboards, and pauses for approval on actions like paying a $640 permit fee. It ships with access to 6,000+ connectors and plugins, reuses your existing Claude memory, skills, and apps, and is limited to Pro and Max plans in the US with a waitlist. The page is product marketing: the walkthrough (hiring finalists, a $410K renewal redlined to Net 60, a Series A deck for Harbor Ventures) is illustrative demo content, not customer evidence.

The only usable information is the headline: EA has shut down BioWare, the studio behind RPGs, after more than three decades. The body of the article as supplied contains nothing but a cookie-consent notice, with no dates beyond the 2026-10-21 publish timestamp, no headcount, no statement from EA or BioWare, and no detail on what happens to projects or staff. There is nothing here to verify or quantify the closure.

Google published its internal Rust Style Guide as part of the Google Style Guides, and it goes well past formatting: code organization (prefer small crates, flat file layout for rust_library sources, no glob imports), ownership (avoid Rc and Arc, prefer borrows over deep copies), API design (accept Into, prefer enum over bool, #[non_exhaustive] on public enums and public-field structs), error handling, traits, macros and naming. Some rules are explicitly scoped to Google codebases — no async/.await and no std-library threads in [chrome], fuchsia_sync::Mutex for [Fuchsia] — and the implementation section pushes expect over unwrap and warns against panic::catch_unwind and long iterator-combinator chains. It drew 382 points and 249 comments on Hacker News.

TechCrunch rounds up several security incidents on October 21, 2026: government websites went offline after AI discovered critical PHP vulnerabilities, prompting NSA advice to update PHP systems or take them offline; Node.js patched four high-severity flaws, including remote code execution and TLS validation bypasses; and LiteLLM had malicious releases/images published to PyPI, Docker Hub, and GHCR that stole cloud, password, and AI service credentials and included a remote access trojan. Separately, Indian certificate authority eMudhra had private keys compromised, potentially enabling fraudulent certificates and website impersonation, with one security pro calling the cleanup 'bigger than Heartbleed.'

GitLab shipped an out-of-band critical patch on October 21, 2026 covering 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 for both CE and EE, and says all self-managed installs should upgrade immediately. The Critical-rated bug is an integer overflow in the regular expression compiler; two Highs cover OmniAuth-to-LDAP auto-linking email lookup (improper authentication) and cache poisoning in OAuth/OIDC discovery endpoints. GitLab.com and GitLab Dedicated tenants on 19.3.5-internal0 / 19.4.2-internal0 or later are already fixed, and the underlying vulnerability issues stay private for 90 days after the patch release.

The Hacker News headline flags a GitLab vulnerability rated CVSS 10.0 that could allow unauthenticated remote code execution, said to affect releases spanning 12 years. The supplied article text is almost entirely site navigation and boilerplate, so the CVE identifier, exact affected version ranges, fixed versions, and whether it is being exploited in the wild are all absent from what we have. Treat the severity claim as unverified detail-wise until the advisory is read directly.

Legora, a legal AI startup that automates workflow tasks for legal professionals, raised a $550M Series E at an $8.8B valuation, led by Atreides Management with Baron Capital, Bessemer, General Catalyst, and Menlo participating. The round comes a month after competitor Harvey raised $550M at a $15.5B valuation, and follows Legora's April $50M extension of a $550M Series D at $5.6B. Legora says ARR is now over $200M, up from $100M disclosed in April, and it plans to expand across North America.

The supplied text contains no article body — only Ars Technica's Condé Nast consent and cookie preferences boilerplate. The headline claims OpenAI's latest models are coming to Google Cloud and 'Antigravity', but no version numbers, pricing, availability dates, regions, or technical terms are present in the text to confirm or detail that. There is nothing substantive to summarise.

PHP released patches across the entire 8.x line on October 21, 2026, fixing two remote code execution holes that had exploits circulating since the previous night. The early leak happened because CVE IDs spread on forums around 15:00 UTC on October 20 with a wrong release time and an inflated CVSS of 10.0 (actual 9.2), so PHP moved its pre-announcement to 19:30 UTC and pulled the release forward from October 22 to October 21 at 14:00 UTC. Wiz Research's timeline says it found the first flaw on August 19, 2026, confirmed unauthenticated RCE against Drupal on August 20 and WordPress on August 21, reported to PHP on August 24, and PHP began the coordinated fix on September 21; a security firm's mistakenly published PoC video around 20:00 UTC on October 20 accelerated public exploit development.

The supplied page contains only Ars Technica's cookie-consent boilerplate — no article body, no named sources, no dates, no figures. The headline alleges that Musk, not Trump, ordered Starlink throttling that affected Ukraine, but nothing in the extracted text substantiates the claim, the mechanism, the timing, or the response. There is no verifiable detail here to summarise beyond the headline itself.

NVIDIA's Hugging Face post introduces Kumo Relational, a pre-trained relational foundation model that makes predictions directly on enterprise databases using up to 10,000 historical examples as context in a single forward pass, with no task-specific training, feature engineering, or table flattening. NVIDIA claims it is the first few-shot foundation model to outperform supervised ML on common relational benchmarks: across 41 tasks on 15 databases it beats supervised relational deep learning and expert-engineered gradient-boosted tree pipelines, and on SAP SALT it surpasses AutoGluon ensembles by 8% MRR. It is available through NVIDIA's open-source GPU-native structured-data-models library or as an NVIDIA NIM, and the post says it scales to databases with 500B+ rows.

The item is an Ars Technica story headlined "Judge rejects Trump's wild claim EPA can dismiss data center pollution lawsuits," published 2026-10-21. The supplied text contains only the site's cookie-consent boilerplate — no ruling, court, judge name, statute, or data center specifics are present. There is nothing verifiable in the excerpt to summarize beyond the headline itself.