AI Weekly Malaysia

Safeworld, founded by Carnegie Mellon Safe AI lab director Dr. Ding Zhao alongside start-up executive Kyle Wong and ML engineer Simo Rachidi, emerged from stealth with a seed round of more than $12 million led by Shine Capital and a16z Speedrun, with Box Group, Carnegie Mellon University Endowment, Innovation Endeavors and SV Angel participating. Its product evaluates robotic control systems in simulations populated with realistic human models, aimed at the problem that generative-AI-driven robot controllers are probabilistic rather than predictable like traditional algorithms. The article notes robots' unstructured environments and differing facility safety standards make this harder than the equivalent problem for autonomous vehicles, and a16z Speedrun partner Jonathan Lai is quoted arguing the industry safety standard should be built now, before household incidents occur.

The Hacker News published the first of three GitGuardian-sponsored articles on credential-layer security, citing GitHub COO Kyle Daigle saying the platform went from roughly 1 billion commits across all of 2025 to 2.9 billion commits in August 2026 alone — an annualized pace of over 14 billion — while GitHub engineering says it has moved from planning for 10x scale to designing for 30x as agentic development accelerates. GitGuardian says it detected 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% year over year, with leaked credentials tied to AI services up 81%. The article frames GitGuardian's Detect / Remediate / Prevent pipeline as the answer, and is explicitly the first of three vendor articles explaining its mission.

The headline claims a former OpenAI safety employee left the company saying its safety culture is broken, citing a failed kill switch and a July HuggingFace hack. However, the supplied page text is almost entirely Tom's Hardware subscription prompts, navigation, and newsletter boilerplate — it contains no named source, no dates, no technical detail, and no description of either incident. As provided, the only concrete facts are the headline assertions themselves.

A solo project ported the PS5-exclusive Wolverine game to PC using AI assistance, and the result is described as buggy. The source code used reportedly came from a 2023 Sony ransomware attack rather than any legitimate release. The article body itself is largely subscription and newsletter boilerplate, so the concrete technical detail is limited to the headline claim.

Nozomi Networks reports a spike, starting around September 5, 2026, in exploitation attempts against CVE-2021-35394 (CVSS 9.8), a critical RCE in the Realtek Jungle SDK, with some attempts delivering a botnet called Cling. The Cling sample bundles exploit logic for at least eight router/DVR flaws (including CVE-2014-8361, CVE-2016-10372, CVE-2016-20016, CVE-2023-26801, CVE-2023-41011, CVE-2024-3721 and CVE-2025-34037), persists via /root/.cling and /usr/local/bin/.cling appended to /etc/inittab, /etc/init.d/rcS and /etc/rc.d/rc.boot, and uses a single-instance lock on port 33957 with SO_REUSEADDR. Its distinguishing trick is repurposing ordinary STUN traffic and public STUN infrastructure as command-and-control, so malicious traffic resembles legitimate NAT-traversal activity.

A Tom's Hardware report claims China has stockpiled 343 immersion DUV lithography tools, of which 270 are ASML scanners allegedly capable of producing 7nm-class processors without sanctioned EUV equipment. The supplied page text is almost entirely paywall, newsletter, and membership boilerplate; it contains no sourcing for the underlying report, no methodology, no dates, and no named analyst or institution behind the figures.

Huawei and Qualcomm signed a new multi-year cross-licensing agreement covering 5G, computing, AI and networking patents, with Qualcomm also buying certain Huawei US patents and licensing the patents behind Huawei's LogicFolding chip technology. The deal is still subject to regulatory approvals, and a Huawei spokesperson quoted by Bloomberg said the overall contract value is expected to exceed USD6.9 billion (about RM28.2 billion). Both companies framed it as FRAND-based, with Qualcomm's John Han calling it recognition of its 5G SEP licensing program and Huawei's Alan Fan pointing to its 4G/5G standard contributions including polar codes.

mold 3.0.0 is the first Rust rewrite of the high-speed linker, replacing the C++ version after 2.42.1. It is intended as a drop-in replacement for 2.42.1 with the same command-line options, target architectures, output, and on-par linking performance, while closing GNU ld compatibility gaps especially around linker scripts. The build system moved from CMake to Cargo, requires Rust 1.95+ and a C compiler, drops oneTBB, statically links mimalloc 3.5.3, and adds bounds-checked handling for corrupted input files; the Hacker News thread has 207 points and 122 comments.

Tom's Hardware reports that Amazon warns $68 billion in data center investment is being blocked, with AWS's CEO objecting to roughly 100 proposed bans and pledging a $1 billion community fund. Beyond the headline and those three figures, the supplied text is subscription boilerplate — no project names, states, timelines, or the CEO's actual quotes are included. So the concrete, verifiable content here is limited to: $68B blocked, ~100 proposed bans, $1B community fund pledge.

Tech Funding News published a headline saying Germany's RobCo reached a $1B valuation, and it hit 324 points with 314 comments on Hacker News. The article text as provided contains only a cookie-consent notice — no round size, investors, valuation date, product details, or revenue figures are present. So the only verifiable facts here are the headline claim and the size of the HN discussion.

The supplied page contains no article content — only Ars Technica's Condé Nast cookie-consent and privacy opt-out interface (targeted advertising toggles, an email address privacy_administration@condenast.com, and a phone number 1-877-241-4999). The promised topic — Hall-effect and TMR 'mechanical' keyboard switches — is not covered anywhere in the extracted text, so there are no specs, dates, prices, or technical claims to report. This is an extraction/consent-wall failure, not a news item.

Tom's Hardware reports that Russian firm ZNTC has reportedly completed development of the country's first 130nm-capable lithography tool, but the piece states realistic volume production is unlikely before 2029 and that the equipment trails modern chipmaking tools by roughly 25 years. The article body available here was almost entirely site navigation and membership boilerplate, so no technical specifics (throughput, cost, customers, or export-control details) are present. Treat this as a headline-level claim rather than a verified capability.

Cloudflare launched a beta Web Search API that lets AI agents and apps run web searches to ground responses in live information rather than relying on model training cutoffs. At launch it routes to three providers — Ceramic.ai, Exa, and Linkup — all supporting Zero Data Retention for requests made through Cloudflare and committed to Cloudflare's verified bot crawling standards. Requests run through AI Gateway, appear in gateway logs, and are billed at each provider's list API price with no markup, with an option to bring your own provider API key; it is callable via REST or the Workers AI binding (env.AI.websearch).

Apple says it will tighten macOS Full Disk Access (FDA) controls because AI agents are being granted the setting in ways that expose files, mail, messages, and browsing history without users fully understanding the risk, and it wants FDA granted only via an explicit user action. Apple gave no rollout date. The post follows reporting that Meta's "Muse" personal AI agent read a journalist's private iMessages after FDA was granted; Meta clarified Muse needs two permissions — FDA plus Messages access — and Muse is described as running on a dedicated Linux VM on Meta's cloud.

The US Senate killed a bill that, per the headline, could have shielded Americans from rising power bills attributed to AI data centers; opponents called it 'toothless' and said it did not do enough to protect citizens. The article text available here is almost entirely Tom's Hardware subscription and navigation boilerplate, so there are no vote counts, sponsor names, bill numbers, dates, or figures to report. Only the headline claim and the opponents' 'toothless' criticism can be stated with confidence.

This item is a Stratechery article by Ben Thompson titled "Apple and a Hacker's Future," published October 5, 2026, but the text supplied here contains only site navigation, subscribe/login links, and podcast chrome — the article body itself is not included. The only concrete facts available are the title, author, publication date, and that the Hacker News thread drew 166 points and 160 comments. No argument, claim, number, or recommendation from the piece can be summarized from this text.

A customer sent a two-stick DDR5 memory kit that cost $16,000 to a repair shop, and a technician revived a dead module using hot-air reflow plus a replacement PMIC. The piece frames the repair as economically rational because replacement costs for high-end DDR5 kits have climbed enough that board-level rework is now worth the bench time. Beyond the headline and the repair technique, the article text available is almost entirely Tom's Hardware paywall and navigation boilerplate, so no further specifics — kit capacity, speed, brand, repair price, or turnaround — are given.

OpenAI announced a new visual ad format inside ChatGPT that will initially be tested during image generation, starting later this month in the US with an initial group of advertisers; ads will be clearly labeled and kept separate from the generated image. ChatGPT is cited as reaching 1.2 billion weekly users. OpenAI also expanded ChatGPT Ads measurement through integrations with Hightouch, Tealium, and LiveRamp, plus attribution partners including AppsFlyer, Triple Whale, Adjust, Branch, and others.

Tom's Hardware marked the fifth anniversary of Windows 11's release (the article is dated 2026-10-05, five years after the October 2021 launch), framing it around Microsoft's claim that the latest update is "predictable and low-disruption." The excerpt supplied contains only site navigation, subscription prompts, and newsletter sign-up boilerplate — no version numbers, no rollout dates, no feature list, no benchmark or incident data. There is nothing concrete here beyond the headline framing.

According to the headline, Anthropic reported a Florida woman to authorities over a threat written in a Claude 'diary' conversation to shoot up a sheriff's office, and she now faces a felony charge. Tom's Hardware says this is at least the third such Claude conversation to reach police since August. The article body in this feed is only site navigation and subscription boilerplate, so no further detail — dates, charging specifics, or Anthropic's stated policy — is available here.

RHB will block RHB Online Banking access from outdated web browsers starting 31 October 2026, requiring at minimum Chrome 149, Edge 149, Firefox 151, Opera 130, or Safari 18. RHB says the cutoff is because old browsers no longer receive official security patches, and it will completely block access below those versions. Users whose computers run an operating system too old to install those browser versions are told to switch to the RHB Mobile Banking App on Google Play or the Apple App Store.

Tom's Hardware reports that an uncrewed Russian robot tank failed during its debut in a military display attended by President Putin. According to the report, the vehicle repeatedly lost its control links and eventually became stuck in the mud, even after operators switched to a human driver. The excerpt provided contains no specifications, dates, unit names, or technical postmortem detail beyond the headline description.

Denmark's national person register (CPR) disclosed a serious security incident in which unauthorized parties abused a Danish company's legitimate query access to pull names, addresses and CPR numbers for roughly 8.8 million registered citizens. Names and addresses of people with name-and-address protection were not included in the unauthorized access. CPR has cut off the company's access, reported the case to the Danish Data Protection Agency (Datatilsynet), and police are investigating alongside relevant authorities.

CVE-2026-61500 (CVSS 9.3) affects Rejetto HFS 3.0.0 through 3.2.0: the server derived its session-cookie signing key from JavaScript's non-cryptographic Math.random() and leaked outputs of the same V8 PRNG to unauthenticated clients during the SRP login handshake, letting an attacker reconstruct the generator state, recover the signing key, forge an admin cookie, and reach remote code execution through the server_code configuration feature. A patch shipped in July 2026 as version 3.2.1, but a public Python PoC by Alejandro Ramos (aramosf) landed in late September, and VulnCheck's Patrick Garrity says exploitation attempts were detected on October 1, 2026 — one day after Horizon3.ai published more detail. Horizon3.ai researcher Zach Hanley stated that Anthropic's Mythos model was used to discover the flaw.

MDEC senior vice president Fadzli Abdul Wahit used a keynote at UKM’s 2nd International Conference on Global Business & Digital Economy 2026 to call for Malaysia to move from digital participation to leadership, commercialising innovation and building homegrown companies that can compete globally. He cited the Thirteenth Malaysia Plan’s aspiration to be an inclusive AI Nation by 2030 and a regional digital hub, plus MD2030’s target for the digital economy to contribute 30% of GDP by 2030. The speech also pushed stronger university-industry collaboration to translate research into commercial solutions, but announced no new grants, programmes, deadlines, or eligibility criteria.