AI Weekly Malaysia

TSMC reported July revenue of NT$467.58 billion ($14.5 billion), up 44.7% year-on-year, driven by sustained AI chip demand from customers like Nvidia and Google. The figure puts TSMC ahead of its full-year guidance of 40% revenue growth, and European semiconductor stocks (ASML, Infineon, STMicro) rose on the news.

Levi Strauss disclosed a data breach after social engineering attackers gained access to three employee workstations and exfiltrated corporate data. Google researchers are tracking a broader campaign (dubbed UNC6671) that has targeted 200+ organizations over five weeks, phoning employees on personal mobiles while posing as IT support and directing them to spoofed login pages that harvest credentials and MFA codes.

Kuber Mehta argues against using prompt instructions like 'I have ADHD' or 'use ASD-STE100 Simplified English' to 'humanise' or constrain LLM outputs. The core issue is that these instructions become part of the model's reasoning process rather than a post-processing filter, which degrades the actual work.

Mistral AI was granted US patent 12,670,045 for a method where an LLM generates a code block encapsulating tool calls, executes it in a sandbox, pauses to send pending tool calls to a client for execution, receives results, and resumes execution. The patent was filed March 4, 2026 and lists Gabriel Vergnaud as inventor, assigned to Mistral AI (Paris). It covers 20 claims around this pause-resume code-execution tool-call pattern.

UK pub chain Wetherspoons has told customers to switch off cameras on Meta-style smart glasses rather than banning the devices outright, citing existing codes against filming patrons without permission. DEF CON, Monopoly Events, Soho House, Brighton's Yellow Book Bar, and several theatre companies have issued outright bans on recording glasses, while CalMac suspended bridge visits after a passenger made crew uncomfortable.

South Korean security firm Genians reports that North Korean hacking unit Kimsuky has set up an offline AI stack on its own infrastructure using Ollama, GPT4All, and Msty, with GPT4All's LocalDocs RAG database (localdocs_v3.db) configured to query a private document collection. The group has not trained a custom model but is assembling existing tools to automate malware development and improve phishing lures, which will increasingly lack the traditional tells of stilted translation and formatting errors.

Tom's Hardware reviews the Acer Swift Go 16 AI, an AMD Gorgon Point laptop with a 16-inch screen, calling it balanced and affordable but not a performance or battery leader. The reviewer notes the price swings widely and it's best value at its $799 sale price.

Nathan Lambert's post-training textbook 'Reinforcement Learning from Human Feedback: Aligning and Post-training LLMs' is now published by Manning and freely available online, accompanied by a 12-hour video course, slides, a codebase with exercises, and model comparison examples. It covers topics like rejection sampling, outcome reward models, and character training at a foundational level, targeting readers with a CS background rather than beginners. The print edition is 50% off until August 19 with code PBLambert.

Cloudflare for Government has achieved FedRAMP Class D (High) certification, sponsored by NIST, marking a step up from its 2022 Moderate authorization. Cloudflare also announced it is pursuing DoD Impact Level 4 (IL4) authorization for handling controlled unclassified data, using the same systems developed for FedRAMP High.

Meta CEO Mark Zuckerberg announced the company will open the weights for Muse Spark 1.2, its latest AI model, making it downloadable and usable by the public. He also said Meta will release a new family of open-source models called Muse Glimmer, specifically designed to run on laptops, as Meta positions itself against OpenAI and Anthropic.

Import AI 468 covers IFP's 23 specific policy ideas across 7 categories for managing risks of automated AI R&D (recursive self-improvement), aiming to give governments tools like transparency mandates, AI verification tech investment, and international cooperation options. The newsletter also mentions PostTrainBench+ and a fictional story about AI takeoff, but the policy framework is the substantive content.

CNBC's Morning Squawk newsletter covers five market-moving items including Iran denying direct negotiations with the U.S. over the Strait of Hormuz, Berkshire Hathaway's stock purchases, and Shein's tariff troubles. The article is a general pre-market briefing with no AI, developer, startup, or Malaysian tech content.

A security researcher found that tl;dv, an AI meeting recording platform with over 2 million users, has no tenant isolation in its Firestore meetings collection—any authenticated user can query all 181,874 meetings across every account, exposing joinable conference IDs for live Google Meet and Teams calls. The researcher demonstrated the flaw by walking into a live Google Meet belonging to the Malaysian Ministry of Education with 157 participants, and a US university startup call. The vulnerability was reported January 28, 2026; six months later the Firestore database remains open and the CTO never responded.

Over 500 local US jurisdictions have now enacted bans or restrictions on new AI data center developments, driven by bipartisan political pressure and public outrage over resource consumption and community impact. This threatens big tech's expansion plans for AI infrastructure capacity in the US.

Three separate research efforts last week demonstrated attacks that defeat passkey protections without breaking the underlying cryptography. SpecterOps showed a Windows + Microsoft Entra ID chain that impersonates privileged users while satisfying phishing-resistant MFA (CVE-2026-34348, CVSS 6.5, patched); Unit 42 demonstrated recovering private keys for cloud-synced passkeys via Google Password Manager in Chrome; and independent researcher Dirk-jan Mollema showed malware in an active Windows session can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric prompt.

A routine cyber vulnerability assessment found cameras aboard Royal Navy Kraken Unmanned Surface Vessels transmitting heartbeat signals to an IP address in China. The UK MoD confirmed no classified data was compromised, and the cameras were sourced by Kraken from a third-party supplier. The incident underscores that even benign telemetry transmissions from unvetted supply chain components can surface as serious security incidents.

Squeak/Smalltalk 6.1 ('Vanessa') ships after 4 years, merging 1700+ patches with 9000+ method changes. Highlights include a new tree browser, the return of Objectland ('Worlds of Squeak'), kernel changes for process simulation and class reshaping, and a major overhaul of Morphic tree morphs with improved navigation, filtering, and drag-and-drop.

Grace Clarke, a self-taught AI educator and former marketing consultant, rebuilt her entire service business on Claude Code, automating 20 hours of weekly admin into a pipeline that handles proposals, client tracking, and email. She teaches a practical workflow including 'voice guide' skill files for consistent AI output, 'intent engineering' over prompt engineering, and a custom Gmail replacement built in under 30 minutes via Cowork.

OpenAI published a customer story where startup Model ML uses GPT-5.6 Sol to generate editable PowerPoint and Excel files for finance workflows, reporting 21% fewer tokens per deck than Fable 5, 36% fewer tokens per Excel workbook than Opus 5, and a tearsheet build time drop from ~1 hour to 5 minutes.

A GeForce NOW exploit reportedly allows users to access the full Windows desktop through a simple file swap, bypassing NVIDIA's sandbox restrictions. A modder used this to run local AI models on the Ultimate tier, which provides 48GB of VRAM. The article body itself contains only website boilerplate with no additional technical detail.

Analyst Claus Aasholm estimates that Amazon, Alphabet, Meta, and Microsoft collectively hold nearly $2 trillion in purchase commitments for AI hardware and memory as of Q2 2026, with Alphabet leading at $811 billion and Apple trailing at $57 billion. A significant portion targets memory components, reflecting a shift from Apple's historical dominance in long-term component contracts to hyperscalers driving the market.

Google Play now supports Venmo as a payment method for U.S. users, allowing purchases of apps, games, subscriptions, and creator tips via Venmo wallet or linked bank accounts and cards. Google Play already supports PayPal, Cash App, and major card networks in the U.S., and has experimented with cash-at-store payments in other markets.

Discovered Materials, founded by Advaith Sridhar and Akash Ramdas, raised a $9M seed from Lightspeed India Partners, Peak XV, and angels including Paul Graham after exiting Y Combinator. The startup uses a pipeline of Anthropic models in a custom harness to generate candidate semiconductor materials, then validates them with trained foundational physics models, claiming thousands of guesses per day versus Ramdas's 20/day during his Stanford PhD.

A European distributor for Steam hardware was hit by a cyberattack, resulting in theft of customer personal information and hardware purchase details. Valve has warned affected customers to expect fake messages as a consequence.

Sunrise Energy Metals shares surged as much as 29% after securing a $400 million conditional loan from the U.S. Department of War's Office of Strategic Capital to develop the world's first primary scandium mine at its Syerston Project in New South Wales. The investment is part of a broader U.S. push to break China's dominance in critical minerals—China controls nearly 70% of rare-earth mining and 90% of processing.