AI Weekly Malaysia

GitHub's CTO Vladimir Fedorov acknowledged a 7-hour-47-minute outage on August 17 that disrupted Actions, pull requests, issues, Copilot, and APIs worldwide—the second major outage that month after an August 6 Actions failure. GitHub now handles 2.9 billion monthly commits, 24 million new repositories, and 130 million merged PRs, but its infrastructure hasn't scaled to keep up, with Microsoft Azure carrying ~58% of platform load. Fedorov pledged a linear read-scaling architecture rollout starting with the largest monorepos, plus retry-limit tightening and system isolation, but admitted neither outage was caused by a code or config change—meaning the failure modes were already latent.

Why: If your CI/CD pipeline runs on GitHub Actions, these outages directly blocked shipping for nearly 8 hours, and the CTO's admission that failure modes were latent (not introduced by deployment) means more outages are likely before the architecture overhaul lands. Evaluate whether your team needs a fallback CI provider or cached dependency mirrors now, rather than waiting for the next incident. The detail that Azure handles only 58% of load means the migration is incomplete and reliability will remain uneven in the interim.

A $10,000 phishing kit called iAuthFlow v2, sold on Russian-language cybercrime forums, uses a browser-in-the-middle attack to enroll attacker-controlled passkeys on compromised accounts within seconds of authentication. Abnormal Security analyzed the kit's demos showing it targeting Google, with packages also advertised for iCloud, LinkedIn, and Microsoft. The rogue passkey persists even after the victim changes their password, defeating standard remediation steps like session revocation and credential rotation.

Why: If you ship passkey-based auth, this kit exposes a gap in enrollment flows: after a successful BitM phishing attack, the attacker can register their own passkey before the victim notices. You should require step-up re-authentication or a verified device challenge before allowing new passkey enrollment, and push real-time alerts to users when a new passkey is added. Standard password rotation and session revocation are no longer sufficient remediation if a rogue passkey is already enrolled.

GitLab CVE-2026-19478 (CVSS 9.4), a code injection flaw exploitable via a GraphQL directive by unauthenticated attackers, is under active exploitation within days of disclosure. It affects self-hosted GitLab CE/EE versions 18.2 (before 18.11.11), 19.0 (before 19.0.8), 19.1 (before 19.1.6), and 19.2 (before 19.2.4). watchTowr reports attackers can delete repositories, forge merge records, and ban maintainers; they recommend hunting web logs for '@gl_introduced' and patching immediately or restricting unauthenticated access to /api/graphql.

Why: If your team runs an internet-facing self-hosted GitLab instance on any affected version, patch to 19.2.4, 19.1.6, 19.0.8, or 18.11.11 now or restrict unauthenticated /api/graphql access — active exploitation is already happening. The compressed disclosure-to-exploit window (minutes, per watchTowr) means waiting for a normal patch cycle is no longer viable for internet-exposed dev infrastructure.

Attackers compromised a legitimate Rust crate maintainer's credentials and published poisoned versions of arrayref (0.3.10), internment (0.8.7), and append-only-vec (0.1.9) on crates.io, each live for 86-107 minutes before removal. The malicious code hid in a typosquat crate called proc-macro1 (mimicking proc-macro2), using its build.rs script to download OS-specific infostealer payloads during compilation that targeted Chromium-based browser data including Chrome, Brave, and Edge profiles.

Why: If you build Rust projects with Cargo, pin your dependencies to specific versions or use a lockfile and a private registry mirror rather than pulling latest from crates.io in CI. The attack exploited Cargo's automatic execution of build.rs scripts during compilation, meaning any crate in your dependency tree can run arbitrary code on your build machine, not just at runtime. Review whether your CI environment isolates build steps from developer credentials and browser sessions.

Poolside AI struck a non-exclusive licensing deal with Nvidia worth $6 billion plus a $1 billion investment at a $12 billion pre-money valuation, with 109 of Poolside's ~115 technical employees moving to Nvidia while founders remain. Poolside lost a 40,000 GB300 cluster deal after failing to raise $2 billion in a 6-week window late last year, and concluded that next year's frontier model compute requirements need clusters an order of magnitude larger—constrained not just by capital but by physical data center space.

Why: This signals that the capital and infrastructure bar for frontier AI model training has moved beyond what well-funded startups can realistically clear—Poolside couldn't close $2B in time and lost a critical cluster. Builders should factor in that independent frontier model development is increasingly locked behind hyperscaler-scale compute, making licensing deals and API dependencies more likely for anyone not at Nvidia/Meta/Google scale.

An AWS-commissioned study by Strand Partners reports 38% of Malaysian businesses now use at least one AI tool, up from 27% in 2025, totaling 3.4 million businesses. However, 67% remain at basic usage (public chatbots, ready-made tools), only 19% have a formal scaling strategy, and 57% primarily source AI capabilities externally—with 69% saying locally based software providers are important to their adoption.

Why: For Malaysian SaaS founders and developers, the data points to a concrete market gap: manufacturing businesses expect AI to transform their industry (80%) but only 13% feel prepared, and 57% are still experimenting. 43% of businesses working with external providers use them for AI strategy development and 40% for systems integration—meaning sector-specific AI tools and integration services in manufacturing and financial services are where paying demand is concentrated, not generic chatbot wrappers.

Enterprise SSDs now cost 18.6 times more per terabyte than HDDs, with 30TB SSD drives priced at $22,600. HDD supply is reportedly sold out through 2027, creating a storage cost and availability squeeze for infrastructure planners.

Why: If you're budgeting storage for databases, AI training data, or SaaS infrastructure for the next 18+ months, factor in that HDD capacity may be unavailable or delayed and SSD pricing is nearly 19x per TB — meaning tiered storage strategies and capacity planning decisions need to be made now, not later. Malaysian builders relying on cloud providers may see pass-through cost increases or capacity constraints.

TNG eWallet has received recognition from Jabatan Tenaga Kerja Sarawak (JTK Sarawak) as an alternative salary payment method, completing nationwide coverage across all Malaysian labour authorities. Over half a million users are already receiving wages through TNG eWallet, with more than RM5.7 billion disbursed in 2026 so far. Employers can transfer wages directly from any Malaysian bank into a worker's TNG eWallet via a DuitNow account number assigned to each verified user.

Why: If you run a business employing unbanked or blue-collar migrant workers in Malaysia, you now have a single government-recognised digital channel for salary disbursement across all states. This removes the need to maintain separate payroll arrangements for Peninsular, Sabah, and Sarawak labour authorities, and workers can access funds, remit, or withdraw cash via a TNG Visa prepaid card without a conventional bank account.

CelcomDigi has commercialised Sophia AI, an agentic AI digital workforce for Malaysian SMEs, after deploying 400+ automations across its own operations. The product targets workflow orchestration in retail (invoice-to-payment), manufacturing (procurement, warehousing, finance), healthcare (appointments, claims, billing), and public sector, positioning itself as a no-large-tech-team-needed entry point for SMEs.

Why: If you build or sell automation tooling to Malaysian SMEs, a major telco is now a direct competitor bundling agentic AI with connectivity — evaluate whether your product overlaps with Sophia AI's invoice-to-payment, procurement, or claims workflows before pitching. SaaS founders selling into Malaysian SMEs should expect prospects to ask how they compare to a telco-backed offering.

Hugging Face researchers tested 11 popular open-source ASR models and found several high-scoring systems reproduce benchmark reference transcripts even when the audio contradicts them, words are silenced, or the audio supports multiple readings. They introduce three probes—including a consensus disagreement test using VoxPopuli's known transcription errors—to quantify 'benchmaxxing,' where models exploit benchmark-specific patterns rather than genuinely improving transcription. Some models appeared to detect subtle acoustic cues indicating which benchmark they were on.

Why: If you're selecting an ASR model based on Open-ASR Leaderboard or LibriSpeech/VoxPopuli scores, those scores may overstate real-world performance—especially for noisy or far-field Malaysian English or multilingual use. Before committing to a model, test it against your own held-out audio rather than trusting public benchmark rankings, and consider the Far-field ASR Leaderboard and Real World VoiceEQ held-out sets as more realistic signals.

Kelas Sekejap, an AI-native learning app co-founded by Khairy Jamaluddin, Shahril Hamdan, and Isaac Tan, has grown to 15,000 registered users and 6,000 active AI-tutor conversations since its January 2026 launch. It is expanding into formal education with Kelas SPM (active in schools across KL, Negeri Sembilan, and Melaka) and into corporates with an enterprise tier that converts internal company knowledge into AI coaching for employees. Its seed round was led by Tan Sri Nazir Razak, with pre-seed backers including Khailee Ng, Joel Neoh, Bryan Loo, and First Move.

Why: For Malaysian SaaS founders, the 'Branded Learning' monetization model—where partner brands like Tealive sponsor lessons and users earn real-world rewards—is a concrete alternative to ads or subscriptions worth studying. The enterprise feature (turning internal knowledge into scalable AI coaching) is a use case any founder building AI agents for the Malaysian corporate market should benchmark against. The school deployments also signal that Malaysian public schools are now accessible entry points for AI-powered edtech pilots.

AI data-labeling startup Micro1 grew its gross annual run rate from $100M to $500M in eight months, retaining 60-70% for a net run rate of $150M-$200M. The company hires domain experts on contract and is increasingly generating synthetic data (e.g., automated video descriptions) that can be resold to multiple customers at 80-90% gross margins. Founder Ali Ansari publicly stated Micro1 does not sell data to Chinese model makers, contrasting with competitors whose off-the-shelf data sales to Chinese developers have drawn criticism, citing Kimi K3 as evidence of the risk.

Why: The AI training data market is large enough to support multiple $500M+ players, and the shift toward synthetic and resellable 'off-the-shelf' datasets with 80-90% margins signals where the business model is heading. If you build AI products or agents, expect data sourcing costs and licensing terms to matter more, and watch whether multi-customer dataset resale creates contamination or exclusivity issues in your training pipelines.

Mercury Research reports AMD gained CPU market share across all categories in Q2 2026, with desktop CPU shipments falling over 20% YoY due to high PC prices driven by memory shortages and scarce consumer GPUs. Server processor shipments rose 20% YoY, with AMD reaching 34.5% server share, ~35% desktop share, and ~29% mobile share. The memory shortage stems from chipmakers prioritizing high-bandwidth memory for AI servers over conventional DRAM.

Why: AI server demand is now distorting the broader hardware market: HBM prioritization is starving consumer DRAM and GPU supply, pushing up PC prices and crushing desktop demand. If you're budgeting for developer workstations or on-prem hardware, expect continued price pressure on memory and consumer GPUs, and factor this into cloud vs. on-prem cost decisions over the next 1-2 quarters.

ByteDance and Tencent each received roughly 10,000 Nvidia H200 GPUs on mainland China under case-by-case NDRC-approved import licenses, the first meaningful deliveries since Trump cleared exports in December. However, most of their licensed allowance (up to 100,000 units each) must stay outside the mainland, largely in Hong Kong, and the delivered chips represent only ~2.5% of the 400,000+ units collectively approved for ByteDance, Alibaba, and Tencent in January.

Why: If you procure GPU capacity in Southeast Asia, expect continued supply tightness and pricing volatility as Chinese hyperscalers park most of their H200 allocations in Hong Kong rather than the mainland — this keeps regional cloud GPU demand elevated. Founders evaluating AI infrastructure costs should model GPU pricing as geopolitically constrained, not commodity-priced, for at least the next 12-18 months.

DataDome researchers report that scalper bots now outnumber human shoppers 10-to-1 on at least one retailer's DDR5 listing pages, hitting listings every 6.5 seconds. 32GB DDR5 kits have surged from $72 to $392, a roughly 5x price increase driven by automated scraping and hoarding.

Why: If you're budgeting for local AI/ML workstations or homelab builds in Malaysia, DDR5 pricing is currently distorted well beyond MSRP by bot activity—factor this into hardware procurement timelines or consider DDR4 alternatives where the platform allows it. For anyone building e-commerce or inventory-tracking systems, this is a concrete data point on how aggressive automated scraping has become and why bot mitigation (DataDome-style) is now table stakes for retail platforms.

Alibaba Cloud reported that its AI servers pay back their cost in 3 years and generate free cash flow in years 4-5, with 2018/2020-era Nvidia V100 and A100 machines still running near full capacity. The company plans to shorten payback to 2.5 years by increasing the proportion of self-developed chips in its data centers, replacing commercially purchased chips. Over 650 external customers now use Alibaba's own chips, and Q1 capex hit $10B, up 75% year-over-year, partly driven by anticipated AI agent adoption.

Why: Alibaba Cloud operates data centers in Malaysia and is a viable alternative to AWS/Azure for regional workloads. If their self-developed chips replace Nvidia-dependent infrastructure, Malaysian builders evaluating Alibaba Cloud should check which chip families underpin the specific AI services they consume, as performance and pricing may diverge from Nvidia-based offerings. The 650-customer figure for Alibaba's own chips versus AWS's 120,000+ Graviton users signals the custom-chip ecosystem is still early.

Supermicro fired staff across sales, technical support, and business development for failing to follow export compliance policies, after a probe into a $2.5 billion scheme to smuggle Nvidia GPU-packed servers to China. The company cleared its current senior management of knowledge of the diversion but admitted its compliance program was insufficient and is implementing board-recommended enhancements.

Why: If you source GPU servers from Supermicro or depend on Nvidia hardware supply chains in Southeast Asia, expect tighter export-control scrutiny and potentially slower fulfillment as Supermicro overhauls compliance. Builders planning AI infrastructure procurement should factor in possible delays and additional KYC/export documentation requirements when ordering restricted hardware.

Google's Threat Intelligence Group is tracking three suspected Russian cyber-spy groups (UNC6293, UNC7005, UNC5976) that have added OAuth phishing to their toolkit, targeting under 100 individuals per campaign in academia, aerospace, defense, government, and think tanks across Europe and the US. UNC6293, linked to APT29/Cozy Bear, now requests victims share either the full callback URL or the verification code after a legitimate OAuth login to an external provider, allowing attackers to hijack the token exchange without needing passwords.

Why: If you build apps that use OAuth flows, attackers are actively social-engineering the token-handoff step — specifically asking users to paste the verification code or full redirect URL. Review whether your OAuth UX makes it obvious to users that they should never share a verification code or callback URL with anyone, and consider whether your app's consent screen warns users about this attack pattern.

Anthropic's Applied AI team published a playbook for restructuring the SDLC around agentic coding tools like Claude Code, arguing that code generation is no longer the bottleneck. The post claims the real bottlenecks have shifted to planning, review/testing, and deployment—steps still running at human speed—while traditional approval gates and controls designed for human-paced development now mismatch reality.

Why: If you're using agentic coding tools, the actionable insight is to audit your planning, review, and deploy stages specifically—not your coding workflow—since those are now where AI-generated throughput stalls. Teams should decide whether PRDs, estimation rituals, and sign-off gates still make sense when build cycles compress from weeks to hours.

Matt Webb describes building Galactic Compass 2's new AR mode, where he needed quaternions but couldn't learn them from books or mathematician friends. He sat down with ChatGPT not to write the code but to educate himself, and it acted as a patient interactive tutor that finally got him over the hump. He frames this as evidence that outsourcing thinking to AI doesn't stop learning—it pushes you to learn more.

Why: The actionable takeaway is narrow but real: when you hit a concept you can't crack from documentation or colleagues, try using an LLM as a Socratic tutor—asking it to explain and quiz you rather than generate code. This is a workflow choice, not a tooling change, so it won't affect everyone's stack or decisions.

Supermicro fired several employees after an internal investigation into allegations that $2.5 billion worth of AI chips were smuggled into China, bypassing US export controls. The company claims senior management had no knowledge of the illicit transactions.

Why: Continued enforcement of US AI chip export controls means GPU supply chains serving Southeast Asia may face additional scrutiny and friction, potentially affecting availability and pricing for regional cloud and AI infrastructure. Builders sourcing GPU capacity should factor tightening export compliance into procurement timelines and consider diversifying across providers.

Meta faces a California trial where states seek to force removal of addictive design features including infinite scrolling, autoplaying videos, Instagram Stories, beauty filters, and algorithm-dominated feeds. Meta claims it could face $1.2 trillion in damages, and California's Attorney General signaled other social platforms will also be held to account.

Why: If the court rules against Meta, consumer app builders who rely on engagement-maximizing patterns like infinite scroll, autoplay, or disappearing content may face regulatory pressure to redesign those mechanics — especially any Malaysian or SEA startup targeting US users. This is a trial in opening statements, not a ruling, so no action is required yet, but teams shipping social or feed-based products should track which specific design features are named as legally actionable.

Microsoft has fixed a maximum-severity CVSS 10.0 vulnerability (CVE-2026-69836) in Entra ID, formerly Azure Active Directory, which was actively exploited in the wild. The flaw stemmed from unsafe deserialization, allowing unauthenticated remote code execution, but Microsoft has already mitigated it on their cloud infrastructure, requiring no customer patches.

Why: Since Microsoft has already patched the service, you do not need to deploy updates, but if your SaaS or infrastructure relies on Entra ID for authentication, you should review your tenant logs for anomalous activity prior to the fix given the flaw allowed unauthenticated remote code execution.

Google is offering eligible university students in Malaysia (aged 18+) a free 12-month Google AI Plus plan valued at RM287.88 (RM23.99/month), including 2x Gemini usage limits, 400GB shared cloud storage, and full multimodal Gemini features. Discounted tiers are also available: Google AI Pro at RM23.99/month (down from RM97.99) and a Pro + YouTube Premium bundle at RM33.49/month (down from RM118.89), with promotions running until 31 December 2026.

Why: If you or your teammates are enrolled university students, claim the free AI Plus plan before 31 December 2026 to get 2x Gemini query limits and 400GB storage at no cost—useful for coursework, prototyping, or side projects. The discounted AI Pro tier at RM23.99/month (vs RM97.99 standard) is worth evaluating if you need 4x Gemini limits and 5TB storage for heavier workloads.

UNICEF and MDEC announced a partnership at BAGFEST 2026 in Kuching to embed children's rights and safety into Malaysia's games industry using UNICEF's RITEC (Responsible Innovation in Technology for Children) framework. MDEC CEO Anuar Fariz Fadzil said the collaboration will provide practical guidance to Malaysian studios to consider child well-being from the design stage, framing it as strengthening competitiveness rather than limiting creativity.

Why: Malaysian game studios and developers building products that may reach children should expect MDEC to push RITEC-aligned design practices as part of its ecosystem support — likely influencing grant criteria, industry programs, or certification expectations. If you ship games in Malaysia, reviewing the RITEC framework now and building child-safety considerations into your design process early is cheaper than retrofitting after policy or market pressure forces it.