AI Weekly Malaysia

Microsoft is merging its consumer and work Copilot applications into a single entity, and pulling Mico—the anthropomorphic blob introduced less than a year ago as the face of Copilot Voice—out of the spotlight. Mico is being relocated to Learn Live, a voice-based study mode for tutoring, rather than being killed entirely. The move echoes Microsoft's history of abandoned persona assistants like Clippy, Cortana, and Microsoft Bob.

Why: If your team or product integrates with Copilot, the consumer/work app merger means you should expect API surface changes and consolidated licensing rather than two separate Copilot experiences. The Mico retreat signals Microsoft found that character-driven AI personas did not drive engagement in general voice use—relevant if you are debating whether to invest in anthropomorphic agent UIs versus plain functional interfaces.

A modder attached two desktop CPU coolers to a ZTE Nubia Z70 Ultra smartphone (Snapdragon 8 Elite SoC, 24GB RAM) and successfully ran The Witcher 3 at 1080p ultra settings, effectively using the phone as a gaming PC. The cooling modification was necessary to sustain peak SoC performance without thermal throttling.

Why: Demonstrates that current flagship mobile SoCs paired with adequate cooling can deliver desktop-class gaming performance, which is relevant if you are building or evaluating mobile-first game streaming, cloud gaming edge clients, or Android-based compute workloads. The Snapdragon 8 Elite with 24GB RAM is now in the same conversation as low-end discrete GPU setups for 1080p gaming.

Grab is testing a Women-Only Rides feature in Malaysia that lets female passengers match exclusively with female drivers, addressing safety concerns for women travelling alone or late at night. The feature requires verification, though the article text cuts off before detailing the full verification process.

Why: For founders building consumer-facing platforms in Malaysia/SEA, this signals that gender-safety features are becoming table-stakes in ride-hailing and gig platforms. If you operate a marketplace with similar trust dynamics, consider whether identity-verification-gated matching is worth implementing — Grab's rollout suggests user demand is strong enough to justify the operational complexity of segmenting supply and demand by gender.

Apple sent a new batch of spyware threat notifications on Thursday to users in 110 countries, bringing the total to over 150 countries notified to date. The notifications now appear directly on the iPhone lock screen as a push alert reading 'Apple detected a mercenary spyware attack targeted at your iPhone,' alongside updated guidance including enabling Lockdown Mode — a feature Apple says has never been bypassed in any known case.

Why: If you or anyone on your team receives one of these notifications (email, Apple ID login, or lock-screen push), the immediate action is to enable Lockdown Mode, which Apple says has zero known bypasses. Founders and developers working in sensitive sectors or regions should pre-familiarize themselves with Lockdown Mode's tradeoffs — it restricts iMessage attachments, web content, and incoming invitations — so they can act fast rather than researching under pressure.

Workday shares surged 18% and were halted multiple times on a Reuters report that private equity firm Silver Lake is in talks to acquire the HR software maker, whose market value exceeds $50 billion. Workday's stock had been pressured by fears that AI tools would upend its business model, and co-founder Aneel Bhusri was renamed CEO in March.

Why: For SaaS founders, this is a market signal that PE is still willing to bet on enterprise SaaS despite the narrative that AI will displace incumbents like Workday. If the deal materializes, it could reset valuations and M&A appetite in the enterprise software space, which affects exit expectations and fundraising leverage for founders building HR, finance, or workflow SaaS.

IBM and OpenAI announced a partnership to jointly market and build industry-specific AI solutions for financial services, government, telecom, and retail. IBM will integrate GPT-5.6, Codex, and ChatGPT Work into its IBM Consulting Advantage platform, train tens of thousands of consultants on OpenAI's stack, and create a group of 'Forward Deployed Experts' via OpenAI's Partner Network. This follows IBM's similar alliance with Anthropic less than a year prior, reflecting a model-agnostic strategy.

Why: If you sell AI solutions to enterprises in Southeast Asia, your clients may increasingly acquire OpenAI tooling through IBM Consulting rather than directly from you — factor this channel shift into your go-to-market. The mention of GPT-5.6 and Codex integration into a consulting platform signals what models enterprises will standardize on next. If you want into OpenAI's enterprise ecosystem, the Partner Network and Forward Deployed Experts program is a concrete entry point.

AWS authors walk through a continuous data loop using Strands Robots (Apache 2.0 SDK), LeRobot's on-disk dataset format (90,000+ datasets, 8,000+ publishers on HF Hub), and Hugging Face Storage Buckets (mutable, non-versioned, Xet-backed object storage announced March 2026) to record robot demonstrations, train policies on growing datasets, and deploy back to hardware like the SO-100/SO-101 arms. The core problem they address is that running this loop daily causes repeated full-dataset transfers to GPUs and redundant byte costs, which the Storage Bucket layer sitting in the hf:// namespace is meant to mitigate as a working staging layer between recording and training.

Why: If you are building robotics learning pipelines with LeRobot-compatible datasets, HF Storage Buckets give you a mutable staging layer that avoids re-copying the entire dataset to GPUs on every training run—a concrete cost and workflow decision. For everyone else, this is a niche robotics tooling walkthrough that doesn't require any change to what you ship.

Apple is reportedly in talks to pay publishers for content to power the upcoming Siri AI, proposing a variable pay-per-use compensation model rather than the industry-standard fixed licensing fees. The company has considered a nine-figure budget for these payments, with Siri AI expected to roll out later this year.

Why: If Apple normalizes pay-per-use content licensing for AI assistants, publishers and content platforms may start expecting similar variable-compensation deals from any AI product that ingests their data. Builders working on AI agents or assistants that surface third-party content should watch whether this model becomes a precedent that raises their own content-acquisition costs or creates new licensing obligations.

Anthropic updated Claude Tag, its Slack-integrated assistant, to read context across an entire channel rather than processing messages one at a time. The previous lightweight yes/no classifier is replaced with a four-option decision system (reply inline, start a thread, route to existing work, or stay silent), and Anthropic reports roughly 30% better accuracy in deciding when to proactively respond. The additional context does not count toward usage or spend limits on any plan.

Why: If your team uses Claude Tag in Slack, expect more unsolicited but context-aware interventions—test it in a low-stakes channel first to see whether the new proactive behavior helps or creates noise. If you were holding off due to spend concerns, the no-additional-cost framing removes that barrier, though it's worth watching actual token consumption over time.

Google unveiled the Pixel 11 lineup (Pixel 11, Pro, Pro XL, Pro Fold) with Gemini Intelligence, an agentic AI layer that works inside the OS to connect data across messages, calendars, maps, and other Google services and carry out multi-step actions like checking availability or starting reservations. Rick Osterloh said Gemini could eventually become the primary interface for phones and laptops, and noted memory shortages are pushing consumer electronics prices higher.

Why: For AI agent builders, the notable shift is Google pushing agentic AI into the OS layer rather than a standalone chatbot — if this pattern succeeds, it signals that consumer-facing agents will increasingly be embedded in platform ecosystems rather than shipped as independent apps. The memory shortage price pressure is a reminder that hardware costs for on-device AI inference may stay elevated.

Qualcomm has disclosed Snapdragon C specifications targeting $300 laptops, claiming 67% faster on-battery performance than Intel's N250. Notably, AC (plugged-in) performance figures were not provided, leaving a key comparison incomplete.

Why: If you spec or buy budget ARM laptops for development work or fleet deployment, the on-battery claim is promising but insufficient without AC numbers — wait for independent benchmarks before committing to Snapdragon C over Intel N250 for $300-class machines.

Researchers from Belgian and German academic institutions demonstrated at the 35th Usenix Security Symposium that commercial out-of-order RISC-V processors—specifically SiFive P550 and T-Head Xuantie C910/C920—are vulnerable to all major Spectre variants (PHT, BTB, RSB, STL), achieving up to 100% recall and 97%+ precision in proof-of-concept attacks. In-order RISC-V processors (SiFive U74, Xuantie C906, C908) appear unaffected.

Why: If you're evaluating RISC-V silicon for embedded or edge deployments, prefer in-order cores (U74, C906, C908) over out-of-order ones (P550, C910/C920) if Spectre-class side-channel leakage is a threat model concern. The T-Head Xuantie C910/C920 chips are Alibaba's designs and are among the more accessible commercial RISC-V parts in Asia, so builders sourcing from regional distributors should factor in that mitigations are not yet mature compared to the x86/ARM ecosystem.

A hacking and extortion group called Helix claims to have breached Uber Freight, exfiltrating mailboxes, cloud storage, accounts payable files, and dispatch documents dated around mid-June. Uber Freight says operations are unaffected and has not confirmed the breach. Google tracks Helix under the umbrella UNC6671 and reports the group has made at least $10.6 million in ransom payments between January and May 2026, primarily using voice phishing against IT helpdesks to reset employee passwords.

Why: The practical takeaway is the attack vector, not the victim: Helix gains cloud access by calling IT helpdesks and socially engineering password resets. If your team or startup operates a helpdesk or identity reset workflow, this is a concrete reason to enforce callback verification or MFA re-authentication before any password reset, rather than relying on the caller's claimed identity.

Oracle is reportedly planning another round of layoffs after already eliminating 21,000 full-time positions and spending most of its $2.1 billion restructuring budget. Some teams face double-digit percentage cuts, though the report does not specify which product lines or geographies are affected.

Why: If your stack depends on Oracle Cloud, Oracle Database, or Oracle-owned technologies (MySQL, Java via support contracts), continued deep restructuring raises the risk of degraded support response times and product roadmap uncertainty. Builders should evaluate whether critical workloads have viable migration paths or multi-cloud fallbacks before any service-level changes materialize.

Form Energy raised $750M to scale manufacturing of its iron-air batteries in West Virginia, which can discharge for up to 100 hours versus the few hours typical of most grid storage. Google is buying a 30GWh Form battery for ~$1B to power a Minnesota data center, and Crusoe ordered 12GWh, driven by AI data centers expected to quadruple U.S. electricity use by 2035. The batteries use iron instead of lithium/cobalt/nickel, with 80% of materials sourced from the U.S. to reduce China dependence.

Why: If you're building AI infrastructure or SaaS with heavy compute needs, energy availability and cost are becoming the binding constraint, not GPU supply. Malaysia's own data center boom (especially Johor) faces the same grid-capacity pressure this article describes for the U.S. — founders scaling compute-heavy products should factor multi-day power storage and renewable intermittency into long-term cloud cost projections, since hyperscalers will pass these energy costs through.

Sandbar, the startup behind the voice-enabled ring 'Stream,' has raised $36 million (including a $23M Series A led by Adjacent and Kindred Ventures) on a bet that push-to-talk, human-controlled wearable AI can succeed where always-on devices like pins and pendants failed. Co-founder and CEO Mina Fahmi, previously at CTRL-labs (acquired by Meta in 2019), argues that 'social acceptability' and custom hardware—not reskinned off-the-shelf devices—are what it takes to break voice wearables out of enthusiast circles.

Why: If you're building voice or agent interfaces, Fahmi's push-to-talk vs. always-on design choice is a concrete data point on user trust and social friction—worth considering when deciding whether your own voice features should default to passive listening or explicit user activation. The $36M raised also signals that investors are still funding consumer AI hardware despite the Humane Pin and similar failures, which is relevant context for founders evaluating hardware-vs-software bets.

The UK's criminal records office (ACRO) was reprimanded by the ICO after attackers maintained persistent access to its Kentico CMS v12.0.0 for over seven months (Aug 2022–Mar 2023), potentially exposing data on ~11,000 people. The root cause was running an unpatched CMS from September 2019 to March 2023, compounded by a miscommunication where the managed service provider didn't learn patching was its responsibility until February 2020 and still didn't actively monitor for vulnerabilities.

Why: If you outsource infrastructure or CMS management to an MSP, get the patching responsibility in writing and verify it's actually happening—ACRO's breach was caused entirely by an unpatched CMS and unclear ownership. Founders running any CMS (WordPress, Kentico, Drupal) should check whether patching is explicitly assigned in their vendor contracts and whether someone is actually applying hotfixes, not just assuming the MSP handles it.

Tencent beat Q2 2026 revenue estimates at 204.78 billion yuan ($30.36B), up 11% YoY, driven by domestic gaming revenue jumping 17% (titles like Delta Force and Valorant) and AI-driven advertising. Net profit missed at 56 billion yuan vs 61.82 billion expected, and capex is rising as the company competes in China's AI race; the stock was down 26% YTD.

Why: Tencent's profit miss alongside rising capex signals that AI infrastructure spending is squeezing margins even for cash-rich incumbents — a data point for SEA founders and builders weighing whether AI-driven ad or gaming features justify their own infrastructure spend. The AI-advertising revenue lift also suggests ad-tech integrations with AI are monetizing now, not just in roadmap slides.

An Akira ransomware affiliate breached a victim via a SonicWall SSL VPN account that lacked MFA, then rebooted the machine into Safe Mode to kill security tools—but Safe Mode also broke the encryptor due to memory constraints. Huntress analyst James Northey warns this was a lucky break, not a reliable defense, since attackers could retool the encryptor to work in Safe Mode. Data and credentials were already exfiltrated before the encryption failed.

Why: If you run a SonicWall SSL VPN or any VPN endpoint without MFA, you are the exact target profile described here—credential-spray attacks succeeded in seven minutes against an unprotected account. Enforce MFA on all VPN accounts now, and assume that even if encryption fails, attackers will still steal Active Directory data and file-share credentials before they leave.

Picus Labs' Blue Report 2026 analyzed 338M+ attack simulations across production environments in H1 2026, finding perimeter prevention rose from 62% to 69% while post-compromise interior prevention was only 37%. Reconnaissance was stopped just 10% of the time and credential theft ~22%, while noisy lateral movement techniques like Sharp-ServiceExec and SMBExec were blocked ~90% of the time.

Why: If you build or operate services with an authenticated interior, assume your perimeter will hold but your internal controls will not. The data says quiet post-compromise actions—domain recon, share enumeration, reading credentials from memory and registry—are nearly unopposed once an attacker has a foothold, so prioritize internal segmentation, credential hygiene, and detection of low-noise recon over further perimeter hardening.

Adobe patched three CVSS 10.0 vulnerabilities across ColdFusion and Campaign Classic, including OS command injection (CVE-2026-48362) and eval injection (CVE-2026-48273) in ColdFusion, plus incorrect authorization flaws in Campaign Classic (CVE-2026-71398, CVE-2026-27302). ColdFusion fixes are in versions 2025.0.12 and 2023.0.23; Campaign Classic fixes require ACC v7 7.4.4 build 9400 for on-premise deployments only. Adobe rated these Priority 1 and recommends patching within 72 hours.

Why: If you maintain or inherit ColdFusion or on-premise Campaign Classic instances—common in legacy Malaysian enterprise, GLC, and some government digital service stacks—these are remotely exploitable arbitrary code execution bugs with no current wild exploitation, meaning patching now is cheap insurance before attackers reverse-engineer the fixes. Adobe-hosted Campaign instances are already patched, so only on-premise and hybrid deployments need action.

Malaysians with passports valid for more than 10 years—caused by JIM rolling over remaining months when renewing early—were barred from international flights because airline booking systems reject the extended validity dates. JIM has capped all new passports at exactly 10 years and is offering free replacements for affected holders, plus priority service at immigration offices.

Why: If you hold a Malaysian passport with validity exceeding 10 years, you should apply for a free replacement before your next international trip to avoid being denied boarding. For builders, this is a concrete example of a data validation edge case in airline systems forcing a government policy change—a useful case study in how rigid field constraints in booking systems can create real-world friction with legitimate documents.

Independent bookstores across Europe are reportedly receiving suspicious bulk orders for thousands of books, with sellers suspecting the books are being acquired to be destroyed and used as AI training data. The orders are believed to be part of AI tech companies' broader push to acquire more training data as publicly available web sources become exhausted or legally contested.

Why: Signals that the era of scraping freely available web text for AI training is closing, and companies are turning to physical media acquisition as a data sourcing strategy. Founders building AI products should expect training data costs and legal scrutiny to rise, and should not assume their models can be trained on publicly available text indefinitely.

A researcher going by 'Chaotic Eclipse' has published a proof-of-concept called ShieldBreak that claims to fully bypass Microsoft's patch for CVE-2026-50656 (RoguePlanet), a race condition in the Microsoft Defender Malware Protection Engine (mpengine.dll) that can grant SYSTEM-level privileges. The PoC reportedly has a 100% success rate on Windows 11 25H2 and Windows Server 2025, with Windows 10 also vulnerable but untested. Microsoft says it is investigating the patch bypass claim.

Why: If you run Windows 11 25H2 or Windows Server 2025 in production or dev environments, this PoC means the existing Defender patch for CVE-2026-50656 does not actually protect you — an attacker with local access can still escalate to SYSTEM. Treat Defender's patch as insufficient and add compensating controls (restrict local user privileges, monitor for unexpected child processes from Defender's engine) until Microsoft ships a corrected patch.

Koray Kavukcuoglu, previously DeepMind's CTO and Google's chief AI architect, is replacing cofounder Demis Hassabis as SVP of DeepMind, reporting directly to Sundar Pichai. He inherits oversight of Gemini model development, frontier AI research, and the Gemini app and developer teams, with Google having not released a frontier model since early 2026 while OpenAI and Anthropic have advanced.

Why: If you're building on Gemini APIs or evaluating it against OpenAI/Anthropic for coding or agent workloads, Google's leadership churn and frontier model drought signal continued uncertainty about Gemini's competitive trajectory. Don't lock in long-term architectural bets on Gemini without factoring in the risk that the next model release timeline and capability level remain unclear.