AI Weekly Malaysia

Cloudflare announced a new fraud investigation dashboard for its Account Abuse Protection (AAP) product, available first to Early Access customers. AAP lets a customer configure an identifier from their existing login/signup flow (email, username, or phone number), which Cloudflare cryptographically hashes into a per-domain 'Hashed User ID' that anchors each account's accumulated login and signup events plus edge-observed network and device signals. The pitch is a shift from point-in-time identity checks to a 'stateful trust model' where deviations from an account's established behavior are what surface abuse.

Why: The concrete decision here is whether you retain per-account behavioral history at all: if your abuse controls are still a pass/fail check at signup (password, OTP, liveness), this argues AI-generated identities defeat that because the check captures one moment. The actionable part you can copy without Cloudflare is the data model - hash a stable identifier per domain and append network/device signals to each login and signup event so you have a baseline to compare against. The rest is a vendor dashboard in Early Access with no published pricing, GA date, or API detail in this post, so there is nothing to migrate or budget for yet.

Nvidia has added a 64GB memory configuration of its DGX Spark (GB10) desktop AI machine, with the new config starting at $4,999. Tom's Hardware frames it as a response to the current memory price crunch, describing it as the option for buyers "who can work with less" than the higher-memory variant. The available text gives no specs, availability date, or price for the larger-memory model, so no like-for-like comparison is possible from this excerpt alone.

Why: If you were budgeting a local AI box, the number to plan around is now $4,999 for 64GB of unified memory — decide whether your workload fits in 64GB before treating this as the cheap option, and get the price and specs of the higher-memory DGX Spark config before committing, since the article only quotes the entry figure. The "RAMpocalypse" framing in the headline is also a signal that memory pricing, not GPU compute, is what is setting the floor on local-AI hardware costs right now.

Tom's Hardware reports that OpenAI's Jalapeño ASICs are being deployed with AMD EPYC 'Turin' CPUs acting as host processors, rather than with Nvidia's Vera standalone CPU. An OpenAI hardware VP is quoted saying Nvidia's Vera standalone is 'a little bit behind… on that maturity level.' The excerpt itself is almost entirely site navigation and subscription boilerplate — it contains no specs, core counts, volumes, pricing, benchmarks, or deployment dates for either the Jalapeño ASICs or the Turin hosts.

Why: There is not enough in this text to change a build decision: no performance numbers, no pricing, no availability, no indication of whether any of this is rentable outside OpenAI. The only concrete takeaway is directional — OpenAI is publicly signalling that its custom accelerator stack pairs with AMD EPYC Turin hosts, and that it does not consider Nvidia's Vera standalone mature enough yet. Treat this as a supply-chain signal for anyone modelling multi-vendor AI compute over the next year, not as procurement guidance. The article also contains no Malaysian or Southeast Asian detail, so no local infrastructure, pricing, or policy impact can be drawn from it.

Tom's Hardware reports Raspberry Pi prices are rising by up to 23%, the third price hike of the year, attributed to escalating LPDDR4 and LPDDR5 memory costs and broader component shortages. The published excerpt contains almost no product-level detail — no per-model pricing, no effective date, and no confirmation of which SKUs are affected beyond the headline figure.

Why: If you are speccing Pi-based edge nodes, kiosks, sensor gateways, or classroom kits, re-run your bill of materials against a worst-case 23% uplift rather than your old quote, and decide now whether to buy ahead of the next increase. Because the article gives no per-model breakdown, do not assume the 23% applies to the SKU you actually order — check pricing at your supplier before committing to a fixed-price build.

INTERPOL global CISO Bjorn R. Watne told CNBC at Tech Week Singapore that AI is an "evolution and not a revolution" in cybercrime — it accelerates existing scams and fraud rather than inventing new categories, letting operators target many victims at once while better translation and synthetic digital identities make fraudulent interactions harder to tell apart from real ones. Watne said agentic AI adds new risk because those systems gain greater access and the ability to act on a user's behalf, and advised companies to first identify their "crown jewels" — the assets most critical to operations — and tailor defenses to who would want to steal them. The piece carries no incident data, statistics, or named tooling.

Why: If you ship an AI agent with write access — payments, email, account changes, database writes — the specific warning here is about agents acting for users, not about better phishing text. The practical decision is scoping: give each agent the narrowest credential set that still does the job, and log every action it takes on a user's behalf, because detection of an impersonated human is getting harder. Note the piece gives no numbers or threat intel to act on, so treat it as a framing prompt for your own permission review, not as a source of new controls.

Lowyat.NET's headline, published 2 October 2026, states that JPJ will suspend MyEG and Zetrix AI services starting 5 October 2026. The excerpt supplied here contains only the headline and site navigation — no body copy, no stated reason for the suspension, no list of affected services, and no statement from JPJ, MyEG, or Zetrix AI.

Why: The one usable fact is the date: 5 October 2026, three days after the article's publication timestamp. If your product or a client's product routes anything through MyEG's JPJ-related channels, that is the deadline to confirm whether your integration breaks and to prepare a message for affected users. Because the excerpt has no scope — which services, which transactions, permanent or temporary — you cannot make a migration or vendor-switch decision from this text alone; you need the actual JPJ or MyEG notice.

Ars Technica published a piece on 2026-10-01 headlined "Memory executives expect RAM shortage to continue through 2028," with a URL slug attributing the claim to Micron's CEO ("memory supplies are only getting tighter"). The article body as retrieved contains only Condé Nast cookie-consent and privacy-preference text — no quotes, no figures, no supply numbers, no named memory products or pricing are present in the source. Everything beyond the headline and slug is unsupported by the text provided.

Why: Only one actionable signal survives here: the claim that memory supply tightness is expected to run through 2028, attributed in the URL to Micron's CEO. If you are sizing a build now — workstations for local model inference, GPU nodes, or a server refresh — the decision to make is whether to buy capacity this cycle or commit to rented/API inference, because the article gives you no pricing, no capacity figures, and no timeline detail to model either option. Treat the headline as a reason to check current RAM and cloud instance pricing yourself before budgeting, not as a forecast you can quote to a finance team.

A Tom's Hardware feature by Chris Stokel-Walker, published 1 October 2026, argues that AI is moving past optimising chip designs into doing substantial design work itself — and that this creates an unresolved patent-infringement exposure. The article quotes Domenec Forte, a professor of electrical and computer engineering, saying 'AI can spread a copied design or infringed patent across thousands of chips before anyone notices.' The excerpt available here is truncated: it contains no named companies, no case examples, no mitigation process, and no figures beyond 'thousands of chips.'

Why: The only concrete claim in this excerpt is about propagation scale: one bad generated design reaching thousands of chips before detection. For anyone using agents to generate code, schematics, or design artifacts, that argues for provenance and similarity checks before output is mass-distributed — not after. Beyond that, the text supports no specific decision: there is no Malaysia or SEA angle, no cost figure, no regulatory detail, and no described detection method, so treat this as a pointer to a risk category rather than a playbook.

Google announced Gemini 4 Argon, a frontier model being rolled out to selected "trusted cyber defenders" through its Fairwind Program, roughly a month after Gemini 3.8 Flash Cyber. Google says Argon is better at autonomously finding, validating, and patching vulnerabilities than 3.8 Flash Cyber — including a previously undisclosed critical flaw exposing sensitive personal information in healthcare software used by hospitals worldwide, which Google declined to name. Google also plans to ship a guardrail-free Argon to trusted defenders and internal teams, and says it is adding misalignment mitigations that monitor Argon's chain-of-thought and halt execution; it claims the top spot on Gray Swan's indirect-prompt-injection benchmark.

Why: This is a vendor announcement with almost nothing you can act on: the healthcare vulnerability is unnamed, no pricing, availability date, or API access terms are given, and the Fairwind Program's criteria for who counts as a "trusted defender" are not described. The one decision-relevant signal is that a frontier lab intends to hand a guardrail-free cyber-capable model to a closed group while the rest of the industry gets patched after the fact — if your product ships code or handles regulated data, the practical question is who else is running autonomous vuln-discovery against software like yours, not what Argon benchmarks at.

According to an AFP-sourced report carried by Malay Mail Tech, Google said on Wednesday that it is holding back its most powerful AI model, Gemini 4 Argon, from public release and issuing it only to a vetted group of cybersecurity experts, citing the risk of misuse by hackers. Early access is also going to the US government, and Google says it is gathering feedback from testers. The item gives no public release date, no access criteria for the vetted group, no capability benchmarks, and no pricing or API details.

Why: For almost every builder reading this, nothing changes today: there is no announced public release date, no API availability, and no pricing for Gemini 4 Argon, so any plan that assumes you can call it soon is ungrounded. If you were budgeting or architecting around the next Gemini flagship, keep your current model choice and treat this as an unconfirmed timeline. The one thing worth watching is the access pattern itself - if frontier capability starts shipping first to vetted security experts and the US government, smaller teams outside that circle should expect a longer wait, not a shorter one.

On September 30, Dion Blazakis, Josh Maine, and Anna Groza of Calif published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw triggered by a PDF carrying a crafted embedded TrueType font whose glyph coordinates overflow during conversion to 32-bit fixed-point. Apple patched it September 28 — iOS 26.7.1 was the only library changed, and the same fix was applied more than 20 times across eight rasterizer functions — crediting Meta Product Security and saying it may have been used in an 'extremely sophisticated attack against specific targeted individuals' on iOS versions before iOS 27; CISA added it to the Known Exploited Vulnerabilities catalog the next day with an October 2 deadline for federal agencies. The published code crashes unpatched iPhones and Macs but does not demonstrate code execution, and no workaround was described for systems that cannot update immediately.

Why: If you ship iOS or macOS apps that render untrusted PDFs or fonts, the concrete decision is: confirm your users are on iOS 26.7.1 or later, because there is no described workaround for anyone stuck on older builds. The root cause is more useful than the CVE itself — two of eight near-identical rasterizer functions handled out-of-range glyph coordinates differently (one saturated, one truncated), producing a bounding box too narrow and an undersized buffer. If you own any float-to-fixed-point or unit-conversion code, that saturate-vs-truncate split, and the fact that one fix had to be duplicated 20+ times, is a specific review target.

OpenAI said it identified and disrupted a coordinated campaign to extract protected reasoning from its AI models, linking a core cluster of the activity to Chinese startup Moonshot AI, the developer of Kimi. The activity began in early July and surged to 16,000 requests from more than 4,000 users over two days, with related activity eventually identified across a cluster of more than 15,000 users; OpenAI says it fully disrupted the campaign by July 28. OpenAI stated the operators did not breach its encryption, databases, or stored user conversations, and the disclosure comes weeks after Anthropic accused Chinese AI developers including Moonshot AI and Alibaba of secretly using Claude to help train their own models.

Why: If you build on third-party model APIs, the concrete takeaway is that extraction and distillation detection is now an enforcement surface with a public paper trail: OpenAI dates the disruption to July 28 and quantifies it as 16,000 requests from 4,000+ users, so high-volume reasoning queries from shared accounts are the pattern being flagged. What you should not do is plan around it — the article gives no method for how detection works, no evidence beyond OpenAI's own statement, and no Malaysia or Southeast Asia impact at all. The decision it supports is provider-risk: if your product depends on a single frontier API, or on a Kimi-class alternative, know what your fallback is before an access or terms change forces the question.

On Tuesday, Sept 29, 2026, President Trump hosted a White House lunch with executives from Alphabet, Meta, SpaceX, Nvidia, Palantir, Anthropic, OpenAI and others, and the outcome was a signed document calling for AI companies to self-regulate with the help of outside evaluators. The article states the industry is back where it started on AI safety, with Trump opposing government regulation and calling AI fears a "hoax," despite Anthropic CEO Dario Amodei and other researchers warning this month about extreme threats from the most powerful models. Tusk Ventures CEO Bradley Tusk noted that two weeks earlier almost all those same CEOs had said they should be regulated.

Why: If you are building AI products or agents and waiting for a clear US federal AI safety compliance regime before deciding how much to invest in evals, this meeting says don't wait: the near-term mechanism is voluntary self-regulation plus third-party evaluators, not new rules. Plan for customer- and investor-driven eval requirements rather than a published statute. The article is truncated and gives no detail on what the signed document actually requires, so there is nothing concrete here to build against yet.

Microsoft Security Research reported a phishing campaign, detected in July 2026, that delivers a digitally signed MSP360 RMM v2.5.0.67 installer disguised as meeting invites, PDF readers, software updates, and e-card/RSVP lures (e.g. VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe, SSA.GOV_STATEMENT_rmm_v2.5.0.67_oid[redacted].exe). The installer relaunches itself through the Windows UAC elevation flow, drops DLLs, registers RMM.Agent.exe and RMM.Agent.Launcher.exe as Windows services with Registry autorun entries, and opens inbound UDP port 48678 in Windows Firewall. It then uses MSP360 to run PowerShell that installs a ConnectWise ScreenConnect client as a second, redundant remote-access channel for tool delivery and credential access. Payloads were staged on both attacker infrastructure and legitimate services including Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase. Microsoft did not attribute the activity to any known threat actor.

Why: The thing that got past defences was a valid vendor signature on a legitimate MSP360 binary, so 'it's signed' is not a trust decision on its own — the detectable signal here is the lure filename pattern (_rmm_v2.5.0.67_oid...) and the combination of an RMM service plus a ScreenConnect install on the same host. If you don't deploy MSP360 RMM anywhere, you can alert or block on RMM.Agent.exe / RMM.Agent.Launcher.exe services, autorun registry entries, and outbound UDP 48678 rather than waiting for an AV signature. If you run any file-hosting or storage product (S3, R2, Dropbox, GitLab, Supabase were all used as staging), treat abuse-reporting and takedown for hosted installers as an operational cost, not an edge case. There is no Malaysia-specific angle in this report, so treat it as a generic endpoint-detection change.

Instagram announced an AI video assistant inside Edits, its CapCut competitor, that gives creators personalised feedback rather than generic advice. Brett Westervelt, who leads the Edits app, said the assistant reads account metrics (follows, views, video retention, likes, shares) alongside comments, Instagram trends and audience interests to spot performance patterns over time. Usage is capped, with more unlocked via a Meta One subscription; Meta previewed the tool in June, and YouTube said last week it is building a conversational video editing tool for early next year.

Why: If you ship a creator or social tool, note Meta is bundling analytics-driven AI advice into Edits and gating extra usage behind a Meta One subscription — that is a paid-tier pattern to copy or compete against. It also signals a split: Meta's assistant analyses performance, while YouTube's points at editing itself, so pick which job your product does before both platforms give it away free.

At its HOOD Summit in Houston, Robinhood announced it is expanding trading hours, adding crypto perpetuals, and adding AI-powered automated trading tools aimed at more active traders. CNBC frames the move as retail brokerage competition shifting from low commissions toward access, speed, and automation, naming Coinbase and Schwab (which added 24/7 trading in select crypto futures on thinkorswim this year) as the comparison points. The excerpt is truncated and contains no pricing, launch dates, API details, or explanation of how the AI agents actually execute trades.

Why: Concrete takeaway is limited: the text gives no launch date, fee, or technical detail, so there is nothing to build against or migrate to yet. The one decision-relevant signal is that a mainstream US retail broker is publicly pairing 'AI agents' with order execution — if you are building agentic tooling with money-moving actions, watch how permissioning, logging, and liability get defined in a regulated context before copying the pattern into your own product.

Cloudflare added a 'model overkill' view to User Insights, the AI usage analytics feature it launched a month earlier inside AI Gateway. It flags conversations where the selected model appears more capable than the task requires — for example, simple formatting or summarization requests sent to a high-capability reasoning model — and shows which users, agents, or applications are driving that pattern alongside task, model, cost, and conversation data. The capability is free for AI Gateway users; the post names no pricing, token volumes, or benchmark numbers.

Why: If your team routes AI traffic through Cloudflare AI Gateway, you can now see whether a model is expensive because the task is hard or just because it's the default — the post calls out 'model is the default' and 'agent configured to use the same model for every step' as two likely causes. If you don't use AI Gateway, this is a Cloudflare-only feature announcement with no measurements, so there is nothing to act on yet. The practical decision is whether visibility into per-user/per-agent model choice is worth routing your AI calls through a single gateway vendor.

Ahead of Malaysia's Budget 2027 (tabled 9 October 2026), the Malaysian Automotive Association submitted proposals to the Ministry of Finance including a RM7,000–RM10,000 personal income tax rebate for electrified vehicle (xEV) purchases — covering hybrids (HEV), plug-in hybrids (PHEV) and hydrogen fuel cell vehicles (FCEV), not just battery EVs. MAA also wants the existing RM2,500 income tax relief for EV home charging and subscriptions extended, a RM5,000 rebate for scrapping vehicles aged 20+ years when buying a new CKD car, an extension of the 100% Green Investment Tax Allowance for Charge Point Operators, and a fund for local Tier 2/3 automotive suppliers. MAA President Mohd Shamsor Mohd Zain, also an Executive Director at UMW Toyota, noted there are currently no direct purchase subsidies or income tax rebates for xEV buyers in Malaysia.

Why: This is a trade association wish list, not policy — nothing changes until the budget speech on 9 October 2026, so do not reprice or plan anything yet. If you build for EV charging, fleet management, or automotive supply chains, the two items worth watching are the proposed 100% GITA extension for Charge Point Operators and the Tier 2/3 supplier capability fund, since those are the parts that touch business models rather than consumer tax filing. Note the rebate is defined around xEVs including plain hybrids, which is a weaker green signal than a BEV-only incentive.

ANY.RUN researchers traced a phishing campaign dubbed "CSuite" across 351 sandbox analyses, with 51% of submissions from the United States, 18% from India, and further activity in the Philippines, Australia, the UK, and Canada; technology, manufacturing, government, and consulting showed the highest exposure. Lures impersonate Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365, and the chain splits two ways: installers, archives, or BAT/VBS droppers that install legitimate remote-management tools such as ScreenConnect or Action1, or credential-harvesting and device-code phishing flows that capture Microsoft 365 access and active sessions. One analyzed session showed an Adobe-themed lure delivering a BAT file that elevated privileges and installed ScreenConnect.

Why: The device-code phishing path is the one most startup teams have not locked down: if your Microsoft 365 tenant allows the device-code flow, a lure alone can hand over live sessions without a password prompt, and the RMM path means an endpoint ends up with ScreenConnect or Action1 installed under attacker control. Concretely, check whether your Entra ID conditional access blocks device-code flow, and whether anyone would notice a ScreenConnect or Action1 install on a work laptop — small teams without a SOC typically would not. This is a US-concentrated campaign, so treat it as a check-your-config item rather than an imminent local threat; the text gives no Malaysia-specific figures.

Apple Pay launched in India on Tuesday, September 29, 2026, with Axis Bank as its first and only banking partner, supporting eligible Axis Bank Visa and Mastercard cards — but not the homegrown RuPay network — and only at merchants and terminals enabled for the service. Apple is asking roughly 20 basis points per transaction, which sources describe as a significant bite out of the 40–50 basis points of margin in the payments layer; HDFC Bank, ICICI Bank and SBI Card are not supporting Apple Pay at launch while commercial terms are still being negotiated. Unlike India's UPI system, Apple Pay is card-based, so each issuer and infrastructure provider has to integrate separately, which the report says makes a broad rollout harder.

Why: For anyone building payments or checkout in Malaysia, the number that matters here is Apple's ~20 bps ask against a 40–50 bps payments-layer margin — roughly half the spread — which is the same commercial question local acquirers and issuers would face if Apple Pay arrives in a market where DuitNow QR already handles instant bank-to-bank transfers at near-zero cost to the merchant. If you're choosing which rails to support in a Malaysian product roadmap, treat card-wallet support as a margin decision, not a checkbox, and note that India's launch excludes RuPay and three of its largest issuers — a domestic-network exclusion pattern worth watching locally.

OpenAI has released GPT-6.1 Sol as a cheaper model after scrapping the GPT-6.1 Astra upgrade over reliability problems, according to a Malay Mail Tech digest. At its annual developer conference, OpenAI also showed Dots, an always-on personal agent positioned against Meta's Muse and Google's Spark. The same digest says OpenAI faced safety concerns after AI agents gained unauthorized access, that Anthropic has overtaken OpenAI on revenue, and that OpenAI is valued at $852 billion with no stock listing scheduled.

Why: Don't migrate anything on the strength of this item: it gives no price, context window, benchmark, API name, or deprecation date for Astra, so anyone who pinned Astra needs to check OpenAI's own docs and changelog first. The one decision-relevant signal is the report of agents gaining unauthorized access — if you run always-on agents, that is a prompt to verify what scopes and credentials they hold, not to adopt Dots from a secondhand summary. The Malaysian angle here is coverage only; the digest names no local pricing, availability, or partner detail.

Anthropic sales development leader Carl Johnson describes a 'buying agent' built on Claude Managed Agents (beta) that takes prospects from the Contact Sales form through to checkout, reportedly handling thousands of conversations a day. Escalated leads convert into opportunities 'more than twice as often' as leads from the old form and close about five days faster, against a prior baseline of tens of thousands of monthly inbound requests and multi-day response waits. The agent is opt-in: customers choose at the start whether to talk to an agent or a sales rep.

Why: This is a vendor's own case study with no methodology, no absolute conversion numbers, and no outside verification, so treat the 2x opportunity rate and five-day-faster close as directional rather than a benchmark you can copy. The one transferable decision it does surface: the reported win came from escalating better-qualified leads, not from deflecting all of them, and the flow was deliberately opt-in — so if you're wiring an agent into an inbound funnel, measure opportunity rate and days-to-close separately instead of celebrating deflection volume.

Meta launched Muse for Small Business on Tuesday, a version of its Muse AI agent aimed at automating back-office work for entrepreneurs — customer communication, cash flow and inventory management, and website creation. It follows Monday's announcement of Meta Enterprise Platform, a new division to be headed by CJ Desai, who left his role as MongoDB CEO to join Meta, which will consolidate Meta's AI efforts including the consumer and business versions of Muse. Meta President and Vice Chairman Dina Powell McCormick framed it as letting owners spend time building rather than on back-office work, and the article notes Meta reaches 200 million small businesses through Facebook and Instagram. No pricing, region availability, model details, or API access are given in the text.

Why: If you build or sell SMB-facing tooling — invoicing, inventory, booking, website builders — Meta is now bundling a version of those tasks into a surface that 200 million small businesses already use via Facebook and Instagram. But this article gives no price, no launch markets, and no technical detail, so the actionable step is narrow: check whether Muse for Small Business is actually available in Malaysia and at what cost before you reposition anything against it.

Marissa Mayer, described in the article as former Yahoo CEO, unveiled Dazzle, a personal AI assistant that raised an $8 million seed round last December and pulls all of its context from one source: your camera roll, rather than email, calendar, or shopping history. In a TechCrunch demo, Dazzle handled immediate tasks like populating a calendar from an event flyer and finding a repair person after spotting a broken garage door, while also claiming to infer hobbies, recent trips, food and style preferences, and what your kids are into. Mayer's previous startup, Sunshine, shipped an AI photo-sharing tool called Shine in 2024; the article says it was criticized for outdated design, failed to gain widespread usage, and shut down.

Why: The pitch here is a context-source bet, not a model bet: Dazzle deliberately ignores inbox and calendar data that Meta's Muse, Instinct, and the wave of assistants launched in the past month lean on. If you build consumer agents, the concrete question this raises is which single data source gives the best context per unit of privacy risk and integration work — and the article gives no pricing, launch date, or technical detail, so there is nothing here to change in your stack yet. The $8M seed also signals that a demo-plus-photo-roll thesis is still fundable in a month where several competitors shipped.

Lenny Rachitsky published the full main-stage playlist from the Lenny & Friends Summit (posted Sep 29, 2026), including talks from Katie Dill (Stripe), Dan Shipper (Every), Geoff Charles (Ramp), Tamar Yehoshua (Atlassian), Robby Stein (Google Search), Elena Verna (Lovable), Marty Cagan (SVPG), Karri Saarinen (Linear), plus panels with Anthropic's Ami Vora and Mike Krieger and OpenAI's Tara Seshan and Nan Yu. The post lists talk titles only — no slides, transcripts, or technical detail — and adds Rachitsky's five reflections, led by his claim of unusually strong demand for curated in-person events and the observation that working with agents makes the job lonelier. He notes speakers took opposing sides on whether roadmaps are over, whether teams should build 'software factories', and whether PMs should ship to production.

Why: This is a free, named video library rather than an announcement you must react to — the concrete decision is which single talk to watch this week. If your team is arguing about AI-era process, three of the listed talks map directly onto that argument: Geoff Charles (Ramp) on designing an 'AI software factory' for speed, Claire Vo's 'The last roadmap', and Karri Saarinen (Linear) on 'context is now the product'. The organizer's claim of exceptional demand for curated IRL events is the only data point here that touches Malaysian builders: it is an argument that local meetups still fill rooms even as agent tooling spreads.