AI Weekly Malaysia

pwn.watch is a live security incident dashboard that currently lists 42 active incidents—19 critical and 21 not fully patched—against 241 incidents in the last 12 months, with zero days without an incident and a longest quiet run of 11 days (Jan 2–Jan 12). It publishes machine-readable feeds (RSS, JSON, llms.txt) and a 'Copy brief for your AI' feature, and its example entry is an actively exploited Arista VeloCloud Orchestrator SQL injection (CVE-2026-114625, CVSS 9.9) that has been patched.

Why: If you run AI agents for on-call or security monitoring, this gives you a concrete, structured incident feed to plug in—llms.txt and JSON are directly consumable—but the current live list is broad infrastructure CVEs, so you still need to filter for what your stack actually runs. For most app developers, the actionable part is the feed format, not the Arista CVE.

The Hacker News reports a flaw in OpenCode where malicious MCP servers can execute code during the sign-in flow, affecting Windows and WSL. The write-up is dated 22 Oct 2026 and is scoped to those two platforms. The supplied excerpt contains no CVE ID, affected version range, or patch status, so the specific trigger and fix are not verifiable from this text.

Why: If you run OpenCode on Windows or WSL and add MCP servers from GitHub, marketplaces, or a colleague's config, this reframes 'installing an MCP server' as running untrusted code at the moment you authenticate. The excerpt does not state whether a fix has shipped, so check OpenCode's release notes for your exact version before assuming you're covered, and avoid signing in to OpenCode with MCP servers you haven't read the source of.

Recursive released Flint, a free Apache 2.0 coding model on Hugging Face that runs on a laptop and uses a mixture-of-experts design with 40B total parameters but only 2.5B active per task. The company says its Eureka Machine automated research system helped build Flint from scratch in under four months, and that the model can run offline to keep code private and avoid per-token cloud fees. Recursive emerged from stealth in May with $650M at a $4.65B valuation, led by CEO Richard Socher.

Why: You can download and test Flint locally without per-token fees, but the practical question is whether a 2.5B-active coding model is good enough for your day-to-day tasks; benchmark it on your own repo before switching any workflow, and treat the 'largely built by AI' claim as a vendor claim, not an independent result.

Anthropic's Claude Duet is a research-preview 'proactive agent' powered by Opus 5.5, pitched as a morning-brief assistant that keeps working while you're away, sets up meetings, builds dashboards, and pauses for approval on actions like paying a $640 permit fee. It ships with access to 6,000+ connectors and plugins, reuses your existing Claude memory, skills, and apps, and is limited to Pro and Max plans in the US with a waitlist. The page is product marketing: the walkthrough (hiring finalists, a $410K renewal redlined to Net 60, a Series A deck for Harbor Ventures) is illustrative demo content, not customer evidence.

Why: The concrete constraint is availability: Pro/Max subscribers outside the US can only join a waitlist, so anyone planning to build Duet into a workflow or demo it to clients this quarter should not assume access. The design detail worth copying is the approval gate — Duet drafts and stages work but blocks on spend and sends (e.g. the $640 fee expiring in 8 minutes, 'Send from you?'), which is a pattern agent builders can implement now regardless of access.

A team writing for Dharma-AI rebuilt the tokenizer of a production Qwen3-4B Portuguese essay grader instead of touching the model, using a method they call VocabX that selects vocabulary by token cost rather than token frequency. The original Qwen tokenizer scored 151,669 entries per generated token and fragmented the fixed JSON envelope and competency phrases the grader emits on every request; the rebuilt vocabulary cut measured inference cost by 77% with the same base model, same data and same training recipe. The numbers come from a paper still under review and may change before publication.

Why: If you fine-tune a small open model for one language and one fixed output schema (JSON grading, extraction, classification), the inherited tokenizer is a cost lever you can pull before training, not a fixed property of the base model — this case claims 77% lower measured inference cost on a 4B model. The caveat is real: one production system, one language, a paper under review, and no absolute per-request cost or latency figures, so treat it as something to benchmark on your own traffic rather than a guaranteed win. Teams running high-volume Bahasa Melayu or Indonesian output with rigid JSON responses are the closest local analogue worth testing.

Autonomous Logistic Solutions Sdn Bhd (ALS) has begun a 6-month public road trial of its Level 4 driverless RoboVan on the 22km Malaysia Autonomous Vehicle (MyAV) test route in Cyberjaya, covering Persiaran APEC, Persiaran Cyberpoint Selatan, Persiaran Rimba Permai and the Futurise area. The company says this is the first time a Malaysian company has been authorised to run a fully driverless L4 vehicle on public roads with a valid plate — the production unit will carry a standard green JPJePlate, not the blue launch plate. Before this, the van ran a 6-month closed trial at the Pos Malaysia National Mail Centre in Shah Alam, logging over 1,000km of point-to-point pallet transfers across at least two daily shifts; the vehicle is cargo-only, built on Zelostech's Zelos Z10 EV with 10m³ of space, LiDAR and multiple cameras, and is overseen from an ALS Remote Operations Centre in Cyberjaya.

Why: The concrete thing to watch is not the van but the operating model: a 22km mixed-traffic route with MRT stations, pedestrian crossings and multi-lane intersections, supervised from a single Remote Operations Centre. If you are scoping any autonomy, delivery-robot or remote-supervision pilot in Malaysia, this trial plus the MyAV route is now the reference path — and the 6-month window means any commercial claims from ALS or partners should be treated as pending until mixed-traffic and remote-supervision results are published. For logistics founders, an authorised driverless cargo operator in Cyberjaya is a potential integration partner rather than a competitor yet; the 1,000km Shah Alam baseline is the only performance number disclosed so far.

OpenAI's engineering post describes ChatGPT's ad stack: a custom post-trained frontier LLM that uses tool calls to handle retrieval, ranking, relevance scoring, and auction pricing, with ads served from a separate service so they can't influence answer generation. Two design choices stand out — 'stateful ads sessions' that remember context across turns and across multiple conversations, and treating intent as something that builds over a conversation rather than a single query. OpenAI says ChatGPT Ads hit a $1 billion annualized revenue run rate under 200 days after launch, with more than 100,000 advertisers.

Why: This is the first detailed public description of ad delivery inside an agentic chat product, and the architectural pattern is directly copyable: a separate ads service, an LLM orchestrating retrieve/rank/relevance/auction via tool calls, and session state persisted across conversations. Two things to act on — if you build agents, note that OpenAI's monetization depends on long-lived cross-conversation memory, so decide deliberately whether your own agent retains that state; and if you run a SaaS, ChatGPT is now a 100k-advertiser channel with intent signals richer than keyword search, though the post says nothing about Malaysian or SEA availability or pricing, so verify before budgeting.

Latent Space interviews Tenex's Alex Lieberman and CJ Hess about scaling an AI-native SDLC: Tenex still ties engineering compensation partly to story points, has grown to 75 people serving Fortune 2000 and mid-market clients, and is shifting from an AI-powered dev shop toward company-wide AI transformation work. CJ describes MetaHarness—shared skills, project docs, and a CLI—with plans and decisions checked into Git so agents can read why code was built that way. The episode also cites a Kill My SaaS experiment where builders were asked to replace a speaker-management tool quoted at $43,000/year.

Why: If you bill by the hour while using agents, this episode gives a concrete alternative: price delivered outcomes and keep decision rationale in Git so agents see not just code but the reasoning behind it. The $43,000/year SaaS replacement prompt is a practical benchmark for asking whether your own tool stack is worth rebuilding with agents—or whether cheaper builds should change what you charge.

A leaked S-1 filing reported by WSJ says Anthropic is struggling to secure enough cloud capacity from AWS, Google, and Microsoft because those providers increasingly view it as a competitor, even as it estimates it could spend more than $750B on cloud contracts, including deals still under negotiation. The filing also reports an $80.7B net loss on $16.3B revenue in H1, with two customers accounting for about a fifth of sales, and warns AI-harm liability could exceed insurance; Anthropic reportedly told investors Q3 revenue hit $16.8B, up 45% QoQ, and is targeting a November IPO.

Why: If you build on Claude through a hyperscaler, treat capacity and commercial terms as a supply risk: the filing says Anthropic may lease third-party data centers with limited operating history because hyperscaler capacity is insufficient. For SaaS and AI teams, check whether your cloud credits, rate limits, or reseller terms depend on a single provider, and decide whether model/provider portability is worth building before access gets slower or more expensive.

On Friday 2 October at 09:35, 333 compromised Tor exit relays — roughly 10% of Tor's ~3000 exit relays — began a coordinated campaign to intercept SSH connections on port 22 and harvest unencrypted mail traffic. The servers had been breached two months earlier in August with an Ebury 1.8.3 payload (an OpenSSH backdoor and Linux credential stealer), and SSH sessions were silently redirected to one of 12 interception servers, which stole passwords, watched commands, and reinfected the connecting server. The author reported it to the Tor Project's network health team that evening; relays were marked BadExit on Sunday 4 October, and by Monday 5 October the attackers' restarted relays could only serve as middle relays before all infected servers were shut down.

Why: The concrete lesson is that the SSH "REMOTE HOST IDENTIFICATION HAS CHANGED" prompt is not a formality — in this campaign, accepting it handed over your password and pushed Ebury onto your own box. If any of your tooling or CI connects over Tor, or if you have StrictHostKeyChecking disabled or set to accept-new in scripts, you would have sailed straight through this without seeing the warning at all. Decide now how your team handles a changed host key: verify the fingerprint out-of-band (the intercepted ED25519 key here was SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E) rather than clicking yes.

Google DeepMind claims four Gemini 4 agents beat Minecraft in 27 hours by writing 2,783 of their own programs, with 605 deaths on Easy difficulty and an estimated $520 in token cost. The supplied text is a headline claim from Tom's Hardware and does not include methodology or independent verification.

Why: Use the 2,783 programs, 605 failures, and $520 token estimate as a concrete sanity check for agent design: a bounded game task still needed hundreds of retries, so budget for retry loops and verification before pointing program-writing agents at production workflows.

Microsoft has launched a security suite under Microsoft 365 E7 that includes Project Perception and Agent 365, aimed at monitoring internal AI agents that hold broad system access. The discovery layer reportedly identifies 60 local agent types — including Claude Code, OpenAI Codex and GitHub Copilot — and registers them centrally alongside Agent 365. The controls include Entra Agent ID (a separate digital identity per bot instead of borrowed employee credentials), sandboxing via Microsoft Execution Container, and Dynamic Permissions that start agents at zero authority and expire access when a task ends.

Why: The design pattern here is the takeaway, not the SKU: the article's core argument is that the model can't be its own security guard, so rules and kill switches must sit outside it. If your team points Claude Code, Codex or Copilot at corporate data, expect those agents to be inventoried by an admin registry — decide now whether each agent gets its own identity and task-scoped, auto-expiring permissions, or keeps sharing a human's credentials where you can't tell bot actions from employee actions. Note the article gives no pricing, licensing tier details, or Malaysia availability for M365 E7, so treat procurement impact as unresolved.

AnyLanguageModel 1.0 ships as a drop-in replacement for Apple's Foundation Models framework: you swap `import FoundationModels` for `import AnyLanguageModel` and the same session code runs against the on-device system model, open-weight models via llama.cpp/MLX/Core ML, or hosted providers. The release adds tool calling and guided generation (including nested @Generable types and arrays) across every provider, image prompts using Foundation Models 27 syntax on iOS/macOS/visionOS 27, and support for any model conforming to the LanguageModel protocol, including Core AI models. It lands alongside swift-huggingface 1.0 and swift-xet 1.0 for accelerated Hub model downloads, and the hosted list now covers OpenAI Chat Completions/Responses, Open Responses, Anthropic Messages with adaptive thinking, Gemini, Ollama, Private Cloud Compute on OS 27, and Hugging Face Inference Providers/OpenRouter via a custom base URL.

Why: If you maintain a Foundation Models codebase, the migration cost is one import line, and it buys you per-task model choice: local llama.cpp/MLX/Core ML by default, and the HF router (the post's example is `openai/gpt-oss-120b` via `router.huggingface.co/v1`) for models too large to run on-device, with tool calling, streaming, guided generation, and token usage working the same in both paths. The decision to make is whether to take a third-party abstraction over Apple's framework now, since provider-specific code you write today would otherwise need rewriting when you add Anthropic or Gemini.

Google and Xcel Energy have proposed a 780-megawatt AI data center in Minnesota that would add more wind, solar, and battery capacity than the facility is expected to use, with Google paying for the added capacity even if it does not consume all of it. Experts told CNBC that much of the grid buildout could be avoided and that utilities have a financial incentive to keep building. Surveys cited in the article found 71% of Americans opposed a local data center and about half said data centers would be mostly bad for the environment and household energy costs.

Why: For builders estimating AI or cloud costs, this is a concrete test of whether new AI load pays for additional clean generation or drives broader grid spending; the key contractual detail is Google's commitment to pay for unused capacity. If the utility-incentive critique holds, AI infrastructure costs and siting conflicts could rise, so treat 'clean add-on' claims in region or vendor choices as something to verify, not assume.

Inception launched Mercury 3, a diffusion-based LLM it says beats GPT-6 Luna and Claude Haiku 5.5 while running 4–8x faster at 1,068 tokens/sec, with 1M context and $0.20/$0.70 per 1M input/output tokens (50% off at launch). The company says it is over 40x larger than Mercury 1 and cites early partners using it for browser agents, tutoring, support, and data engineering; a production web-agent test completed 50% of 50 live Mind2Web tasks versus GPT-6.1-Sol. The HN thread has 226 points and 85 comments.

Why: If you run latency-sensitive agent loops or high-volume chat/tutoring, Mercury 3 is a concrete option to benchmark against GPT-6 Luna/Claude Haiku 5.5: 1,068 tok/s, 1M context, and launch pricing of $0.10/$0.35 per 1M input/output tokens. Do not migrate on Inception's vendor-run Mind2Web result alone; rerun a comparable 50-task navigation eval and compare token volume and per-task cost at your latency budget. There is no Malaysia/SEA-specific detail in the post.

MiniMax announced MiniMax M3.1 Flash, a next-generation "Flash" model it says makes online inference nearly 3x faster and cuts usage costs by 70% versus its prior version. The post reports self-run benchmark scores of 76.2 on BankerToolBench, 73.7% on DeepSWE v1.1, 61.7 on OSWorld V2, 29.6 on Agents' Last Exam, and 82% on CyberGym, and claims the model completes end-to-end enterprise workflows across SaaS systems (sales, marketing, ops, support, finance, HR). It also says an early version ran anonymously as "Space Bunny" and processed more than 200 trillion tokens before launch. All figures are MiniMax's own, with no independent replication or pricing table in the text.

Why: A 70% cost cut and ~3x faster inference on agentic workloads changes the unit economics of anything you run at volume — multi-step coding agents, computer-use loops, document-chaining workflows — so the practical move is to re-run your own eval set and cost-per-task math against your current model rather than trusting the vendor's BankerToolBench/DeepSWE numbers. For Malaysian teams paying USD for inference on thin SaaS margins, a cheaper Flash tier is worth benchmarking before your next pricing or quota decision, but treat the benchmark claims as unverified until you test them yourself.

Brooke Lacey, who has built a TikTok audience of more than 290,000, demonstrates a workflow where Claude Code drives FFmpeg and OpenAI's Whisper to turn a raw phone video into a captioned, jump-cut TikTok in roughly 15 seconds on her own computer. She describes teaching Claude her jump-cut cadence, hooks, and sense of what 'funny' sounds like, mining her TikTok comments for new scripts, and running a weekly short-form operation with no editor. The episode also covers where the workflow breaks — 'lane OS' and status files — and how she prompts Claude back on track.

Why: The reusable pattern here is not 'AI edits video' — it's wiring a coding-agent CLI to existing CLI tools (FFmpeg for cuts/captions, Whisper for transcription) so one prompt runs a full media batch job locally, with no per-seat editor subscription. The second transferable piece is codifying your style as instructions the agent re-reads (jump-cut cadence, hook format), plus status files to recover when the agent drifts — the same structure you'd want for any repeatable agent task, not just video.

CNBC reports that Apple, Amazon, Meta and a host of startups released AI-powered, always-listening devices this year, and unlike earlier wake-word smart speakers they record ambient life in new ways. In some US states, experts say the legal exposure may fall on the person wearing the device during a private conversation without required consent from bystanders. The piece opens with a Pittsburgh-based business owner wearing Meta camera glasses, a Fieldy note-taking pendant and an Amazon Bee wristband; after a bystander at a bar said he felt uncomfortable, the wearer took the device off completely.

Why: If you build or ship always-listening wearables, recording features, or agent devices, the article’s concrete warning is that in some US states the wearer may bear legal exposure when bystanders have not consented—so consent prompts, recording indicators, and clear device-off behavior become product requirements, not policy footnotes. There is no Malaysia-specific detail in the text, but local builders targeting US users or privacy-sensitive markets should treat jurisdiction-aware recording defaults as a design decision.

OpenCode, the open source coding agent, posted on X that it suffered a security breach "last night" tied to what it called a "large scale distillation attack," affecting 1.4% of OpenCode Console users, who were notified by email the following morning. The post says the incident is ongoing, that no further details can be shared yet, and that OpenCode is working with Anthropic, OpenAI, and Google to remediate. The tweet drew 21.7K views and the Hacker News thread drew 439 points and 78 comments, with replies openly asking what a "distillation attack" has to do with leaked credentials and whether affected users would be compensated.

Why: If you or your team run OpenCode Console, the only concrete facts are 1.4% of users affected, email notification sent, and remediation involving three model providers — so check your inbox and your OpenCode Console account, and rotate any Anthropic, OpenAI, or Google API keys that were reachable through that console rather than waiting for a fuller report. The wording matters for your decision: "distillation attack" usually describes model extraction, not credential theft, yet the providers named are the ones whose keys would leak, and the community replies show nobody outside OpenCode can currently tell which it was. Until a postmortem gives scope and timeline, treat this as an unresolved disclosure, not a closed incident. No Malaysia-specific angle is supported by the text.

Internal documents released in a court battle between Amazon and a Canadian union describe Atlas, an in-house AI forecasting tool that scores warehouses in the US, Canada and the UK from 100 to 900 for the likelihood of union activity, sit-ins or other 'disruptive labour events'. The documents say Atlas pulls 'hundreds of data points', including Reddit posts, employee responses to internal feedback surveys and records of past industrial action; lower scores mean workers are judged more likely to organise, and the training material states higher scores are 'better' for leadership. Garfield Hylton, a 62-year-old worker at Amazon's Coventry warehouse, told openDemocracy he knew his scanning and idle time were tracked but not that social media and internal bulletin posts were being monitored for dissent.

Why: If you build any scoring model over people — churn risk, engagement, sentiment, 'flight risk' — this is the disclosure scenario: an internal feedback survey and public Reddit posts become model inputs for a score whose direction is a management value judgement (here, higher = better for the company). Concretely, decide before shipping whether survey or community data you collect for one stated purpose is technically and contractually firewalled from any risk scoring, and whether your score's polarity is documented where users can see it. The 'hundreds of data points' claim also means anyone building HR or people-analytics tooling for SEA employers should expect this kind of discovery request as a realistic failure mode, not a hypothetical.

Meta released Muse Spark Open, which Nathan Lambert describes as now the strongest American-made open-weight model by a wide margin, landing above GLM 5.2 and near DeepSeek V4.1 Flash but behind GLM 5.3 and Kimi K3. Reflection's first model Beam also shipped, and Mistral announced Mistral Large 4 with an index score of 38 but has not released weights. Without Muse Spark Open and Beam, the article says 20+ Chinese open-weight models would outrank the best Western ones, and it estimates the US-China open-model gap has narrowed roughly by half.

Why: If you pick models for an agent or app today, the article's ranking gives you a concrete ordering to test against: Muse Spark Open sits above GLM 5.2 and near DeepSeek V4.1 Flash, but below GLM 5.3 and Kimi K3, so it is a viable default when you want Western licensing or provider support, not automatically the top performer. Also treat Mistral Large 4 as unshippable for now — its weights are not yet released — and do not assume the Chinese models Lambert names (GLM-5.3, Kimi K3) have been superseded just because newer Western releases are louder. The text says nothing about Malaysia or Southeast Asia, so any local cost, hosting, or data-residency implication is not supported here.

esp32sim is an MIT-licensed ESP32 emulator written in Rust that boots the real mask ROM, the real second-stage bootloader and an unmodified application image — no patched firmware or stubs — locally or in the browser via WASM. It covers four SoCs across both Espressif architectures: classic ESP32 (dual Xtensa LX6, ECO3 ROM, GPIO/UART/timers, plus a --board ttgo-tdisplay option adding the ST7789 and buttons), ESP32-S3 (2× LX7 @ 240 MHz, with ST7735, ST7701S 480×480 + touch, WS2812, camera and audio), and RISC-V ESP32-C3 / C6 @ 160 MHz. The repo reports full-listing decoder checks of 977k instructions with 0 mismatches on S3, 161k on C3 and 126k on C6, models WiFi as a virtual AP with WPA2, DHCP/DNS/NTP and NAT to the real network, and sits at 324 stars and 1,469 commits with 189 points and 39 comments on Hacker News.

Why: If you ship ESP32 firmware, this is a route to running unmodified app images in CI with no board farm, no cloud account and no subscription — the MIT licence removes the usual vendor lock-in. The catch is in the table: C3 and C6 are console-only with no display or peripheral models, so anything with a screen, camera or sensor still needs real hardware; S3 is the only one with the richer board set. For teams that currently order boards before they can test, browser-first emulation shortens the loop before any import or shipping cost is committed.

At TechCrunch Disrupt, Benchmark partners said the unwritten VC rule against backing direct rivals can no longer be counted on as the AI boom strains it. The article cites Factory firing board observer/adviser Chris Degnan over “unethical conduct involving Cognition,” its direct rival and maker of Devin; Degnan said he had already resigned, denied sharing confidential information, and then announced he was joining Cognition as chief revenue officer. Vinod Khosla sided with Degnan on X and called Factory “a struggling second tier competitor,” while Benchmark’s Eric Vishria said conflicts are now a necessity because companies evolve quickly and downplayed what a VC could pass along, saying “We are not product or technology experts.”

Why: For founders raising in AI/agent tooling, the practical change is that an investor’s other portfolio companies are now a diligence item: ask what board observers/advisers can see, how conflicts are walled off, and whether the firm backs a direct competitor. The Factory–Cognition episode shows the risk is not theoretical—confidential board-level discussions and hiring can collide—so if you are building a coding agent or SaaS with overlapping AI roadmaps, document access controls before giving observer rights.

Nick Cammarata of Goodfire published an essay arguing that "Neural Networks Are Already Clean" — that known cases of polysemanticity and superposition, where single neurons respond to many unrelated inputs, dissolve under further agentic analysis rather than needing a second model to "unfold" them. The headline claim circulating is that roughly 90% of neurons in Qwen-32B have one job. The item itself is a Latent Space AINews roundup post that quotes the essay and reaction tweets (one thread at 135K views, another at 319K views and 5.76K likes) rather than the underlying method or data. The same roundup notes a weaker-than-expected Muse Spark Open release and a Tesla Roadster demo.

Why: If the 90%-of-neurons-in-Qwen-32B claim holds up, the practical shift is that you can inspect an open model's neurons directly with an agent loop instead of first training or applying a separate sparse-autoencoder-style unfolding step — which would make cheap interpretability passes on models you actually self-host (Qwen-32B being a common local choice) plausible. But this item gives you no method, no benchmark table, and no link to the essay's evidence, so treat it as a claim to reproduce, not a tool to adopt this week. Nothing here changes anything for Malaysian builders specifically.

Google announced changes to its AI-powered search results that push contextual website links higher and make them more prominent, expanding its link "carousel" feature globally and giving preference to articles from users' preferred sources. The move comes as news publishers report referral traffic declines of around 40 percent. The article, carried by Malay Mail Tech, does not detail the exact mechanics, rollout dates, or which markets or publishers were measured.

Why: If you run a content-led site, newsletter, or SaaS that depends on Google referral traffic, the number to act on is the ~40% drop publishers are reporting, not the promise of more prominent links. That means tracking your own organic referral share as a metric you watch weekly, and testing at least one non-Google acquisition channel, rather than assuming the carousel expansion restores lost clicks. The article does not quantify how much traffic the link changes actually return, so treat the 40% figure as publisher-reported, not as a guaranteed baseline for your site.