AI Weekly Malaysia

Block's research lab released a voice model called Dessa, announced by Jack Dorsey on October 23, 2026, which the company says runs locally and was trained entirely on human speech using a single NVIDIA GPU. Dessa is full-duplex — it listens and speaks at the same time — matching the approach of OpenAI's GPT-Live, and Block claims emotion is baked into the model rather than driven by voice tags like ElevenLabs v4 or Fish Audio Drama 3. Block also says Dessa's knowledge comes only from its conversational training data, not from a paired LLM, and the article gives no benchmarks, latency numbers, license, weights availability, or release date.

Why: The interesting claim is architectural: no ASR-to-text-to-TTS pipeline, so prosody and pauses survive instead of being flattened into text. But nothing here tells you whether you can actually use it — no weights, license, latency, or hardware specs beyond 'a single NVIDIA GPU'. Until those exist, treat Dessa as a demo to watch, not a component to plan around; if you're building voice agents today, your decision is still between tag-driven TTS and full-duplex APIs that ship with real docs.

Kimi 3.1 Pro is described as a 2.8T-parameter open-weights model, a post-trained version of Kimi K3 with substantially more post-training compute and joint RL across hundreds of downstream domains. The post claims it beats Fable 5.1 and that a Pro Highspeed API runs 2-3x faster, but Latent Space notes that little research detail is provided.

Why: Teams choosing an LLM API should treat the 'beats Fable 5.1' claim as unverified—the post admits little research detail—and instead test the Pro Highspeed API on their own agent workloads for latency and cost before migrating.

The Hacker News reports (23 Oct 2026) that researchers demonstrated an exploit dubbed "Node2Shell" achieving remote code execution against a Node.js build by feeding it crafted Brotli-compressed data. The excerpt available here is almost entirely site navigation and contains no CVE identifier, affected Node.js versions, disclosure timeline, patch status, or technical root-cause detail. Treat the headline claim as unverified in this text: nothing concrete is provided about how the Brotli payload reaches the vulnerable path or which configurations are exposed.

Why: Node.js is the default runtime for most JavaScript tooling, CLIs and web backends in this community, so a claimed RCE in the runtime itself is worth 15 minutes of attention — but you cannot act on this excerpt. Concretely: before changing anything, go find the primary source (the researchers' write-up or the Node.js security release notes) and check the specific version numbers and whether the exploit requires the app to decompress attacker-supplied Brotli bodies (e.g. HTTP Content-Encoding: br handling). Until those details exist, do not treat this headline as a reason to rewrite code, and do not assume "we never accept Brotli from clients" is a safe position if your stack is a proxy/CDN or a CLI that ingests compressed archives.

Hugging Face published a Space that checks whether a given Transformers model runs unmodified on AWS Trainium via torch-neuronx, the native PyTorch backend. Each result row reports the number of Trainium cores the model is sharded over, wall time including compilation, and peak device memory on a trn2 instance, plus the exact run.py script, Neuron stack, and neuronx-cc/Transformers versions used. Coverage is currently limited to text-generation and image-text-to-text Transformers models, with diffusers and sentence-transformers planned; "runs" means the model loads, shards (tensor parallel, or expert parallel for MoE without a TP plan), and generates 32 tokens.

Why: If you are costing out inference for a text-generation or image-text-to-text model, look the model up here before budgeting GPU capacity: the Space gives you Trainium core count, wall time with compilation, and peak memory for a trn2 run, and if it is listed you can skip the first-run compile by syncing the prebuilt graphs with `hf buckets sync hf://buckets/aws-neuron/torch-neuronx-neff-cache/neuronxcc-<version>` using the matching compiler version. Treat a green result as "loads and emits 32 tokens", not as a throughput benchmark — you still need your own numbers before migrating a production workload.

At TechCrunch Disrupt, Lovable GTM lead Luke Arno, Polsia's Ben Broca, and Theory Ventures' Tomasz Tunguz discussed the first 90 days after a startup launches a sellable product. Arno said founders should not treat early fast revenue as proof they are ready to scale: if 10 customers arrive through 10 different motions solving 10 different problems, there is no repeatable go-to-market; three customers acquired through a similar motion for a similar problem gives more confidence. Broca said product-market fit is especially hard now because products can be copied easily.

Why: For founders, use Arno's 3-similar-customers versus 10-different-ways test before hiring a sales team or scaling spend after launch; early ARR alone is not evidence of a repeatable GTM motion.

Microsoft published a Science study claiming its MAI-DxO system, a multi-agent panel that questions patients, orders tests, and debates diagnoses, was correct on 83% of complex NEJM simulation cases versus 36% for primary care doctors and general internists working individually. The comparison excluded specialists and physician teams, and Microsoft says its best results came with OpenAI’s GPT-5 and GPT-5.5 after testing models from OpenAI, Google, Anthropic, Meta, and DeepSeek; it also measured estimated cost per case.

Why: For agent builders, the concrete takeaway is that orchestration added gains on top of stronger base models, but the 83% vs 36% headline is not a specialist-level benchmark. If you build or pitch healthtech agents, compare against physician teams and disclose cost per case instead of repeating the vendor framing.

METR and Redwood Research conducted a July 21–Aug. 11, 2026 pilot review of an OpenAI internal monitoring system, with one employee from each nonprofit getting access to OpenAI's internal codebase, documentation, and some technical staff. They were chaperoned on site and used OpenAI-issued devices that never left the premises, and they found several 'novel vulnerabilities'; the excerpt cuts off before naming them or giving severity/remediation. The pilot follows Sam Altman's September pledge to give independent evaluators 'employee-like access' amid safety concerns.

Why: If you build on OpenAI models or agents, this is a concrete precedent for external safety access—codebase, docs, and staff—but not an actionable vulnerability report: no affected component, severity, or fix is disclosed here. The practical decision is to ask OpenAI-dependent vendors whether third-party monitoring evaluations are part of their assurance, rather than changing deployments based on this excerpt alone.

Ai2 released OlmoEarth v1.3, a satellite embedding model that turns a year of Sentinel-1 radar plus Sentinel-2 and Landsat multispectral time series into one 128-dimensional vector per 10-meter pixel, with a 64-dimensional version also usable. Ai2 precomputed annual embeddings for the entire planet and published them on Source Cooperative, alongside a no-sign-in browser Embeddings Explorer for exploring and customizing maps. Across 27 evaluations on six continents against AlphaEarth Foundations and Tessera v2, the 128-dim embeddings ranked highest on 20 of 27 evals and the 64-dim version on 18 of 27; the release also introduces PLANTEUR, a tropical crop-type benchmark.

Why: If you work on agriculture, land-cover, flood, or urban-change mapping in Malaysia or Southeast Asia, the expensive part — global 10m embeddings — is now precomputed and free to reuse. You can download the vectors and train a small classifier locally instead of fine-tuning a model with GPU access and storing raw imagery; the new PLANTEUR benchmark is specifically aimed at tropical farming, so it is worth testing the 64-dim embeddings first for a lightweight prototype before committing to a full imagery pipeline.

A project called HackiOS (by OOSEX GANG) boots Apple's open-source XNU kernel — xnu-8796.121.2, the kernel from iOS 16.5 — on Android phone hardware and runs the unmodified iOS 16.5 user space on top: launchd → backboardd → SpringBoard → apps. It targets a POCO X5 Pro 5G (Snapdragon 778G), where the UEFI is launched via `fastboot boot` and the whole system lives in RAM, so a reboot returns the phone to Android, and it also runs under QEMU aarch64 on any Linux machine. The repo contains XNU patches, an EFI loader, a UEFI port, a Linux Wi-Fi driver on a compatibility layer, and QEMU scripts; the companion repo holds init, injected libraries, and the APFS image builder. Working: lock screen, home screen, gestures, Settings/Clock/Calendar/Photos/Notes/Safari. Not working: cellular, Bluetooth, and charging under their kernel.

Why: The reusable trick here isn't iOS-on-Android — it's the deployment method: a UEFI image pushed with `fastboot boot`, running entirely from RAM, leaving the device untouched after reboot. If you do mobile or embedded work, that's a low-risk pattern for testing alternative kernels on a daily-driver phone without flashing or wiping it. Treat the iOS part as a demo, not a usable OS: no cellular, no Bluetooth, and the phone only discharges while running it.

At TechCrunch Disrupt, three investors — Shailendra Singh (Peak XV), Jahanvi Sardana (Index Ventures) and Jenelle Teng Wade (Bessemer) — described a Series A market Singh called 'never... as dysfunctional as it is now,' with a correction possibly arriving as soon as 2027. Concrete symptoms they named: startups closing a single round at as many as three different prices at once, and rounds split into tranches, which Sardana dubbed 'tranchopalooza.' Teng Wade said capital is flowing into defense, robotics and AI infrastructure, with foundation-model companies vertically integrating but room remaining for 'neo-clouds' renting out AI compute and 'neo-labs' doing AI research; the excerpt cuts off mid-sentence on metrics.

Why: If you plan to raise within the next year, price your round for tranching: the panel says multiple prices per round are now normal, so decide in advance whether you'll accept a lower first-tranche valuation with milestone-linked follow-on, and how a possible 2027 correction affects your runway plan before you sign. It also tells you which pitch framing these firms currently fund — AI compute/neo-cloud and neo-lab positioning — versus generic SaaS. The piece gives no revenue multiples, check sizes or Malaysia/Southeast Asia-specific data, so it can't be used to benchmark a local raise.

Anekha Sokhal, CEO of Moshi, describes building a recommendation engine for traders that combines market data, an interface, and tailored recommendations — framed as 'Bloomberg, Claude and Netflix had a baby.' The conversation covers her path from mathematics and JPMorgan energy derivatives to founding Moshi, plus build-vs-buy decisions for models and document extraction (she cites Reducto) and the pressure on AI engineers told 'you are the team.' She also notes extending her New York stay to take customer meetings in energy and Houston before hiring.

Why: If you are a solo AI engineer or small founding team, the concrete decision here is what to buy versus build: Moshi uses Reducto for document extraction rather than building it, and Sokhal prioritizes booking customer meetings over hiring. The 'you are the team' framing is a useful prompt to decide which infrastructure you should not rebuild yourself.

Bloomberg reported that DeepSeek raised about $15 billion (~100 billion yuan) — one of China's largest funding rounds — just two days after the U.S. ordered federal civilian agencies to remove its AI technology over security concerns, with potential investors including CATL and Tencent. The round follows a June raise of more than $7 billion at a $50 billion valuation and a reported July push for $1.5 billion at roughly $71 billion, with a potential China IPO as early as next year. DeepSeek, founded in 2023 by Liang Wenfeng (who previously co-founded High-Flyer), says it is ramping up spend on AI infrastructure and open models for domestic and international markets.

Why: The same week DeepSeek's models get pulled from U.S. federal civilian systems, it reportedly gains a $15B war chest for open models and infrastructure — meaning the open-weight models you build on likely keep getting cheaper and more capable, while enterprise or government customers exposed to U.S. procurement rules may start asking you to document which model vendor you depend on. If you ship on DeepSeek weights, decide now whether you need a documented fallback provider and a model-swap path before a deal or tender stalls on provenance questions.

Malaysia’s National Security Council (MKN) said on 22 Oct 2026 that civil servants using Waze for official duties will face disciplinary action, while Google Maps stays allowed because Waze Mobile Ltd is under Israeli jurisdiction and Google Maps is under US law. The public is not under a blanket ban, but MKN is encouraging Malaysians to uninstall Waze, citing granular location telemetry; Waze has rejected the security-risk claims.

Why: If you build or procure location-based tools for Malaysian government work, map-provider choice is now a compliance decision: Waze is out for official duties, Google Maps is still in, and the split is based on data-controller jurisdiction rather than technical risk. For founders selling into the public sector, expect security and procurement questions about where your location data is legally governed.

A Hacker News thread with 333 points and 120 comments is circulating around CVE-2026-111943, titled 'Compromised Intermediate Certificate Authority', pointing at the NVD entry. The excerpt available here is title-only: it does not name the affected certificate authority, the relying parties, the trust stores or platforms impacted, the disclosure timeline, or any remediation. Nothing beyond the CVE identifier, the title, the NVD source, and the 2026-10-22 timestamp can be confirmed from this text.

Why: You cannot act on this from the text provided — there is no named CA, no affected-software list, and no fix, so treat the title as a lead to verify, not a finding. The one usable signal is the discussion volume: 120 comments on a bare CVE link suggests practitioners are trading specifics in the thread that the NVD excerpt does not contain. If you maintain a service that terminates TLS or ships a trust store, the concrete action this week is to open the HN thread and the NVD entry directly and look for the named intermediate and any vendor advisory before deciding whether your chain of trust is affected.

Sammy Hajhamid published ns2jb, a software-only, tethered jailbreak for the Switch 2 on firmware 23.0.1, using a WebKit n-day loaded via a custom Wi-Fi captive portal to get native code execution as sysmodules. The rig uses JetKVMs for controller input and HDMI capture, plus a Bluetooth light switch to press the power button after crashes. The author says the jailbreak took about two weeks of substantial effort, while a Mario Kart World character mod was 'entirely vibecoded in a day.'

Why: If you use coding agents for hardware or security work, this draws a concrete line: the author says the exploit took ~2 weeks, while the game mod was vibecoded in a day—so budget agent time for glue and prototyping, not for finding a WebKit escape around PAC/XOM. The JetKVM plus Bluetooth power-button harness is also a cheap pattern for unattended device reboot loops.

IBM Research published a Granite Timeseries Ensemble recipe on Hugging Face that combines four Granite time-series models behind one interface and returns point plus quantile forecasts, with no retraining and no fitted ensemble weights. You use it via `pip install "granite-tsfm>=0.3.11"` and `QuantileEnsembleForecaster.from_pretrained("ibm-granite/granite-timeseries-ensemble-r1")`, with the demo running context_length 1024 and prediction_length 24 on the ETTh1 dataset. Two variants are offered: a default Probabilistic Ensemble using uniform probability pooling, and an adaptive IQR Ensemble; the recipe stores only the ensemble configuration, so the four member checkpoints are downloaded at runtime on first run.

Why: If you're shipping forecasting into a product, this gives you a permissively licensed default that removes the 'which model do I pick' step for smooth industrial signals, noisy retail demand, and long seasonal horizons alike. The practical catch is stated in the post itself: because the recipe holds configuration rather than merged weights, your first invocation pulls four checkpoints, so budget for that in cold-start, serverless, or CI environments rather than assuming a single small download. The text contains no Malaysian or Southeast Asian angle, so treat this purely as a tooling decision.

Google, Temasek and Bain's e-Conomy SEA report says generative AI adoption in Southeast Asia reached about 243 million users in under three years — 58% of the working population — with adoption occurring four times faster than [text truncated]. The report also says only a small fraction of the region's population pays for personal AI subscriptions, while Bain partner Florian Hoppe told CNBC that businesses are generating AI commercial value through applications ranging from e-commerce to digital advertising.

Why: For builders targeting Southeast Asia, this points to business and embedded AI use cases as a clearer monetization path than consumer subscription conversion: if your plan assumes many users will pay monthly, test B2B or workflow-specific value first. It is regional macro data, not a Malaysia-specific policy or product change.

Google published its internal Rust Style Guide as part of the Google Style Guides, and it goes well past formatting: code organization (prefer small crates, flat file layout for rust_library sources, no glob imports), ownership (avoid Rc and Arc, prefer borrows over deep copies), API design (accept Into, prefer enum over bool, #[non_exhaustive] on public enums and public-field structs), error handling, traits, macros and naming. Some rules are explicitly scoped to Google codebases — no async/.await and no std-library threads in [chrome], fuchsia_sync::Mutex for [Fuchsia] — and the implementation section pushes expect over unwrap and warns against panic::catch_unwind and long iterator-combinator chains. It drew 382 points and 249 comments on Hacker News.

Why: This is a concrete, opinionated rulebook you can diff against your own lints rather than a general 'best practices' post: the enforceable ones are things like expect over unwrap, no glob imports, one module per use statement, #[must_use] and #[non_exhaustive] on public types, and no code before main(). Copy the rules that are context-free, but skip the Chrome/Fuchsia-tagged ones — banning async/.await and std threads is a Google-runtime constraint, not a default for a normal service or CLI. There is no Malaysian or SEA angle in this item; its value here is purely code-review and lint-config hygiene for teams shipping Rust.

NVIDIA's Hugging Face post introduces Kumo Relational, a pre-trained relational foundation model that makes predictions directly on enterprise databases using up to 10,000 historical examples as context in a single forward pass, with no task-specific training, feature engineering, or table flattening. NVIDIA claims it is the first few-shot foundation model to outperform supervised ML on common relational benchmarks: across 41 tasks on 15 databases it beats supervised relational deep learning and expert-engineered gradient-boosted tree pipelines, and on SAP SALT it surpasses AutoGluon ensembles by 8% MRR. It is available through NVIDIA's open-source GPU-native structured-data-models library or as an NVIDIA NIM, and the post says it scales to databases with 500B+ rows.

Why: If you maintain XGBoost or feature-engineering pipelines for churn, fraud, or demand prediction, this is a concrete prompt to benchmark a no-training relational model against your existing baseline, especially given the claimed 4 AUROC point gain on RelBench V1 classification and 7-13 MRR point gains versus XGBoost on SAP SALT. Do not replace production pipelines from a vendor post alone; reproduce the 41-task/15-database result on your own schema and check GPU, NIM, and licensing costs first. There is no Malaysia-specific detail in the text, so the impact is limited to teams already doing relational predictive modeling.

Dennis Crowley, Foursquare's co-founder and former CEO, wrote a blog post saying investors received no returns from Infillion's acquisition of the location-data platform last month at an undisclosed price, citing an angel investor's post to infer that neither preferred nor common stockholders got value. Foursquare had raised over $411 million per PitchBook, ran consecutive years above $100 million in revenue after pivoting to enterprise, brought in a private equity firm in 2019, and installed the banker who led that raise as CEO in 2021; the consumer app shut down in 2024. Crowley blamed the outcome on that management transition and apologized to roughly 1,600 former employees over 17 years.

Why: This is a concrete case of an acquisition that reportedly paid nothing to equity holders even after a business hit $100M+ revenue years, which is the scenario anyone accepting startup options should model: ask for the liquidation preference stack and run the payout waterfall at a low exit price, not just the headline valuation. If you are hiring or being hired in Malaysia or elsewhere with equity as part of comp, treat 'acquired' as meaningless until you know where common stock sits behind preferred and any PE liquidation preference.

Techdirt's Mike Masnick writes that the No Kings Instagram account was suspended for about an hour during a get-out-the-early-vote protest push, with admin access locked out for a few more hours; Reuters reported Meta apologized. The article uses the incident to argue that movements and builders should not rely on rented social platforms for critical distribution. The Hacker News thread drew 449 points and 411 comments.

Why: If your startup or community uses Instagram/Meta as a primary announcement channel, this is a concrete reminder that admins can lose access for hours even when a suspension is later reversed. Decide now which critical updates need an owned channel and whether you have backup admin/export procedures.

A Nielsen survey of 1,700 directors and senior managers across seven countries, commissioned by Monday.com, found that more than half say AI makes it harder to evaluate employees' work because output arrives already polished. Nearly half say they spend more time reviewing and guiding output, while 94% are excited about AI and 78% have changed how they evaluate staff—weighting prompt-writing, task delegation to AI, and experimentation. Michal Miller Levi, head of market research and customer insights at Monday.com, said AI is moving faster than organizational processes can adapt.

Why: If your team uses AI to draft code, docs, or plans, decide now what evidence reviewers need—tests, commit history, decision notes, or prompt logs—because the survey says over half of managers struggle to judge AI-polished work and nearly half spend more time reviewing it. Performance criteria are already shifting: 78% of surveyed managers now weigh prompt-writing and AI delegation, so builders should treat those as explicit skills rather than hidden workflow.

Cloudflare has a beta edge implementation of WebMCP, Google's experimental browser standard that exposes structured tools like search_products to AI agents instead of forcing them to scrape HTML and guess at buttons. Commerce.com, which runs almost 100,000 domains on Cloudflare, is turning WebMCP on across all its storefronts at once with per-merchant edge opt-outs, so agents can search products, build carts, and get checkout links without merchants editing themes. WebMCP is still behind Chrome flags and Origin Trials and works alongside server-side MCP.

Why: If you run a commerce platform or many storefronts, the concrete pattern here is platform-wide edge injection plus per-merchant opt-outs, not asking every merchant to edit a theme. But because WebMCP is still behind chrome://flags/#enable-webmcp-testing and Origin Trials, prototype the agent-tool contract now rather than treating it as a production requirement.

OpenAI announced a partnership with Google Cloud to put its frontier models and Codex agentic workflows into Google Cloud's Model Garden, purchased through the Google Cloud Marketplace. Enterprises with existing GCP spend commitments can draw down those commitments for the OpenAI purchases, and the post says OpenAI models will "soon" be available in Google Antigravity and the Gemini Agent. The announcement names no specific models, versions, prices, or a concrete availability date.

Why: If your team already carries a committed Google Cloud spend, this is a procurement change: OpenAI model and Codex usage can potentially be billed against that commitment via Marketplace instead of a separate OpenAI contract, which affects budget planning and vendor consolidation. Because no pricing or GA date is given, treat it as a line item to re-check before your next cloud commitment renewal rather than something to architect around now.

OpenAI is rolling out Locked Chats in ChatGPT, which moves selected conversations out of the sidebar history and in-app search into a folder whose titles stay hidden until you authenticate. Unlocking uses a four-digit account PIN on web, macOS and Windows, or Face ID / Touch ID / device passcode on iOS and Android; the vault re-locks on page refresh, tab close or window switch on desktop, and after 60 seconds in the background on mobile. Locked sessions get isolated memory and separate file storage so new details don't bleed into normal chats, but OpenAI states this is device-level screen protection, not end-to-end encryption — standard data retention rules and model training preferences are unchanged, and resetting a forgotten PIN permanently wipes every locked conversation, attachment and isolated memory with no support recovery.

Why: If your team treats Locked Chats as a confidentiality control for client work, contracts or personal data, that assumption is wrong on two counts: OpenAI says retention rules and training preferences are unchanged, and the only recovery path for a lost PIN is total deletion of the vault. Decide explicitly whether sensitive client material is allowed in ChatGPT at all, and if it is, make sure the four-digit PIN isn't the single point of failure for conversations you may need later — the wipe is unrecoverable by support.