AI Weekly Malaysia

In a 882-word post (created Sep 26, updated Sep 28, 2026), Simon Späti argues the real problem with AI-generated code is not code quality but that teams no longer know their system architecture or the intent behind past decisions. He quotes a developer half a month into a role at a big company saying specs, code, tests, PRDs, tickets and ticket resolutions are all made by Claude Code, that engineers from L1 to L7 do the same thing, and that people work 12-13 hours a day "just to press enter" while nobody reads anything. He also quotes Hoyt Emerson arguing data engineers are different because they had to learn the product and business from day one, and Sean Behan on product managers now being able to build what they want. The Hacker News thread drew 255 points and 169 comments.

Why: The post's own framing is that AI lifts a below-average codebase up to average, so the thing you lose is not quality but the ability to answer "why is it built this way" — the quoted engineer's complaint is specifically that nobody gets time to read the code being shipped. If your team runs agents over tickets, decide now who owns architectural intent and require a short human-written rationale on non-trivial changes before merge; otherwise the first person to leave takes the only copy of the reasoning with them.

Peter Vijeh fine-tuned a small GLiNER named-entity model to extract brands, models and steels from knife comments across six subreddits (r/knives, r/knifeclub, r/chefknives, r/japaneseknives, r/FixedBladeEdc, r/KnifeSteels), then asked who does the recommending in 'what should I buy' threads. The headline finding: one chef's-knife brand gets 31% of its buying-thread mentions from 5% of the accounts, four times what chance would predict. He says the buying-thread numbers can be recomputed from the published data with one script, but the account-history comparison cannot, because it rests on usernames he will not publish; the post drew 276 points and 359 comments on Hacker News.

Why: If you use the 'append reddit to a Google search' trick for product or tooling research — or if your growth plan is seeding Reddit comments — this gives you a concrete number to reason about: one brand taking 31% of recommendation mentions from 5% of accounts. Note what you can and cannot verify: the 4x concentration is recomputable from the published data, the account-history evidence is not, so treat the second claim as unverified and the first as a measurable pattern you could run on your own category. Vijeh also states the post was drafted with AI from his outline and run logs before editing, which is worth knowing when you weigh the prose against the code.

Four months after VoidZero joined Cloudflare, the team reports 80+ releases and 1,200+ closed issues across Vite, Vitest, Rolldown, Oxc, Oxlint and Vite+, and restates the commitment that all five stay open source, vendor-agnostic and community-driven. Concrete ships include the Oxc React Compiler (August, claimed 10x faster React compiles), Vitest 5 (September, up to 50% faster than Vitest 4), a stable tsgolint claimed up to 18x faster than ESLint on large codebases, Rust rewrites of Oxfmt's JSON/CSS/SCSS/Less/GraphQL/YAML formatters claimed 7x faster than Prettier, and Vite+ reaching 1.0. A new 'Bundled Dev' mode (formerly Full Bundle Mode) is in progress, developed against very large apps including Cloudflare's own dashboard.

Why: The claims are specific and testable, so the decision is whether to migrate rather than whether to read: if you run ESLint on a large TypeScript codebase, tsgolint is now stable and is the single biggest claimed win (up to 18x); if you are on Vitest 4, Vitest 5 is a same-API upgrade claimed at up to 50% faster. All numbers come from the vendor's own post, not third-party benchmarks, so time one representative CI run on your repo before committing. Vite+ at 1.0 is the one to watch if you want a single defaulted toolchain instead of assembling Oxc/Rolldown/Vite yourself.

ThreatDown disclosed a botnet called Carbonato that breaks into Docker daemons exposed without authentication on port 2375, launches a privileged container, and installs the open-source Hermes Agent framework unchanged - except for overwriting its 39-line SOUL.md persona file with a prompt telling the agent to run tasks sent over Telegram, maintain persistence, and harvest credentials. The implant establishes a reverse SSH tunnel to a relay in Costa Rica, installs an SSH server with the operators' key, reports new deployments back through Telegram, persists via cron, and rescans neighbouring networks every five minutes. Researchers found the operation through an unauthenticated Docker registry that had been publicly accessible since May 2026; the staged data also included a separate campaign pushing trojanized cryptocurrency wallet apps.

Why: The attack does not exploit a flaw in Hermes Agent - it uses the framework as intended, only swapping the persona file, which means any agent stack you deploy with a writable persona/config file and a chat-platform command channel is a ready-made C2 client. Concretely: if any Docker host you run binds 2375 without auth (common on self-hosted VPS and home-lab boxes that also run agent tooling), it is worm-reachable, and the first thing the persona prioritises is AI API keys and other credentials - so rotate keys and check for a privileged container, a reverse SSH tunnel, and unexpected cron entries before assuming you are clean.

Microsoft, tracking the actor as Storm-3168, reports that JADEPUFFER-linked attackers used two compromised service principals in a single Azure tenant to run destructive operations over about 18 hours in early June 2026, deleting Azure Storage Accounts, SQL databases, Key Vaults, Function Apps, recovery protection locks, Virtual Machines, and App Services. JADEPUFFER was first documented by Sysdig as the first ransomware operation run end-to-end with an LLM, entering through a known Langflow flaw (CVE-2025-3248), and the same Langflow instance was later hit again with ENCFORGE, a Go-based strain that scans roughly 180 file extensions covering model checkpoints, vector databases, training datasets, and embedding indices, plus macOS Keychain stores, Xcode project files, and Apple Pages and Numbers documents.

Why: Three concrete decisions: patch Langflow for CVE-2025-3248 if you self-host it, because that was the documented entry point. Don't assume Azure-native recovery saves you here, since recovery protection locks were among the deleted resources, so keep copies of vector databases, model checkpoints, and training datasets outside the subscription that runs them. And inventory your service principals and what each one can delete, because the access in this incident came from service principals in one tenant, not from user accounts.

Simon Willison re-ran a two-year-old GPT-4o experiment (originally posted by Colin Frasier on Bluesky) on local hardware, testing whether `Qwen3.8-27B-Q4_K_M.gguf` on a DGX Spark could add positive integers and return exact results only in English words. With reasoning disabled across 5,070 cases it hit 23.57% numeric accuracy, falling from 97.04% on one-to-three-digit operands to 6.44% on ten-to-thirteen-digit operands, even though format compliance was 96.17%. A paired 169-case run with medium reasoning enabled got 167/169 correct one-shot, with visible carry-by-carry traces in the report.

Why: If you deploy a local quantized model with reasoning turned off to save latency, this is a direct measurement of the cost: 23.57% accuracy on word-form arithmetic versus 167/169 with reasoning on, on the same 27B Q4_K_M weights. The more dangerous number is the 96.17% format compliance — the model still emits well-formed English answers when it is wrong, so validating output shape is not validating output correctness. Anyone piping local-model output into anything that acts on numbers should add a real correctness check, or leave reasoning enabled for those paths and budget the extra latency (Willison notes the reasoning run took much longer per pair, which is why he dropped from 30 samples per cell to one).

Vincent Bernat documents a self-hosted HTTP tunnel using only OpenSSH and nginx: `ssh -R 0:localhost:8080 server` allocates a free remote port, and an nginx regex `p(\d\d\d\d\d).ssh.luffy.cx` proxies to `127.0.0.1:$port`. It uses wildcard DNS for `*.ssh.luffy.cx`, Let’s Encrypt DNS-01 via a Route 53 zone, and `ngx_http_secure_link_module` with an MD5 hash plus expiry in the URL username; the allocated port alone has only ~14.785 bits of entropy. The Hacker News thread has 165 points and 34 comments.

Why: If you want an ngrok or Cloudflare Quick Tunnel alternative you control, this gives a concrete OpenSSH+nginx pattern and shows the security tradeoff: the remote port is not a secret, so you need an extra expiring token. Decide whether wildcard DNS, ACME DNS-01, nginx regex, and a weak MD5-based link are worth it versus using managed tunnels for quick localhost previews.

Google paused its Open Source Software Vulnerability Rewards Program as of October 1, with a promised update in Q1 2027, citing a "significant rise in automated submissions, the vast majority of which are not valid." According to Tom's Hardware, Google engineers and open source maintainers were overwhelmed by reports that were invalid or contained hallucinations, and TechCrunch notes prior warnings from cybersecurity experts that AI slop posed a risk to bug bounty programs. Participants are pointed to Google's other bug bounty programs in the meantime.

Why: If you maintain open source code or triage inbound reports, this is a concrete data point that AI-generated submissions can overwhelm a review pipeline badly enough to shut down a paid program for two quarters — plan for verification-first intake (reproduction steps, rate limits, human screening) rather than trusting volume. If you file findings against Google's open source projects, the OSS VR Program pays nothing until at least Q1 2027, so route them to Google's other bounty programs instead. Builders shipping agentic security scanners should treat validity filtering, not scanning, as the hard part.

Strata is an open-source, one-click inference engine (GitHub Niko1221/Strata, 10.2k stars, 902 forks, 845 commits) that runs the 125B-parameter Qwen3.8-Flash-Next on consumer GPUs with 12GB+ VRAM on Windows or Linux, exposing an OpenAI/Anthropic-compatible API on localhost with optional image input. Its own benchmark table shows Q2_0 hitting 94 tok/s generation and 2,650 tok/s prompt processing on an RTX 5070 12GB / Ryzen 5 7600 / 64GB RAM, and 60 / 1,160 tok/s on an RX 9070 XT 16GB / Ryzen 9 3900X / 47GB RAM, with quality dropping down the quantization ladder (IQ3_S: 53 / 1,620 tok/s). The Hacker News thread drew 265 points and 134 comments.

Why: If you pay per-token for coding agents or chat, a localhost OpenAI-compatible endpoint on a 12GB card is worth a test — but the submission title claims '100T/s' and an RTX 4090, while the repo's own numbers top out at 94 tok/s on an RTX 5070, so treat the headline as unverified. Everything here is 2-bit-class quantization (Q2_0, IQ2_XS, IQ3_XXS, IQ3_S), so benchmark your actual coding tasks against a hosted model before pointing a production agent at it; the speed cost of stepping up to IQ3_S is roughly 40 tok/s, which is the real tradeoff to decide on.

A free browser-based GTA-style game set on the streets of Taipei, described as vibe-coded and AI-generated, reached 1.2 million concurrent players within three days. Tom's Hardware reports the build cost was $10,000 in AI tokens. The provided text does not include technical stack, infrastructure, monetization, or retention details.

Why: If you build AI-assisted games or browser apps, the only hard number here is $10,000 in AI tokens against 1.2 million concurrent players; that should push you to separate token-generation cost from hosting and concurrency cost when planning a launch. But because the excerpt omits stack, server costs, and retention, don't treat this as a repeatable architecture case study yet. No Malaysia-specific policy, funding, or infrastructure angle is stated in the text.

A claude.dev blog guide by Addy Osmani (published Sep 22, 2026, 9 min read) walks through prompting Opus 5.5 in Claude apps and Claude Code, and the HN thread drew 191 points and 132 comments. Its concrete claims: Opus 5.5 always thinks before replying and decides how much, so "think carefully" / "think step by step" lines should be deleted from prompts and saved instructions — in the author's chat-product testing, removing one made replies start sooner with no clear quality drop. It also advises giving the whole task in one message with an explicit finish line (e.g. "the test suite passes", "every endpoint uses the new client") plus a stop-and-ask condition, and notes early testers had it run long coding tasks for hours with little oversight; in Claude Code, thinking depth is changed via an "effort" setting. The article text is truncated after section 2, so guidance on checking results, Claude apps, flagged messages, and speed is not available here.

Why: If your saved prompts, CLAUDE.md, or agent system instructions still contain "think step by step" boilerplate, this says you can delete it and get faster first tokens with no measured quality loss — a one-line edit you can A/B this week. The bigger operational point: because the model runs for hours unsupervised on multi-step work, your prompt now needs a machine-checkable definition of done and an explicit stop condition, otherwise you are paying for and reviewing runs with no defined endpoint. Caveat: these are the author's own tests on a vendor-adjacent blog, not independent benchmarks — treat the latency claim as a hypothesis to verify on your own tasks.

Google has suspended the product-vulnerability side of its Open Source Software Vulnerability Reward Program (OSS VRP), with submissions ending October 1 and the freeze reportedly running until 2027. Tom's Hardware attributes the halt to a flood of invalid, AI-generated submissions that maintainers describe as hallucinations. The headline frames it as open-source maintainers drowning in low-quality automated reports.

Why: If you run a bug bounty, a security intake form, or any public issue tracker, this is the failure mode to design against now: AI-generated reports can scale faster than humans can triage them, and the cost lands on maintainers, not submitters. The concrete decision is whether to add submission gating (proof-of-concept requirement, reputation thresholds, rate limits, or paid bounties only) before your queue becomes unreadable — Google's answer here was to close the program entirely rather than triage.

Aleph Alpha released Kolibri on 3 October 2026, an open-weight German/English mixture-of-experts LLM with 78.1B total parameters but only 3.46B active per token, under Apache 2.0 for the weights and config files (training code and methods stay proprietary). It was trained from scratch on ~24 trillion tokens — over a fifth German — on 768 NVIDIA B200 GPUs using infrastructure in Germany and Finland, with a 262,144-token native context (tested to 1,048,576), four reasoning levels, tool calling, a 18 June 2026 knowledge cutoff, and about 78 GB of FP8 weights. Aleph Alpha frames it as 'sovereign': built under European/German law with no foreign control, so customers get full deployment freedom and 'compliance as an inherited property', and it has signed the EU's GPAI Code of Practice. The 409-point Hacker News thread drew only 11 comments.

Why: The ~78 GB FP8 footprint means Kolibri can plausibly run on a single 80 GB accelerator rather than a cluster, which is the concrete difference between self-hosting and paying per-token to a US API. If you sell into the EU, handle data that cannot leave a client's building, or need tool-calling agents with a 262k context window, this is a deployable alternative — but the 'scores above every compared model of its size in both languages' claim comes from Aleph Alpha's own evaluation, so benchmark it yourself before committing. For Malaysian and SEA builders, the relevant lesson is the packaging: weights + license + no-foreign-control deployment story as a compliance argument, which is a template local sovereign-model efforts can copy.

Ahmad Al-Dahle, who led generative AI at Meta and the Llama model launches from 2023-2025, joined Airbnb as CTO in January and is pushing it toward being an "AI-native company" via an "inside-out" approach: use AI internally to speed up product development, then apply the same capability to the guest experience. He cites self-reported numbers: 60% of Airbnb's code is now AI-authored, features and improvements shipped are up nearly 80% year over year, and average engineer pull-request throughput is up about 1.6x. The mechanism he describes is process, not tooling — product, design and engineering teams now move straight into shared prototypes instead of PRD-to-Figma-to-engineering handoffs, and an internal tool called Everest was used to accelerate the launch of a new external service. Note: the excerpt cuts off mid-sentence before details on the guest-facing deployment.

Why: The transferable claim here is organisational, not technical: Airbnb attributes ~80% more shipped features and ~1.6x PR throughput to collapsing the PRD → Figma → engineering handoff into one team working on a prototype, which is a change a small team can make this sprint without buying anything. Treat the 60% AI-authored code figure as a self-reported CTO number from a company with a ~$93B market cap, not an independently measured benchmark — useful as a directional target for your own AI-assisted workflow, not as a productivity guarantee to quote to your board.

Epic, which makes the MyChart patient portal used to maintain over 320 million patient records in the US, has paused most of its product development for roughly six weeks to fix security bugs, per founder and CEO Judy Faulkner speaking to Modern Healthcare. The flaws surfaced after a deployment of Anthropic's frontier cybersecurity model, Mythos, and chief security officer Stirling Martin told The Times that some customer configurations of MyChart could let outsiders read patient records without leaving any entry in the software's logs. Martin said the model did not establish whether records could also be altered undetected, but Epic judged the risk serious enough to remediate; TechCrunch notes Epic has not disclosed the nature of the bugs.

Why: The concrete lesson is the logging gap, not the vendor: a read of patient records that leaves no trace in application logs defeats detection and audit entirely, and that class of bug is exactly what an AI security model found here at scale. If you ship anything with a permission model — patient data, tenant data, customer records — test whether privileged or misconfigured access paths produce an audit entry, and treat 'no log line' as a bug of its own. Also note the release-planning implication: a six-week freeze on most product development is what a serious finding costs, so teams running continuous release trains should decide in advance what triggers a stop-ship versus a patch-forward.

MyDigital ID's Android app now supports the next-gen MyKad, letting new cardholders complete identity registration online after updating via the Google Play Store; iOS and Huawei users still have no timeline and must use a physical kiosk if urgent. The new MyKad launched on 16 September with 53 security elements including contact and contactless NFC and an enforcement QR code, but its redesign (chip left, no photo on the right) broke eKYC matching — the new card was rejected when signing up for TNG eWallet, Ryt Bank, AEON Bank and GXBank because the MyDigital ID app still rendered the old card template.

Why: If you run or integrate Malaysian onboarding, the new MyKad has been failing eKYC since mid-September at four named institutions (TNG eWallet, Ryt Bank, AEON Bank, GXBank) purely because of a card template mismatch — that is a fixable image/template assumption in your pipeline, not a chip or NFC problem. Anyone shipping a mobile app that touches identity should note this rollout is Android-first with no iOS or Huawei date given, so you cannot assume all users can self-register; plan a kiosk or JPN pre-registration fallback and ask your eKYC vendor whether their template library already covers the 16 September card.

Latent Space interviews Alex Zhang, an MIT PhD and first author on Recursive Language Models (RLMs), covering GPU kernels and KernelBench, RLMs, 'mismanaged geniuses,' multi-agent swarms, and the idea of harnesses as compositional generalizers. The episode points to concrete signals: Prime Intellect's Prime Agent, described as a self-improving RLM harness using programmatic tool calling, context as a variable, multi-agent messaging, and self-modifiable harness state, was claimed to be first to ~solve ARC-AGI-3 ahead of OpenAI's Astra; and Rulin Shao's Context Language Models (Sep 30, 2026) push the same idea further by learning context policies in model weights with no harness at all. Zhang's framing is that wrapping stronger models in primitive systems leaves capability on the table.

Why: The concrete decision this surfaces for agent builders: if your harness hardcodes how context is assembled, trimmed, and passed between steps, that is the exact layer these researchers argue is underperforming. The pattern to evaluate is context as a variable or file the model edits itself, plus programmatic tool calling and subagent calls instead of fixed orchestration — the episode attributes token efficiency and expressiveness gains to that shift. There is no Malaysia or Southeast Asia angle in this text; treat it purely as an architecture question for what you are building.

SvelteKit 3.0 shipped on October 1, 2026, and the team describes it as the same framework with more polish and type safety. Breaking changes include moving configuration from svelte.config.js into vite.config.ts, renaming the $lib alias to #lib via standard subpath imports, plus reworked environment variables, less service-worker boilerplate, and improved error handling. Remote functions — type-safe client-server utilities — are explicitly not ready and still need Async Svelte behind an experimental flag, though the team calls them their top priority.

Why: If you maintain a SvelteKit app, the $lib to #lib rename and the config move to vite.config.ts will break imports and build setup, so run `npx sv migrate sveltekit-3 --tasks all --confirm` and expect it to leave a TODO list rather than finish the job. If you were planning to build a data layer around remote functions, don't wait — they still require an experimental Async Svelte flag, so design for the current load/action patterns instead.

Scott Chacon argues that Git 3.0's plan to make SHA-256 the default content-hashing algorithm is an expensive, low-value global migration. The piece recounts that Git has used SHA-1 since Linus picked it in 2005, that accidental collisions would require roughly 1.4 septillion files in one project, and that the only real weakness is theoretical collision attacks published as SHAttered (2017) and 'SHA-1 is a Shambles' (2020). The Hacker News thread drew 324 points and 312 comments.

Why: Anything you run that assumes a 40-character SHA-1 hex object ID — build cache keys, CI fingerprints, hooks, scripts, or a database column storing commit hashes — is what this default change would break, and Git 3.0 timing means you should decide now whether to pin/opt out or budget for a migration. Note the excerpt argues the cost is huge but does not quantify it; the specific migration mechanics and the article's supporting numbers beyond the 1.4-septillion collision figure are not in the text provided, so treat the cost claim as an argument to evaluate, not a measurement.

AWS released Strands Decider 2B, an open-source 'decision model' inspired by TypeSafe's Jev, the same week OpenAI announced a comparable offering. Built on the torso of Qen3.5-2B, it doesn't generate text — it picks between pre-decided options and returns a calibrated confidence score, and it's small enough to run locally. Amazon distinguished engineer Marc Brooker built an early version after seeing Jev; it briefly topped the Jevbench ranking for models of its size before AWS cleaned it up and shipped it via Strands Labs.

Why: If your agent workflow uses a full LLM call just to answer 'what do I do next?', a 2B local decider with confidence scores can replace that step with lower latency and no per-call API bill — and because the answer domain is closed, you can gate actions on the confidence value instead of parsing free text. Worth benchmarking on your own routing steps before assuming it beats your current prompt.

Cloudflare released two Cloudflare-trained "decision models" — Clef and Clef-flash — hosted on Workers AI, open-sourced on Hugging Face under Apache 2.0, and made Jev-API compatible with Typesafe AI's Jev System One. Decision models return bounded, typed outputs with probabilities (e.g. 95% fashion, 85% ecommerce, <1% phishing) instead of open-ended text, and Cloudflare says Clef currently leads the Jev Decision Index. Cloudflare also debuted an RL product for fine-tuning Clef, and reported its own Threat Intelligence workflow classified a domain in 2.2s with Clef versus 4.7s for gpt-oss-120b, which returned only two classifications.

Why: If you are routing tickets, escalations, or domain/page categories inside an agent loop, a classifier that returns typed labels plus probabilities lets your code branch deterministically instead of parsing LLM prose — and since Clef is Apache 2.0 on Hugging Face you can self-host and test it without committing to Workers AI billing. Treat the 2.2s vs 4.7s figure as vendor-reported on Cloudflare's own Threat Intelligence workflow, so benchmark it on your own inputs before swapping out a prompt-based classifier. The new RL fine-tuning option is the piece to evaluate if your label set is domain-specific and you don't want to retrain a full classifier each time categories change.

Reddit announced it is winding down RSS feeds, with support ending November 13, 2026, and will shut down public API access in March 2027. Reddit says RSS had become a "common surface for large-scale scraping and automated abuse," and points moderators toward the Discord Relay Devvit app as a migration path, while stating there is no direct replacement for RSS consumption. The move lands as Reddit's non-advertising "other revenue" grew 24% year-over-year to $43 million in Q2, largely on AI data licensing deals.

Why: If you ingest Reddit via RSS or the public API — for moderation alerts, sentiment pipelines, dataset collection, or agent tooling — you have a hard deadline of November 13, 2026 for RSS and March 2027 for the API, and no free equivalent is being offered. Reddit's $43M/24%-growth non-ad revenue line shows the intended replacement is a paid licensing deal, so any product that depends on Reddit content needs either a Devvit-based re-architecture, a budget line for licensed data, or a different data source. Treat this as a pricing signal, not just an access change: free community data is being converted into a commercial licensing product.

Hillel Wayne's Buttondown post What TLA+ can and can't check responds to Boris Cherny's claim that Opus used TLA+ to find race conditions in code, pushing back on the idea that formal methods will solve agentic software development. It walks through what TLA+ can express, including behaviors as state sequences, the temporal operators [] always, P' next, and <> eventually, plus invariants and action properties, while promising to focus on properties TLA+ cannot even express. The excerpt ends mid-explanation of action properties and stutter-invariance, and the Hacker News thread had 222 points and 47 comments.

Why: If you use coding agents like Claude Code or Opus for bug-fixing, do not treat a TLA+ run as a turnkey correctness guarantee: the author notes you still need a property to verify, and correct designs do not automatically translate into correct code. Teams should decide who writes and reviews the invariants or properties before trusting agent-generated fixes.

Epoch AI's report, covered by Tom's Hardware, claims the price of AI has fallen by thousands of times in recent years — roughly 50% cheaper every quarter, or about 13x cheaper per year. That pace outruns lithium batteries, DNA sequencing, and even compute riding Moore's Law. The article also notes that vendor loyalty and subscription schemes have limited appeal when prices can fall this fast.

Why: If inference really is deflating ~13x a year, any pricing model that assumes today's per-token or per-seat API cost for a 12-month horizon is wrong by an order of magnitude — that flips build-vs-buy math toward 'buy now, revisit in a quarter' and argues against multi-year vendor commitments or self-hosting to chase cost. Treat the 13x figure as a claim from one report, not a law, and check your own invoice trend before re-architecting.

The Hacker News rounds up six browser-based attack techniques it says security teams should track in 2026, citing Push data and Microsoft's Digital Defense Report. It claims reverse-proxy adversary-in-the-middle phishing kits (Tycoon2FA, Sneaky2FA, Evilginx) relay live credentials and session tokens to bypass most MFA, that roughly 1 in 2 phishing attacks now arrives outside email, and that 89% of phishing domains live under two days. It says ClickFix copy-and-paste attacks hit 47% of observed attacks per Microsoft and 52% of Push's Q2 2026 detections, with four in five ClickFix payloads reached from search engines, and describes an 'InstallFix' variant using malvertised fake install pages for developer tools including Claude Code and NotebookLM where the install command is swapped out.

Why: The concrete action item is the install-command path: if your README, onboarding doc, or YouTube tutorial tells someone to copy a curl/install command, an attacker can rank a fake page above yours and swap that command — and this piece names Claude Code and NotebookLM as already-targeted examples, meaning AI coding tools are now the lure. Second, if your product's MFA is TOTP or push, session-token relay means a phished session can survive login, so passkeys or other origin-bound auth is the thing to evaluate rather than adding another prompt. Note there is no Malaysia-specific detail in the text, so treat this as generic team hygiene, not a local incident.