AI Weekly Malaysia

Cloudflare's Certificate Transparency Monitoring is now generally available after being in beta since 2019, covering over 650,000 domains. The GA release fixes a major noise problem by filtering out alerts for certificates Cloudflare issues and renews on your behalf, so you only get notified about unexpected external certificates.

Why: If you previously disabled CT Monitoring because of spam from routine Cloudflare certificate renewals, you should re-enable it now; the GA version only alerts you to certificates issued outside Cloudflare, which is critical as certificate lifespans shrink to 47 days by 2029 and renewal frequency increases.

Ryanair signed a five-year Google Cloud deal covering Gemini Enterprise, Google Workspace, AlphaEvolve, and WeatherNext, weeks after renewing AWS for another five years. The airline is running a dual-cloud resilience strategy across 35,000 staff and 647 aircraft, targeting 300 million passengers by 2034, with critical systems able to switch between providers during outages.

Why: This is a concrete enterprise case of multi-cloud failover using the AWS-Google Cross-Cloud Interconnect that was announced last year—if you're evaluating whether dual-cloud resilience is practical or just marketing, Ryanair's deployment across flight ops, crew logistics, and forecasting is a reference architecture to study. It also shows Gemini Enterprise agentic AI being used for real operational decision-making (crew scheduling, maintenance planning), not just chatbots.

Twitch has added a 'Training for Generative AI' opt-out toggle in channel settings, but it is enabled by default—meaning all channel content (livestreams, VODs, clips, highlights, text, images, and chat messages) is fed into Amazon's generative AI models unless a streamer manually disables it. Twitch CPO Mike Minton openly admitted the default-on choice was because 'if it was opt-in, nobody would opt in,' and confirmed Amazon has already been using Twitch data for AI training since at least 2024. Opting out only covers future model improvements, not data already ingested, and chat messages you post in another streamer's channel are governed by their setting, not yours.

Why: If you stream or build tools on Twitch, you should go into channel settings and disable 'Training for Generative AI' now if you don't want your content feeding Amazon's models—but understand this only stops future use and doesn't retroactively remove anything already trained. For Malaysian creators and builders using Twitch as a platform, this is a concrete data-rights decision point, not a theoretical one, and the chat-message cross-channel wrinkle means your audience's messages in your channel are your responsibility to protect.

OpenAI is previewing an 'Ultrafast' API tier for GPT-5.6 Sol that delivers up to 14× the speed of Standard processing, generating up to 750 output tokens per second. The service is powered by Cerebras inference hardware, marking a notable infrastructure partnership for OpenAI. It launches first via the OpenAI API.

Why: If you build latency-sensitive AI features (real-time agents, voice assistants, interactive copilots), 750 tokens/sec is a concrete threshold that could shift your architecture from streaming-with-spinners to near-instant full responses. The Cerebras partnership signals that non-NVIDIA inference silicon is reaching frontier-model production, which matters for cost and vendor-lock-in planning. Malaysian builders shipping API-based products should benchmark whether Ultrafast pricing justifies migrating workloads currently on Standard tier.

SK Hynix is investing $720 billion to build the world's largest network of memory factories at its Yongin Cluster, with production starting in February. The company now controls 58% of the high-bandwidth memory (HBM) market and its market cap has topped $1 trillion after a fivefold jump in the past year. South Korea's president is pushing both SK Hynix and Samsung to expand capacity under a national plan backed by at least $22 billion in chip support.

Why: HBM supply constraints directly drive GPU scarcity and cloud compute pricing for anyone training or deploying AI models. If SK Hynix's Yongin fab comes online as planned in February, HBM supply could loosen, potentially easing GPU availability and cost for AI builders. Founders budgeting for AI infrastructure should track this timeline rather than assuming current compute costs are permanent.

Cisco CEO Chuck Robbins told the Q4 earnings call that Anthropic's Mythos bug-finding model is driving a network refresh 'supercycle,' as customers rush to replace unsupported (past LDOS) networking equipment they now consider too risky to operate. Robbins said buyers are pulling from security budgets to fund replacements, and cited quantum-readiness and AI network demands as the other two factors. Cisco reported $17.3B Q4 revenue (up 17%) and $63.3B for the year (up 12%).

Why: If AI bug-finding models like Mythos are systematically surfacing vulnerabilities in unsupported hardware and software, any builder running past-end-of-life infrastructure (routers, switches, firewalls, even old library versions) faces a shrinking window before those flaws become public. Audit your stack for components past their last support date and budget for replacement now—before a model finds the bug for you.

Tencent disclosed it spent $53B in capex last quarter and could rent that compute at 30%+ profit margins almost immediately, but is instead building its own models and selling tokens through products like WorkBuddy (an agent swarm) and CodeBuddy (code generation). It released the 295B open-weight Hunyuan-3 in July and says Hunyuan-4 will be larger and more capable, with products being co-designed around it.

Why: Tencent is publicly betting that selling AI tokens through applications is more lucrative than renting raw compute — a signal for SaaS founders on where margin sits in the AI stack. The 295B open-weight Hunyuan-3 is available now for builders who want a Chinese-ecosystem alternative to Llama, and Tencent Cloud's active push of CodeBuddy for cloud migration means teams evaluating Tencent Cloud should ask how bundled AI tooling affects their pricing and lock-in.

Tencent reported spending $53 billion on capex in Q2 and said it could recover depreciation almost immediately by renting compute at 30%+ profit margins, but is instead allocating that capacity to build its own models and AI applications for longer-term returns. It released the 295-billion open-weight Hunyuan-3 in July, with Hunyuan-4 promised as bigger and more capable, and is shipping agent products like WorkBuddy (agent swarm) and CodeBuddy (code generation tool tied to cloud migration).

Why: Tencent's choice to forgo instant 30%+ compute-rental margins in favor of selling tokens through its own applications is a concrete data point for SaaS founders weighing infrastructure-as-a-service vs. product-layer AI businesses. The open-weight Hunyuan-3 (295B params) is available now for teams evaluating non-Western foundation models, and CodeBuddy's role in accelerating Tencent Cloud migration suggests the vendor is using AI tooling as a cloud lock-in lever.

JetBrains CTO Vladislav Tankov describes how his team evaluates frontier LLMs against private repositories, including their monorepo, rather than trusting public benchmark scores. Claude Fable 5 posted a 44.3% Python pass rate in JetBrains' suite versus 28.2% for Opus 4.8, solving 18 tasks Opus missed while losing only 2, and despite higher per-token cost, delivered lower cost per task on complex long-running work.

Why: If you're shipping AI-assisted coding features, JetBrains' approach is a concrete template: build eval sets on your own private codebase, track separate leaderboards for quality/cost-per-task/speed, and measure cost-per-task (not per-token) because a more expensive model can be cheaper on complex work. The 16-point pass-rate gap between Fable 5 and Opus 4.8 on real code is large enough to justify re-evaluating your current model choice.

Anthropic has begun inserting invisible watermarks into Claude's editorial text outputs to comply with the EU AI Act's Transparency Code, which requires AI-generated or AI-edited content to be machine-identifiable. Some users on Reddit are upset, arguing the system will disproportionately catch casual users rather than sophisticated ones who paraphrase or route outputs through other AI services.

Why: If you ship products or workflows that surface Claude-generated text to end users — especially in EU markets — you should now expect that text to carry machine-detectable provenance signals. This affects compliance posture for SaaS products that embed Claude outputs, and it changes the calculus for anyone using Claude for drafting, summarization, or editing in workplace or academic settings where AI use is restricted.

A 16-year-old SQLite write-ahead log (WAL) checkpointing bug caused recurring database corruption in Tailscale's tailnet infrastructure starting August 2025, taking six months to diagnose. Tailscale funded SQLite maintainers to build a new virtual file system logging tool to reproduce the issue, which engineer Alex Chan described as resisting all initial debugging attempts including checks on POSIX locks, memory management, and thread safety.

Why: If you ship SQLite as a primary database under continuous backup snapshots, this postmortem is a concrete lesson in how deep storage-layer bugs can masquerade as application-level corruption for months. The debugging methodology—systematically ruling out POSIX lock, memory, and threading theories before isolating checkpointing—is worth studying before you hit a similar wall. The fact that SQLite maintainers themselves had to write new tooling to reproduce it should reset expectations about how 'reliable and well-known' doesn't mean 'bug-free' for critical infrastructure.

Twitch will now use creators' livestream content to train Amazon's generative AI models by default, requiring streamers to manually opt out. During a stream to nearly 3,000 users, Twitch CPO Mike Minton explicitly admitted the policy is opt-out rather than opt-in because 'if this was opt-in, nobody would opt in.' Twitch framed the change as adding an opt-out setting rather than announcing new AI training, causing confusion over whether content had already been used.

Why: If you build platforms with UGC, this is a concrete example of the opt-out-vs-opt-in design choice becoming a public trust crisis—Twitch's own CPO admitted the default exists to harvest data creators wouldn't voluntarily give. For AI/ML practitioners, it signals that large-scale training data acquisition is increasingly shifting to owned-platform scraping (Amazon on Twitch, Meta on Instagram) rather than open-web crawling, which affects where data licensing and consent debates go next.

Cognition, maker of the AI coding agent Devin, is reportedly in talks to raise at a $40B valuation, up from $26B just three months ago. The new valuation hinges on reaching a $1B annualized revenue run rate, double the $492M ARR it reported in May, with enterprise usage growing 50% month-over-month. Customers include Mercedes-Benz, NASA, and Goldman Sachs, with Devin primarily used for long-tail grunt work like legacy modernization and platform migrations.

Why: The revenue trajectory ($492M to $1B ARR in months) signals enterprises are paying real money for AI agents that handle migration and modernization grunt work, not greenfield development. If you're building AI coding tools or agents, the proven willingness-to-pay is in tedious legacy work, not replacing core developer workflows. For SaaS founders, the $40B valuation at $1B ARR implies a 40x revenue multiple, which sets a benchmark for what investors will pay in this category.

CoreWeave's Q2 2026 revenue doubled YoY to $2.575B, but operating expenses of $2.624B produced a $49M operating loss and $626M net loss, with total debt at $35.6B. 93% of revenue growth came from existing customers, and just three customers accounted for 72% of quarterly revenue. CEO Michael Intrator pitched AI compute as a continuous recurring loop (training, inference, evaluation, redeployment) rather than a one-time training cost, with managed inference services targeting $250M ARR by end of 2026.

Why: If you rent GPU capacity from neoclouds like CoreWeave, this signals pricing and service-model shifts ahead: they are pushing up-stack into managed inference and are financially stretched enough that contract terms or availability could change. The extreme customer concentration (three clients = 72% of revenue) and $35.6B debt mean builders should avoid single-provider lock-in for critical inference workloads and evaluate whether the 'continuous compute loop' framing matches their actual usage pattern before committing to long-term contracts.

Lovable raised $400M in a Series C at a $13.3B valuation, up from $6.6B in December, after hitting $500M annualized run rate revenue in June. The platform now hosts 60 million projects with 900 million monthly visitors, signed a multiyear Google Cloud deal with fivefold increased usage, and offers its own in-house trained AI model alongside frontier model options.

Why: The $500M ARR and 900M monthly visitors signal that vibe-coding tools have reached mainstream scale, not just hype—if you build developer-facing tooling or AI agents, expect users to compare your UX against Lovable's. The in-house model detail is worth noting: it suggests margin pressure from frontier API costs is pushing even well-funded startups to train their own models, which affects build-vs-buy decisions for anyone shipping AI-powered coding tools.

CoreWeave CEO Mike Intrator says the company has signed A100 GPU contracts extending into 2029, demonstrating that Nvidia's 2020-era GPUs remain profitable nine years post-deployment. Power constraints and legacy infrastructure costs make older GPUs economically viable even as newer chips arrive.

Why: If you're budgeting GPU compute for AI workloads, don't assume older GPUs like the A100 will become cheap or obsolete soon — CoreWeave is locking customers into multi-year A100 contracts through 2029, which signals sustained pricing power for legacy hardware. This affects cost planning for anyone renting cloud GPU capacity or deciding whether to wait for next-gen capacity versus contracting now.

Group-IB detailed a fraud campaign called WindRelay that combines a phone-based social engineering attack with two Android malware strains—SpyNote (a RAT leaked in 2016) and WindRelay (NFC relay malware discovered August 2025)—to clone contactless card transactions in as little as 13 minutes. The attacker poses as bank helpdesk, gets the victim to install SpyNote, which silently deploys WindRelay, then tricks the victim into tapping their card on their NFC phone and entering a PIN. WindRelay captures the live EMV APDU exchange and relays it to an attacker-controlled POS terminal or ATM, completing a genuine card-terminal handshake that authorizes fraudulent payments.

Why: If you build or operate payment, fintech, or banking apps in Malaysia—where contactless card and e-wallet usage is near-universal—this attack shows that contactless EMV is not a trust boundary you can rely on when the cardholder's own device is compromised. Fintech teams should evaluate whether their fraud detection can flag relay-style transactions characterized by unusual POS-to-cardholder geolocation or timing gaps, and whether customer-facing flows that instruct users to tap cards on phones create teachable moments for social engineering awareness.

Meta and Nvidia both released open-weight AI models this week, available for free download, as part of a broader US effort to compete with leading Chinese labs in the open-source AI space. More than 20 US tech companies recently urged policymakers to avoid 'premature restrictions' on open-weight models, including those from China.

Why: If you build with open-weight models, you now have new free options from Meta and Nvidia to evaluate alongside existing Chinese open-weight offerings. The policy lobbying signal also matters: if restrictions on open-weight models are delayed, you retain broader access to frontier open models for local deployment and fine-tuning without vendor lock-in.

Known Agents' Agentic Web Index reports that 35% of web traffic is bots, with 29% of that bot traffic being AI-related (up 11% over 90 days). Someone is conducting mass vulnerability scans while spoofing their user-agent as AI bots like ClaudeBot, making malicious scanning traffic harder to distinguish from legitimate AI crawler traffic.

Why: If you block or rate-limit by user-agent string, spoofed scanners can masquerade as known AI bots like ClaudeBot to evade detection. Don't rely on user-agent alone for access control or bot management—consider behavioral fingerprinting, IP reputation, and challenge mechanisms instead. The 98.5% robots.txt compliance rate also means robots.txt is not a security boundary.

Nathan Lambert reflects on writing an AI textbook and argues that LLMs remain stagnant at long-form non-fiction writing, increasing entropy rather than compressing knowledge into insight. He contends that if models can't organize and present established science, they're not ready to autonomously solve open-ended scientific problems, and that progress will look more like low-hanging fruit and cross-field connections than revolutionary breakthroughs.

Why: If you're building AI agents for research, technical writing, or autonomous knowledge work, this argues against assuming models will soon self-organize complex information into coherent long-form output. Plan for human-in-the-loop structuring and editing rather than end-to-end autonomous generation for anything requiring sustained argument or knowledge compression.

The FCC is drafting a measure under the Secure Networks Act to block imports of new Chinese optical transceiver models, with a target to publish the rule before end of 2026. The move has sent shares of Chinese photonics makers (Zhongji Innolight, Eoptolink, TFC Optical) tumbling while boosting Western rivals Coherent and Lumentum, as companies like Nvidia and Marvell pour billions into silicon photonics acquisitions to solve AI's copper interconnect bottleneck.

Why: If you build or budget for AI infrastructure, expect upward pressure on optical transceiver costs and potential supply constraints as US restrictions reshape the photonics market — Malaysia-based data center and hardware players could see both risk (component sourcing) and opportunity (manufacturing rerouting). Track whether indium phosphide shortages and transceiver import bans hit before your next hardware procurement cycle.

An opinion piece arguing that hyperscalers are using AI-driven demand to lock up the enterprise hardware supply chain, leaving businesses little choice but to rent compute back from them. Nutanix CEO Rajiv Ramaswami noted the fastest way to get a new server is now to rent from a hyperscaler; Micron, SK Hynix, and Seagate have long-term supply deals favoring their largest customers; AMD has sweetheart deals with OpenAI and Meta. AWS CEO Andy Jassy says AWS recoups server spend in under three years on assets with 5-6 year useful lives, with datacenters designed to last 30 years.

Why: If hyperscalers continue cornering hardware supply, bootstrapping or cost-sensitive Malaysian startups that planned to own on-prem or colo gear will face longer delivery times and higher prices, making cloud rental the de facto path. Founders should model infrastructure costs assuming hyperscaler pricing power persists rather than betting on cheaper self-hosted hardware, and consider locking in longer-term cloud commitments if AI compute is core to their product.

Written shortly after OpenAI announced it had solved ten major open problems in mathematics and theoretical computer science—including the first construction of a non-sofic group and a superexponential growth proof for multicolour Ramsey numbers—this post observes that LLMs' most famous mathematical successes have overwhelmingly involved finding counterexamples rather than constructing proofs. The author explores whether this pattern reflects a genuine structural strength of LLMs and what it might reveal about where they still fall short of human mathematicians.

Why: If you build or rely on LLM-based reasoning tools, this suggests a concrete asymmetry: LLMs may be more reliable at disproof-by-counterexample than at constructing novel proofs, which should shape how you scope tasks for agentic math or formal-verification workflows. The author also notes that despite headline results, LLMs are not uniformly better than humans at all mathematics—if they were, their speed advantage would produce a flood of results that has not materialized.

Attackers are actively exploiting CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in Broadcom VMware vCenter, with 361 victim IPs across 47 countries as of August 2026. Patches were released by Broadcom in late July 2026, and exploitation began within days of disclosure, using reverse_ssh via cron jobs for persistent remote access. QUIRSO attributes the campaign to a suspected APT actor.

Why: If your team runs VMware vCenter and has not applied Broadcom's late-July 2026 patch, patch now — the exploit chain is trivial enough that 361 hosts were compromised within days of disclosure. The reverse_ssh persistence technique bypasses inbound firewall rules, so compromised hosts may not show obvious inbound connection alerts.

Mark Pesce gave an AI agent SSH access to a 15-year-old device running ancient Arch Linux with a browser too old for modern encryption. Over three hours the agent failed to compile modern cURL, then found a fast math library that solved the CPU's lack of floating-point support, and got the device chatting via Telegram. He then used agents to revive a 12-year-old iMac Pro on Ubuntu, a 10-year-old VR PC, and an underpowered Surface Go, arguing that agents have made the cost of testing ideas nearly zero.

Why: If you have old hardware or niche environments you've abandoned because the config grind isn't worth your time, an agent with SSH access can plausibly handle the research-and-compile loop for you. The practical lesson is to let agents do the tedious cross-referencing of Reddit posts, GitHub repos, and firmware notes, then step in only when they hit a wall — as Pesce did by asking the agent whether someone else had already solved the math-library problem.