AI Weekly Malaysia

Proofpoint attributes a credential-phishing campaign to TA419, a China-aligned espionage group that has targeted U.S.- and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025. In February 2026 an AI policy expert at a U.S. think tank received a phishing email with the subject line 'Request for Feedback on Military Integration of Claude,' after the actor impersonated prominent economists, AI policymakers, and a prominent Anthropic employee; around July 2026 it also impersonated a former member of the White House Office of Science and Technology Policy leadership team. The chain starts with a benign-seeming invitation, then on reply sends a shortened URL through a multi-stage redirect and a Cloudflare Turnstile check to a fake OneDrive adversary-in-the-middle login page built with 'Frameless BitB,' a browser-in-the-browser variant that spoofs a login window without an iframe using injected HTML, CSS, and JavaScript.

Why: This is not a spray-and-pray phish: the campaign defeats MFA by proxying a real Microsoft/OneDrive login (AitM), and the Cloudflare Turnstile gate plus Frameless BitB make the fake page hard to flag with URL-reputation checks alone. If your product lets users sign in with Microsoft/Entra ID or click OneDrive share links, assume an MFA prompt can be relayed by an attacker — phishing-resistant factors (passkey/FIDO2), conditional access, and token-binding are the only controls that hold. Malaysian builders are not the described targets here (the article names U.S. think tanks, universities, law firms, and a U.S. AI policy expert), so treat this as a technique warning for your own auth stack, not a threat aimed at you.

Nolan Lawson's October 3, 2026 post on Read the Tea Leaves takes the platform-skeptic side of the 'use the platform' debate, giving three reasons developers still reach for libraries instead of browser APIs: browsers spent years behind the ecosystem (jQuery filling gaps while IE6 aged out), developers search npm and React components out of habit even when a standard exists, and web platform documentation was scattered across StackOverflow, CSS Tricks and blogs until MDN became the default reference (with web.dev as Google's more future-facing arm). He notes most browsers are now evergreen — Safari is 'debatable, although ~7 times per year ain't bad' — which undercuts the original justification for rolling your own. The Hacker News thread drew 203 points and 189 comments, and the excerpt cuts off mid-sentence, so the piece's later arguments aren't visible here.

Why: This is a framing essay, not a benchmark or a shipped change — nothing here forces a code change, so treat it as a prompt to check one dependency you added by reflex. The concrete lever is that the historical excuse (browser lag, IE6) is largely gone while the npm reflex and doc fragmentation are not, so the decision should be per-feature: ask whether a baseline standard already covers it before adding a package. Safari's roughly 7 releases per year is the one number worth carrying into your baseline targets if you still support it.

FTL is a proposed cloud OS where each container runs a userspace OS implemented as a shared library (Linux process, VFS, TCP/IP), while a minimal FTL kernel exposes only a hypervisor-like interface — vCPU, memory, drivers — so Linux system calls are implemented in userspace on top of user-mode hardware isolation. The project claims Linux binary compatibility (the Rust HTTP server serving ftl-os.org is a Linux app running on FTL) and that lightweight containers can be made as secure as VMs without bare-metal machines, also allowing Unikernel-style apps without POSIX abstractions. It drew 191 points and 74 comments on Hacker News, but the page shows no benchmarks, release artifacts, download instructions, or version numbers.

Why: This is a design to read, not a platform to adopt this week: there are no syscall-overhead or I/O numbers to compare against gVisor, Firecracker, or plain runc, and no stated release or availability. The one concrete action is to check whether FTL publishes measurements and Linux compatibility coverage — the claim 'containers as secure as VMs' is exactly the claim gVisor already makes, and without numbers you can't tell whether FTL's userspace-OS-as-a-shared-library approach is cheaper or more expensive per syscall.

Cloudflare opened a closed beta for a self-serve OHTTP Gateway, a paid add-on customers enable on their zone to receive Oblivious HTTP traffic without seeing client IP addresses or TLS fingerprints. OHTTP splits requests across two independently operated hops — a relay that blindly forwards encrypted requests and a gateway that decapsulates them — so no single party sees both client identifiers and request contents; Cloudflare also renamed its 2022 'Privacy Gateway' product to 'Cloudflare OHTTP Relay'. Named users of the pattern include Flo Health's app Anonymous Mode and Apple's Private Cloud Compute, which uses OHTTP to disassociate AI inference requests from user identities.

Why: The specific decision: if your servers already sit behind Cloudflare, you previously could not pair them with a Cloudflare-operated relay without collapsing the relay/gateway separation of trust — this gateway is the missing half, so the choice becomes pairing a non-Cloudflare relay with the Cloudflare gateway versus staying with your current setup. Because it is a waitlist closed beta on a paid add-on with no published price, treat it as a watch-list item and do not architect around it this quarter; the actionable step now is deciding whether an IP-free request path is worth a two-hop latency and vendor-pairing cost for any feature where you currently log client IPs. No Malaysia- or SEA-specific detail appears in this text, so the relevance is only as general infrastructure local apps could adopt.

Northeastern University researchers, working with Consumer Reports, ran what they describe as the first large-scale measurement study of the connected-vehicle ecosystem, testing 21 late-model vehicles across 19 brands plus 30 companion mobile apps. They found 19 of 21 vehicles contacted at least one third party over Wi-Fi, 7 of 30 apps transmitted PII to trackers, and 5 of 30 sent VIN plus other PII to trackers. Consumer Reports supplied the vehicle fleet, which the team says would have cost over $1.2M to assemble independently; the peer-reviewed paper lands at IMC '26, and the Hacker News thread drew 233 points and 195 comments.

Why: The number to act on is 7 of 30: roughly a quarter of the tested companion apps leaked personal data to third-party trackers without it being an obvious product feature, and 5 leaked the VIN itself. If you ship a mobile app with analytics, attribution, or ad SDKs, this is a concrete reason to capture your app's outbound traffic and check what identifiers those SDKs attach — a VIN or device identifier leaving your app is a compliance problem you inherit, not one the SDK vendor absorbs. There is no Malaysia-specific finding in the text, so local relevance is indirect: anyone building insurtech, fleet, or vehicle-adjacent apps should treat third-party SDK data flows as part of their own privacy surface.

Fervo Energy began selling electricity to the grid from its Cape Station enhanced geothermal plant on September 30, 2026 — one day ahead of schedule — making it the first enhanced geothermal company to hit commercial operation. The first block came online 23 months after groundbreaking and represents the first third of a planned 100 MW plant, with Fervo targeting as little as 18 months for future blocks and citing potential for up to 4 GW at the site. Google and Southern California Edison have committed to buying power from the project; Fervo went public in May via an upsized IPO raising $1.9 billion, after raising over $1.3 billion as a startup.

Why: If you build or buy AI infrastructure, this is a concrete datapoint on where firm, phaseable power is coming from: 23 months from groundbreaking to first commercial megawatts, with an 18-month target, and Google already signed up as an offtaker. It also matters as a capital-markets signal — a geothermal developer raising $1.9 billion in an upsized IPO means the 'power for data centers' thesis is now fundable on public markets, not just in venture rounds. Nothing here is Malaysia-specific; the relevance to Malaysian builders is indirect (regional data center power costs and siting), so treat it as context rather than something requiring action this week.

This ThreatsDay roundup argues the week's attacks came from ordinary-looking operations that do more than expected: a model inspection step that can execute code, a cache that can mix up requests, and public secrets that stay usable for years. The concrete items given are OFAC sanctioning 10 targets tied to a Tren de Aragua ATM jackpotting scheme using Ploutus malware, with $40.73 million in reported losses across more than 1,500 U.S. attacks, and roughly $6.1 million in inflows to seven designated crypto wallets since March 2022. It also notes EtherHiding, where actors hide malware instructions on public blockchains so they cannot easily be seized or taken down, plus a claim of 543K live secrets and a model-inspection RCE that the excerpt does not name or detail.

Why: Two of the listed items sit directly in AI and dev workflows: 'a model check can run code' means loading or inspecting third-party model artifacts is a code-execution decision, not a read-only one, and 543K live secrets implies leaked keys stay valid long after the leak. The excerpt does not name the affected tool, CVE, or vendor, so you cannot patch from this alone - treat it as a prompt to check whether your model-loading path uses safe formats and whether your own repos are still leaking usable credentials. The ATM jackpotting and sanctions items have no practical bearing on most builders in this audience.

The ESPARGOS team (a phased array of ESP32-connected patch antennas) found an undocumented ESP32 feature that lets firmware bypass fixed WiFi/Bluetooth behaviour and capture raw IQ baseband samples, turning several ESP32 chips into an internal SDR covering 2.2–2.7 GHz (plus 4.8–6.0 GHz on the ESP32-C5) at up to 80 MS/s with roughly 13–54 MHz analog bandwidth depending on chip. On plain ESP32 the output bandwidth is too low to stream to a PC, so it works only as a snapshot spectrum analyser — except the new ESP32-S31, which streams continuously at up to 16 MS/s over Gigabit Ethernet with a SoapySDR driver for GNU Radio and gqrx 'coming soon'. Independently, Reddit user /u/h0m3us3r found the same feature, published it to GitHub on Sept 26 and demoed an ESP32-S3 as an SDR with an FPGA as a USB3 front end that streams IQ continuously to a PC, though the FPGA currently clocks the ESP32 and produces poor phase noise; a third project, C5VRX, appears to use a similar finding.

Why: If you build or deploy 2.4 GHz IoT/wireless hardware, you can flash ESP-WebSDR firmware to most ESP32 dev boards from a browser and get a live spectrum and waterfall for interference checks at zero extra hardware cost — but do not plan to demodulate or decode continuous radio data on a bare ESP32, because only snapshots can be exported. The only continuous-streaming path in the text is the ESP32-S31 at 16 MS/s over Gigabit Ethernet with a SoapySDR driver still unreleased, and the ESP32+FPGA route is described as a prototype with unresolved clocking/phase-noise problems, so treat general-purpose SDR replacement as unproven. Nothing in this item is Malaysia-specific, so there is no local policy, funding or pricing decision attached to it.

DeepSeek and Huawei have released open-source programming tools for Huawei's Ascend AI chips, aimed at reducing dependence on Nvidia's CUDA ecosystem. According to the headline, the release covers compute and communication libraries plus Ascend support for TileLang. The article body provided contains only site navigation and subscription boilerplate — no version numbers, benchmarks, repo links, license terms, or hardware requirements are available in the text.

Why: For anyone whose GPU budget or supply is constrained by Nvidia, a second viable toolchain matters — but this item as given is a headline, not a usable decision input. Do not plan a port on it yet: there is no stated license, supported Ascend part list, or performance comparison here, so the practical step is to wait for the actual repos and benchmarks before evaluating Ascend as a cost alternative for training or inference.

Photon, a startup that helps developers build agents that run over iMessage and WhatsApp, raised $4.5M in seed funding after signing up 40,000+ developers and growing revenue 10x in four months, per the company. It marked the raise with an 'app funeral' in a San Francisco church on September 17, complete with a coffin for app icons and panels featuring Vercel, Stripe, and OpenAI. Its product bundle is a unified API, an extensible channel framework, a CLI, and an observability suite for shipping agents across iMessage, WhatsApp, Telegram, SMS, RCS, email, and voice; co-founders are CEO Daniel Tian and CTO Ryan Zhu.

Why: For anyone building a WhatsApp-first agent for Malaysian users, the concrete question is whether to use Photon's unified API + CLI + observability layer or build directly on WhatsApp's own business APIs — the channel abstraction is the value, but this is a $4.5M seed-stage vendor and Meta's own Muse app sitting at No. 1 on the app stores is a reminder that the platform owner can move into your layer. Treat the 40,000-developer and 10x-revenue figures as company-stated, not audited, and pilot on one channel before committing.

California Governor Gavin Newsom signed SB 947, the 'No Robo Bosses Act', which bars employers in the state from relying exclusively on 'automated decision-making systems' to fire or discipline workers, and restricts AI's use as a 'principal tool' in those decisions. The signing reverses Newsom's veto of an earlier version of the bill last October, which had passed both legislative chambers with overwhelming majorities. The report does not detail penalties, effective dates, or enforcement mechanisms.

Why: The law bans AI as the sole or principal decision-maker, not AI as an advisor — so if you build HR, people-ops, or agentic workflow tooling for California employers, the compliant design is AI producing a recommendation that a named human reviews and signs off on, with that review logged. If you sell to US customers from Malaysia, decide now whether human-in-the-loop approval is a default in your termination/discipline flows or a per-customer config, because retrofitting an audit trail after a customer asks is the expensive path.

Google's new support document states ChromeOS devices will only receive regular updates and security patches through mid-2034, which undercuts the 10-year update promise attached to Chromebooks bought in the last two years. Google says it will "support your transition to Googlebook OS" for qualifying devices whose 10-year lifecycle runs past 2034, with "many newer commercial Chromebook models" capable of upgrading — but the migration path is described vaguely. This follows the launch of the Android-based Googlebooks platform about a week earlier; the article notes Chromebooks stay on sale for now because Googlebook OS lacks the management frameworks schools require.

Why: If you or a client bought Chromebooks in the past two years — for a school lab, kiosk, reception desk, or cheap shared dev machine — the effective support window is now roughly 8-10 years from purchase, not the 10 years sold at the time, and anything bought from here gets a hard mid-2034 cut-off no matter the purchase date. The only stated mitigation is an unspecified upgrade to Googlebook OS for "many" models, so treat the device as replaceable at 2034 rather than assuming migration. Practically: don't build a multi-year deployment plan on Chromebook longevity, and check whether your fleet's ChromeOS Linux container tooling has an equivalent on the Android-based Googlebook OS before committing.

Digital Nasional Berhad completed a RM5.2 billion Syndicated Islamic Term Financing — described by DNB as among the largest syndicated loan facilities ever arranged for an unlisted Malaysian company — led by Maybank Investment Bank with AmInvestment, CIMB Islamic, RHB Islamic and UOB Malaysia as joint mandated lead arrangers. The money refinances DNB's Government Guarantee Revolving Credit Facility, which expired 29 September 2026, and is expected to reduce the need for extra equity from its mobile network operator shareholders. DNB also received the full 100MHz block in the 3.3GHz–3.4GHz band (F0) and converted its 240MHz holding from Apparatus Assignment to a 15-year Spectrum Assignment, while MOF Inc exits as an ordinary shareholder but keeps a special share, with CelcomDigi, Maxis and YTL expected to hold equal stakes and the transition due in early Q4 2026.

Why: If you build anything that depends on Malaysian mobile connectivity — apps, private 5G, edge, IoT, or an MVNO/wholesale arrangement — the concrete change is that DNB now has 15-year spectrum certainty on 240MHz and a refinanced balance sheet that DNB says reduces the need for further shareholder equity. That shifts the question from 'will the network keep getting funded' to 'what wholesale and enterprise 5G terms do three equal MNO owners (CelcomDigi, Maxis, YTL) plus a government special share produce' — worth checking your 5G-dependent roadmap and any wholesale pricing assumptions against that ownership structure before early Q4 2026.

Exabytes founder and CEO Chan Kee Siak argues Malaysian SMEs get little from agentic AI unless they re-engineer existing workflows and have bosses who personally use AI, recommending phased adoption starting with standalone agents. He cites an Ecosystm and Red Hat study of 133 Malaysian SMEs, supported by the National AI Office, showing only 21% moved past AI pilots and about 60% cited a lack of in-house technical expertise. Exabytes itself is putting more than 50% of its budget into AI, targeting one million businesses adopting AI by 2030, opened an HPC/AI colocation facility in Penang, signed an MoU with Aurora Mobile, and now draws roughly 30% of revenue from AI and cloud.

Why: If you sell or build for Malaysian SMEs, the survey number that matters is the 60% citing no in-house technical expertise and the 79% stuck in pilots, not the model access problem — the paid work is workflow redesign plus ongoing support, not another chatbot. It also sets a concrete benchmark for local demand: Exabytes claims 160,000 business customers (90% SMEs) and 30% of revenue from AI and cloud, so a small team should decide whether to compete on agent delivery or on the unglamorous integration and change-management layer.

A developer has built Retro486, a complete Intel 486 PC emulator that runs in the browser in what the piece describes as 100% pure JavaScript, with modular tabs for the screen, motherboard, storage and expansion cards. The available text is mostly page chrome from Tom's Hardware, so it confirms the project's existence and its tab-based UI structure but gives no benchmarks, compatibility list, licence, repository link or release date.

Why: Treat this as something to look up and tinker with rather than something to adopt: the excerpt gives you no repo URL, licence or speed figures, so you cannot judge whether pure-JS 486 emulation is fast enough for your own use until you find the actual project. The concrete takeaway is architectural — a full x86 PC (CPU, motherboard, storage, expansion cards) modelled as separate tabbed modules in plain JavaScript is a useful reference for how to structure a complex browser-based simulator without a backend.

Anthropic filed its preliminary IPO prospectus this week, a 300-plus-page S-1 that CNBC calls the most comprehensive public look at a pure-play AI lab’s fundamentals. It reported $16.29 billion in revenue and $2.38 billion in cost of revenue for the first half of 2026, implying an 85% gross margin, while leaving revenue durability, compute, governance, and pricing questions open; CEO Dario Amodei and six co-founders each own over 200 million shares ahead of an expected over $1 trillion valuation.

Why: If your product depends on Anthropic models, the filing gives a rare margin number—85%—but leaves compute commitments and pricing unanswered, so don’t assume API price cuts or stable pricing from the IPO; check the final S-1 for compute and pricing disclosures before locking in annual AI vendor commitments.

A group of Democratic US representatives led by Reps. Greg Casar and Maxine Waters introduced a non-binding resolution opposing any taxpayer bailout for AI-related corporations or executives if an AI asset bubble collapses. It cites AI-related firms holding trillions of dollars in debt, much of it in opaque private credit markets, and a stock-market price-to-earnings ratio nearly as high as the 1990s tech-bubble peak. The resolution calls instead for federal support to workers, retirees, and low-income communities.

Why: This is a political signal, not a rule change: if US AI financing tightens, the resolution makes a Big Tech rescue less politically automatic, which could feed into cloud/GPU pricing and AI startup funding conditions. If your roadmap assumes cheap AI infrastructure or easy AI startup capital, stress-test it against a scenario where US AI debt reprices and no bailout arrives.

Binance is dealing with what the article calls the biggest heist in crypto history, affecting an unprecedented $6.3 billion, with suspicion pointed at a state-backed actor. On the equity side, Amazon posted a double miss on both EPS and revenue — overshadowing the fastest AWS growth in five years — with shares down over 7% premarket, while Intel is plunging 25% premarket and the Nasdaq is set for its worst session of the week. The supplied text cuts off mid-sentence in the Intel section, so there are no exploit mechanics, affected assets, or recovery details for the Binance incident.

Why: Two concrete decisions: (1) If any treasury or payout float sits on a centralized exchange, a single-venue event measured at $6.3 billion is a counterparty-risk problem, not a price problem — the text gives no technical detail on how the hack happened, so the only actionable move it supports is reducing exposure to one venue, not patching anything. (2) AWS logging its fastest growth in five years even as Amazon misses on EPS and revenue means cloud demand is not softening — anyone modelling infra costs for the next quarter should assume no relief on pricing or capacity.

elect.horse is a browser puzzle game where you draw 5 districts of 5 voters each to make the incumbent "Horse" win the most seats despite losing the popular vote — the mechanic is explicit packing and cracking. It ships with a daily puzzle (same for everyone, currently Day 8), Normal and Expert modes, a hint that reveals one district of a winning map, and an Unlimited practice mode ranging from Beginner to Insane with past puzzles and streak stats. It's from the same makers as enclose.horse, and the thread drew 438 points and 113 comments on Hacker News.

Why: This is a compact, copyable template for a daily-engagement web toy: one shared puzzle per day, a streak counter, a hint that gives partial rather than full answers, and an unlimited practice tier so new players aren't blocked by difficulty. If you're shipping a small browser game or any habit-forming side project, the specific loop here (fixed daily seed, escalating difficulty ladder, stats in a menu) is worth studying rather than inventing from scratch — but nothing here changes what you build or deploy technically.

Foxconn Chairman Young Liu told CNBC the company holds about 40% of the global AI server market, could reach roughly 45% next year, and aims for 50% within a couple of years. He said production capacity is fully booked for at least the next 18 months and that AI infrastructure should exceed 60% of revenue in three to five years, while Foxconn plans to expand U.S. manufacturing further upstream.

Why: Builders planning AI-infra-heavy products should treat the 18-month fully booked capacity as a signal that server supply is not loosening quickly; if your roadmap assumes easy short-term compute, revisit procurement or architecture assumptions now. The 40% to 45% to 50% share path is company ambition, not an independent forecast.

On Amazon's Thursday earnings call, Andy Jassy repeated that AWS can become a trillion-dollar annual revenue business within five to 10 years, off a current $184 billion annualized run-rate. He guided 2026 cash capex at roughly $220 billion — mostly for AWS — and said 2027 spending will be meaningfully higher, while forecasting north of 40% AWS growth in both 2027 and 2028 after 39% year-over-year growth this quarter, the sixth straight quarter of growth. Analysts reportedly pressed repeatedly on the spending, the growth signals, and expected margins.

Why: The concrete numbers to carry away are $220B 2026 capex, $184B run-rate, and a 40%+ growth forecast held through 2028 — a signal that AWS expects to keep adding capacity rather than ration it. There is no pricing, region, or capacity-availability detail in this text, so it should not by itself change a build decision this week; what it does justify is treating multi-year cloud commitment negotiations as a moment to ask what capacity guarantees come with the spend.

TechCrunch reports, citing anonymous sources speaking to the New York Times, that U.S. intelligence agencies surveilled Megaspeed executive Alice Huang (Huang Le) for about a year over suspected ties to China, amid concern she had grown close to Nvidia CEO Jensen Huang through business dinners in the Singapore region. Megaspeed, a Singapore-based AI cloud firm, had already drawn a 2025 Commerce Department investigation over allegations it helped Chinese companies sidestep AI chip export rules by reselling restricted chips. An Nvidia spokesperson denied anything unusual, saying regional cloud customers get ordinary business information and 'zero information relevant to national security.'

Why: If you rent GPU capacity from regional cloud providers in Southeast Asia, this is a reminder that export-control exposure sits with your upstream supplier, not just your own paperwork — a Commerce investigation or surveillance story around a reseller can disrupt capacity, contracts, or procurement timelines you depend on. Concretely, ask GPU cloud vendors where their chips came from and how they document export compliance before committing to annual reserved-capacity contracts; the article gives no technical or pricing detail, so treat it as a due-diligence prompt rather than a market signal.

Tom's Hardware reports that AI demand has pushed PCB order books full out to 2030, with lead times stretching to 30 months and material costs surging 12x. The item as supplied is headline-and-deck only — the body text is site navigation and subscription boilerplate, so there are no named suppliers, component-level breakdown, or sourcing for the 12x figure. Treat the numbers as reported claims, not verified measurements.

Why: If your roadmap assumes you can buy or refresh dev machines, GPU rigs, or custom hardware on a normal cadence, a 30-month PCB lead time means orders placed for 2027 delivery may already be late — get quotes and lead-time commitments in writing before you commit to a hardware-dependent launch date, and budget for the reported 12x material cost increase rather than last year's BOM. Note the article gives no per-component or supplier detail, so don't build a forecast on the 12x number alone.

Tom's Hardware reports the GeForce RTX 5080 is selling at around $2,000, roughly 2-3x its original $999 MSRP and above what the RTX 5090 cost at launch, with limited stock available. The article is headline-level: it gives no board-partner models, no regional pricing, and no benchmark data. Published 2026-10-29.

Why: If you were budgeting a local GPU box for model inference or fine-tuning around the $999 launch price, that assumption is now off by roughly $1,000 on this card — the build-versus-rent-cloud math has to be redone. The article carries no Malaysian retail or distributor pricing, so treat $2,000 as a US data point and confirm actual local quotes before committing to a build.

Tom's Hardware (Jake Roach, published 29 Oct 2026) has published a member-exclusive, work-in-progress methodology piece describing its first attempt at a CPU benchmark for agentic AI workloads — an internal test set that tries to measure agentic loops end-to-end while isolating CPU and memory performance from the accelerator. The framing is that agentic AI has driven heavy CPU interest over the past six months but still lacks solid, repeatable benchmarks. The available excerpt contains no test list, no scores, no hardware results, and no numbers; the methodology detail sits behind the Premium paywall.

Why: There is nothing here you can act on for a purchasing or sizing decision yet — no throughput figures, no CPU models, no token or tool-call rates — so don't cite it in a hardware justification. The one usable takeaway is the framing: if you run agents without a GPU (self-hosted on a VPS, on-prem, or local), the claim is that CPU and memory behaviour inside the agent loop is the thing to isolate and measure, so build your own micro-benchmark around your actual loop (tool-call orchestration, tokenization, sandbox/process spawning) before assuming an accelerator is the binding constraint.