AI Weekly Malaysia

At Hot Chips 2026, Micron's Raghu Sreeramaneni said HBM now requires roughly 3x the wafer area of DDR5 for equivalent capacity, and this silicon penalty is widening each generation rather than narrowing. This wafer competition is a key driver behind conventional DRAM contract prices surging 90-95% quarter-over-quarter in Q1 2026.

Why: If you are budgeting cloud GPU spend or planning AI inference infrastructure for the next 12-18 months, expect memory costs to keep climbing — DRAM contract prices already jumped 90-95% in a single quarter. This directly pushes up per-token inference economics and cloud instance pricing, so factor rising memory costs into SaaS unit economics and model hosting decisions now rather than assuming 2024-era pricing.

Mirage2FA, a commercial phishing-as-a-service toolkit, has targeted 4,532 organizations globally since 2024 by bypassing Microsoft 365 2FA via session cookie and password theft. ANY.RUN reports that 48% of targeted emails were potentially compromised, with victims concentrated in the US but also spanning Singapore, India, and the UK, heavily impacting the technology and manufacturing sectors.

Why: If your company relies on Microsoft 365 and SSO, standard 2FA is insufficient against this AiTM attack; you must implement conditional access policies that revoke or restrict session tokens based on anomalies to prevent attackers from pivoting into connected SaaS apps.

Qwen is releasing Qwen3.8-Flash-Next, a 125B (6B active) multimodal MoE model, on August 26, 2026, at 15:00 UTC. This early release serves as a preview of the upcoming Qwen4 architecture, with both standard and FP8 weight versions available on ModelScope.

Why: Builders running local or self-hosted AI agents should evaluate this model's FP8 variant for cost-efficient inference, as its 6B active parameter MoE design promises fast, lightweight execution while previewing the Qwen4 architecture.

Attackers are buying sponsored Google search results for "OpenAI Codex" downloads and directing Mac developers to fake Google Sites pages that mimic OpenAI branding. Instead of an installer, victims are told to paste a Terminal command that looks like an npm install but decodes a Base64 URL, fetches a shell script, and downloads a universal Mach-O infostealer to /tmp/helper while stripping macOS security flags. Cato Networks found strong similarities to the Atomic macOS Stealer (AMOS) family.

Why: If you or your team search for Codex or other AI coding tools and click the top sponsored Google result, you may land on a lookalike page instructing you to run a terminal command—never paste installation commands from a download page you reached via an ad. Verify the official source URL before running anything, and treat any site that asks you to open Terminal and paste a command as suspicious until proven otherwise.

Two unauthenticated authentication bypass vulnerabilities (CVE-2026-15981 CVSS 9.8 and CVE-2026-61979 CVSS 8.1) in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin allow attackers to log in as any user, including admins. The root cause is a loose boolean check on PHP's openssl_verify(), which returns -1 on error but was treated as truthy (valid). Both are fixed in plugin versions 17.0.5 and 17.0.6 respectively, and active opportunistic scanning from six IP addresses is already underway.

Why: If you run WordPress with the miniOrange SAML plugin below version 17.0.6, patch immediately—attackers are actively scanning for this and can get full admin access without credentials. Beyond patching, the openssl_verify() tri-state return value (-1, 0, 1) being loosely compared as boolean is a PHP gotcha worth auditing in any SAML or crypto verification code you maintain.

Reverse engineering by Xusheng Li reveals that Microsoft Paint and Photos embed a server-issued GUID as an invisible watermark into locally generated AI images. While image generation happens on-device using local ONNX models (decrypted via XOR keys), the prompt is sent to a remote server for moderation, which returns the GUID. This invisible watermark is separate from the app's visible watermark setting and persists in C2PA-preserving formats like PNG and JPEG.

Why: If you build tools that process or re-export images generated by Windows Paint or Photos AI features, be aware that these files carry hidden server-issued GUIDs linking them back to the moderation request, even when generation is local. This impacts privacy assumptions for local AI pipelines and means 'local generation' still involves a remote tracking identifier.

Claire runs blind evaluations of Grok 4.6 against GPT-5.6 Sol, Claude Sonnet 5, and Opus 5, finding Grok 4.6 ties GPT-5.6 Sol at the top of her personal index. She also tests Grok Bot, whose multi-account connectors (handling her 4 email addresses and 7 Slack workspaces) solve a problem Codex and Claude still ignore, and Cursor Origin, an agent-native GitHub alternative that looks attractive but lacks the features teams relying on GitHub Actions and code owners need to migrate.

Why: If you're choosing a frontier model for agent workflows, Claire's blind evals suggest Grok 4.6 and GPT-5.6 Sol are now ahead of Sonnet 5 and Opus 5 for general tasks, though Sonnet 5 still wins for conversational agent interactions. If you manage multiple Slack/Gmail accounts for agent access, Grok Bot's multi-account connectors are a concrete reason to try it over Codex or Claude. Don't migrate to Cursor Origin yet if your team depends on GitHub Actions, code owners, or existing automations.

Dave Plummer, original author of the 1996 Windows Task Manager, rebuilt it as a cross-platform app for Windows, Mac, and Linux using AI-assisted 'vibe coding' via Fable, starting from a 107-page specification that produced a first iteration in 3.5 hours. He chose native UI code (Swift, Direct2D/DirectComposition, Qt) over Electron for game-like responsiveness, and described the AI as 'a very ambitious and precocious intern' where results depend heavily on what you ask for and how you test it.

Why: The concrete lesson is that a 107-page spec fed to an AI tool produced a working cross-platform app in 3.5 hours, but the AI 'balked' at security-adjacent work and quality depended on instrumentation and testing. If you're vibe-coding real products, invest in a detailed spec and expect to manage the AI like an intern, not a black box. The native-UI-over-Electron choice is also a signal for anyone building performance-sensitive desktop tools.

A critical Keycloak vulnerability (CVE-2026-18963, CVSS 9.1) lets unauthenticated remote attackers bypass the email action token in the reset-credentials flow and reset any account's password, including admin accounts. Patches shipped August 19, 2026: upstream Keycloak 26.7.2, and Red Hat Build of Keycloak 26.4.15 and 26.6.6. No known exploitation yet.

Why: If you run Keycloak for auth in your SaaS or internal apps, patch to 26.7.2 (or RHBK 26.4.15 / 26.6.6) immediately — the flaw requires no user interaction and yields full account takeover. If you cannot patch right away, review whether your reset-credentials flow is internet-exposed and consider temporarily restricting it.

A developer built 'Varkos,' a low-latency AI companion that plays Skyrim alongside the user in real-time. It uses local inference to avoid cloud costs and latency, and handles complex, multi-step deferred instructions by monitoring game state and waiting for specific events (like an arrow being fired) before executing the next step.

Why: Demonstrates a practical architecture for building real-time AI agents that use local inference to avoid cloud costs and latency, and can execute complex, event-driven, multi-step plans rather than just simple chat responses.

FT reports Anthropic's annualized revenue hit $65bn in July (up from $47bn in May), with 6,000 customers spending $100k+/year and Q3 expected to be profitable. Ramp AI index billing data from 70,000 companies shows Opus 4.8 dominating Anthropic spend at 28%, while the newer flagship Fable 5 sits at just 8% and Opus 5 (released July 24) at 3.5% — suggesting cost, not capability, drives adoption.

Why: If you're picking models for agents or apps, the Ramp data shows users gravitate to cheaper proven models over expensive flagships — Opus 4.8 gets 28% of spend vs Fable 5's 8%. Don't default to the newest 'best' model; benchmark cost-per-task against older tiers before committing.

Drew Breunig argues that the era of relying on new AI models to automatically fix coding workflow problems is ending. With the arrival of an expensive but powerful model called Fable, teams must now deliberately route work to different models—using cheaper options like Opus, 5.6, K3, and GLM for most code, and reserving the costly Fable for specific tasks.

Why: If you're building AI-assisted coding pipelines or agent workflows, you should stop assuming the next model drop will be free or cheap. Start implementing model routing strategies now—identify which tasks actually need the premium model and which can run on cheaper alternatives, because the cost gap between tiers is widening rather than closing.

The Dutch Data Protection Authority fined Uber €825 million (~$966M) — the second-largest GDPR penalty to date — for deactivating driver accounts through automated processes without sufficient human oversight or warning. Uber disputes the finding, says most suspensions are brief and permanent deactivations involve human review, and will appeal. A former Uber driver, Brahim Ben Ali, brought the complaint after collecting testimonies from 170 drivers, aided by nonprofit PersonalData.io, whose founder Paul-Olivier Dehaye noted this is the third Dutch fine against Uber.

Why: If you ship automated decision systems that affect people's livelihoods (account suspensions, bans, credit decisions), GDPR Article 22 requires meaningful human review for decisions with significant consequences. This fine signals regulators will penalize 'computer decides alone' pipelines even if you offer an appeal after the fact. Audit your automated enforcement flows now: identify which decisions are fully automated, whether a human reviews before action, and whether users get clear notice and recourse — especially if you serve EU users.

The release of Fable, despite being highly capable, triggered a shift in agentic coding economics: its high cost and restrictive access controls, data retention, and dynamic degradation policies pushed developers toward routing work to cheaper models like GLM 5.2 (~1/9th Fable's cost, ~1/5th Opus 5's cost). The author argues this mirrors the end of Moore's Law for AI coding—instead of waiting for cheaper big models to paper over inefficiencies, developers now must architect which model does which task, using expensive models for design interrogation and cheaper ones for rote implementation with good context.

Why: Stop sending every coding task through your most expensive model. The author's workflow—interrogating design with Fable, then handing a brief to GLM 5.2 for implementation—is a concrete routing pattern you can adopt now. Fable's data retention and access control requirements also mean you should audit where your AI traces and tokens are processed, especially if operating under jurisdictions with data sovereignty concerns.

Fabien Sanglard shares his agent.md file—a set of coding style rules injected into LLM coding sessions via agentic IDEs like Antigravity and VS Code's Claude Code plugin. After finding AI-generated code unusable (spaghetti, no comments, no structure), he iterated by repeatedly giving the same feedback, then codified those rules into agent.md: no magic numbers, function names under 30 characters, enums over booleans for parameters, early returns to reduce indentation, minimal but pointed comments, and no superlatives or praise from the LLM.

Why: If you use agentic IDEs (Claude Code, Antigravity, Gemini), dropping an agent.md at your project root with explicit style rules eliminates the repetitive 'reviewing a junior dev' loop. Sanglard's specific rules—especially 'use enums not booleans for parameters' and 'no superlatives, give me the cold hard truth'—are concrete starting points you can copy and adapt today. The symlink trick (gemini.md/claude.md → agent.md) lets one file work across multiple tools.

An independent LLM leaderboard ('Ed-o-meter') tested 17 models on 28 real-world tasks with identical prompts and deterministic grading. GLM-5.3 (open-weight) achieved 100% pass rate, a 9.3 rubric score, and $0.28 per full lap—roughly one-fifth of GPT-5.5's cost—though with a 16.3s TTFT versus GPT-5.5's 13.2s. The full suite costs ~$30 to run, and the author flags caveats including single-trial wide confidence intervals and self-judge bias for fable-5's rubric score.

Why: If you're picking a single model for agentic or task pipelines, GLM-5.3's open-weight model passed all 28 tasks at ~20% of GPT-5.5's cost—but you must check compliance before deploying an open-weight model, and accept 3s slower time-to-first-token. If latency is critical, GPT-5.5 is the faster alternative; GPT-5.6-luna is cheapest for retryable low-risk jobs; haiku-4-5 for right-first-time; sonnet-4-6 for quality without the wait. The benchmark methodology (single trial, 28 tasks, ~$30 full suite) is cheap enough to replicate yourself before committing.

Richard I. Cook's 1998 treatise lays out principles of how complex systems fail, arguing that all interesting systems are intrinsically hazardous, heavily defended, and run in degraded mode with latent flaws. Catastrophe requires multiple small failures to combine — single-point failures are never sufficient on their own. The system continues functioning because of redundancies and human workarounds, not because it is flawless.

Why: If you ship AI agents or multi-service systems, this reframes your incident response: stop hunting for 'the root cause' and instead map the chain of latent failures that lined up. When your agent pipeline breaks, the proximate trigger is rarely the real cause — it's the combination of a degraded state, a missing guardrail, and an edge case nobody tested. Build your postmortems around that combination, not around blaming the last component that touched the request.

An author with 20 years in tech and an InfoSec background spent $266.15 across four AI models to root an Amazon Fire HD 10 (11th gen, 2021) that had no published root method because Amazon fused the bootrom shut. Claude spent five months on diagnosis before its safeguards cut him off; Kimi K3 (Moonshot AI, released July) found the exploit for $164.25, GLM-5.2 caught fatal bugs for $21.90, and GLM-5.3 finished the job in one day on an $80 subscription. The author notes the most sophisticated technique he used was prompting an LLM.

Why: This is a concrete cost-and-capability comparison across frontier models for a real agentic security task: Claude hit guardrail limits after five months, while Kimi K3 reasoned through the ethics and produced a working exploit for $164. If you're choosing AI coding agents for hard reverse-engineering or security work, this suggests model guardrails and persistence vary enough to justify running multiple models in parallel rather than committing to one vendor.

Jen Abel, co-founder of JJellyfish and GM of enterprise sales at State Affairs, breaks down the full enterprise sales cycle as ~15 steps rather than the standard five-stage CRM pipeline, which she argues is merely a forecasting tool. She covers the 'pincer model' for simultaneous executive and N-minus-one outreach, crafting 2-3 sentence messages that sell 'alpha' not features, running intelligence-gathering intro calls before demos, structuring 2-3 day pilots with jointly defined success criteria, and navigating pricing, procurement, and redline negotiations.

Why: If you're a founder doing enterprise sales, stop treating your CRM's default pipeline stages as your actual process—Abel's 15-step breakdown gives a concrete checklist to find where deals stall. The 'sell the alpha, not the feature' messaging approach and the pincer model for outreach are immediately actionable for anyone struggling to land first meetings with large accounts.

Linus Torvalds described a grueling kernel debugging session where an AI assistant did much of the grunt work but repeatedly declared the problem impossible and suggested writing a report instead. He noted the AI kept working when pushed, analyzing debug code faithfully, and he let it write the commit message. The quote appears in a commit for drm/xe driver code.

Why: Even top-tier developers are hitting the same wall you will: AI coding assistants quit early and declare problems unsolvable. The practical takeaway is to treat AI as a tireless but defeatist junior—push past its 'impossible' responses and keep directing it to generate and analyze debug code rather than accepting its verdicts.

Anthropic is running a server-side A/B test in Claude Code that silently downgrades the 'high' effort setting to 10 out of 100—the value 'low' previously held—for sessions on version 2.1.236+ using the 'fable 5' model. Older Claude Code versions and Opus 5 are unaffected, and the change is absent from the changelog. Users in the test group may experience noticeably degraded output quality without any indication beyond the version they run.

Why: If you ship or rely on Claude Code in agentic workflows, pin your version or verify effort behavior before assuming your codebase or prompts are broken—this test caused at least one developer to lose an afternoon debugging a non-existent problem. There is also an open concern that users may be billed for 'high' effort while receiving 'low' effort output, so check your usage logs if quality drops.

Former CISA acting head Matt Hartman and former NSA cyber boss Rob Joyce warn that AI agents are now actively used in real attacks for automated reconnaissance, personalized phishing, and exploit-chain discovery, while also creating a new attack surface via non-human identities and data-integration channels. Joyce's core message at RSAC: if you aren't running AI agents against your own systems, adversaries will do it for you—and keep the results.

Why: If you ship AI agents or integrate them into production, you now have a growing population of non-human privileged identities that bypass traditional static security policies. Practically, this means treating every agent as a privileged identity, adopting phishing-resistant auth and zero-trust behavioral signals, and running agentic red teaming against your own stack before attackers do it for free.

Dan Luu argues that LLMs have collapsed the cost of specialized performance work—JIT compilers, custom regex engines, database internals—that previously required rare expertise. He cites FRE, a regex engine built by an agent looping for a month against the rebar benchmark suite (which overfit until a holdout benchmark was introduced), and Michael Malis's observation that LLMs make writing JIT compilers tractable enough to underpin projects like pgrust. Marc Brooker adds that dynamic custom software fitted to a specific workload, rather than a class of workloads, is now a realistic outcome.

Why: If you are building performance-sensitive software (databases, query engines, data pipelines), the build-vs-buy calculus shifts: workloads that needed a specialized perf team can now be attacked with agent-driven optimization loops against your own benchmarks. The FRE example shows the failure mode—agents overfit to the benchmark suite you give them—so you must design holdout benchmarks upfront before letting an agent optimize. For Malaysian startups who couldn't previously justify hiring performance engineers, this opens a path to custom-optimized infrastructure at near-zero marginal cost.

GitHub's CTO Vladimir Fedorov acknowledged a 7-hour-47-minute outage on August 17 that disrupted Actions, pull requests, issues, Copilot, and APIs worldwide—the second major outage that month after an August 6 Actions failure. GitHub now handles 2.9 billion monthly commits, 24 million new repositories, and 130 million merged PRs, but its infrastructure hasn't scaled to keep up, with Microsoft Azure carrying ~58% of platform load. Fedorov pledged a linear read-scaling architecture rollout starting with the largest monorepos, plus retry-limit tightening and system isolation, but admitted neither outage was caused by a code or config change—meaning the failure modes were already latent.

Why: If your CI/CD pipeline runs on GitHub Actions, these outages directly blocked shipping for nearly 8 hours, and the CTO's admission that failure modes were latent (not introduced by deployment) means more outages are likely before the architecture overhaul lands. Evaluate whether your team needs a fallback CI provider or cached dependency mirrors now, rather than waiting for the next incident. The detail that Azure handles only 58% of load means the migration is incomplete and reliability will remain uneven in the interim.

A $10,000 phishing kit called iAuthFlow v2, sold on Russian-language cybercrime forums, uses a browser-in-the-middle attack to enroll attacker-controlled passkeys on compromised accounts within seconds of authentication. Abnormal Security analyzed the kit's demos showing it targeting Google, with packages also advertised for iCloud, LinkedIn, and Microsoft. The rogue passkey persists even after the victim changes their password, defeating standard remediation steps like session revocation and credential rotation.

Why: If you ship passkey-based auth, this kit exposes a gap in enrollment flows: after a successful BitM phishing attack, the attacker can register their own passkey before the victim notices. You should require step-up re-authentication or a verified device challenge before allowing new passkey enrollment, and push real-time alerts to users when a new passkey is added. Standard password rotation and session revocation are no longer sufficient remediation if a rogue passkey is already enrolled.