AI Weekly Malaysia

David Horn argues that software engineers repeatedly reinvent concepts from older disciplines—statistics became 'data science,' crypto speedran finance history, Silicon Valley reinvented bus stops—without studying the originals. He sees the same pattern repeating with AI agents, where engineers are intuiting that managing multiple agents resembles managing engineering teams, but are not consulting existing management literature.

Why: If you're building AI agent workflows, the article's core point is that the leadership/management intuition you're developing about orchestrating agents is not new—decades of management science already cover delegation, feedback loops, and team coordination. Before designing your own agent orchestration patterns from scratch, check whether established management frameworks map onto your problem.

Simon Willison built CORS Chat, a browser-based tool for chatting directly with any OpenAI Responses-compatible API endpoint that supports CORS headers. He used it to test Qwen 3.8 27B running in LM Studio on an M5 MacBook Pro and an NVIDIA DGX Spark, with conversations persisted locally and exportable as JSON. It also progressively renders SVG images while tokens are still streaming.

Why: If you run local models via LM Studio (with the --cors flag) or use OpenRouter, this gives you a zero-backend, browser-only chat UI for testing endpoints—useful for quick model evaluation without spinning up a separate frontend. The progressive SVG rendering detail is worth noting if you build streaming UIs.

Apple denied developer Sean Byrne access to App Store Connect after an automated match against a U.S. government Consolidated Screening List entry for a 'Sean Byrne' in County Sligo, Ireland — an entity that appears to be a fabricated employee from a 2009 aircraft-parts export prosecution. Despite Byrne providing his passport, driver's license, and pointing out he has no connection to the listed address or company, Apple has not responded to his appeal.

Why: If you ship apps through App Store Connect, you are subject to automated sanctions screening with no apparent human escalation path — a false positive can lock you out of your livelihood indefinitely. Malaysian and non-U.S. developers should be aware that this screening covers international lists, not just U.S. persons, and that Apple's process offers no documented timeline or appeal mechanism once a match is flagged.

Anthropic announced a text watermarking scheme for Claude that modifies inconsequential word choices (e.g., picking 'cold' over 'gray' when meaning is unchanged) to comply with the EU AI Act, based on Google DeepMind's SynthID-Text technique. The watermark uses a separate randomness source detectable with a digital key, and other AI model makers are expected to deploy similar approaches.

Why: If you ship LLM-powered products to EU users, watermarking will likely become a compliance requirement you can't opt out of — and since it alters token sampling, it could subtly affect output quality or determinism in ways that break evals or downstream pipelines. Builders using Claude (or eventually other models) should test whether watermarked outputs behave differently in their specific use cases, especially for tasks sensitive to word choice like summarization or classification.

Apple submitted a court-ordered proposal to charge 15% commissions on purchases made via external links inside iOS apps, with 5% for small business developers, 10% for certain partner programs, and 10% for subscription renewals. The Supreme Court rejected Apple's bid to delay, forcing the disclosure after Apple had previously imposed a 27% external-link commission that the court found problematic. Apple compared its rates to Google Play's 20% standard, 15% special program, and 10% subscription renewal link-out fees.

Why: If you ship an iOS app and route payments through external links, these proposed rates determine your unit economics: 5% if you qualify as a small business developer versus 15% standard. Founders should model both scenarios now and check whether their app qualifies for the small business or partner program tiers before finalizing pricing.

Hyperscalers (Amazon, Google, Meta, Microsoft) are betting heavily on natural gas to power AI data centers, with Meta planning a 7.5GW plant in Louisiana, Amazon 7.6GW in Texas, and Microsoft and Google each building gigawatt-scale gas plants in Texas. Energy research firm Noreva forecasts natural gas prices could triple above $10/MMBtu in certain U.S. hubs (from ~$2-4.50 today), as hyperscaler demand collides with declining supply growth and rising LNG exports.

Why: If fuel costs double or triple, cloud compute pricing for AI workloads could rise materially since fuel is roughly half the cost of electricity from large gas plants. Founders and developers running GPU-heavy workloads on AWS, Azure, or GCP should model scenarios where cloud inference and training costs increase, and consider cost-optimization strategies like spot instances, model distillation, or multi-cloud arbitrage before locking into long-term cloud commitments.

Cloudflare announced new Cloudflare One capabilities to detect and control MCP (Model Context Protocol) traffic on corporate networks. The core problem: employees can connect AI agents (Claude Code, Codex, Cursor, VS Code) to arbitrary MCP servers with a single line of config, and the resulting HTTPS traffic has no distinguishing hostname or path pattern, making 'shadow MCP' usage hard to spot. Cloudflare Gateway now uses protocol signals to identify this traffic and enforce routing through approved MCP Server Portals.

Why: If you are shipping or using AI agents that connect to MCP servers, your existing permission models were designed for humans who pause on unexpected results and act at human speed. Agents act non-deterministically and can repeat a bad tool call thousands of times before anyone notices. You should decide now whether your team needs network-level visibility into which MCP servers agents are calling, especially if employees can self-configure connections without approval.

Grab PayLater can now be used at any physical merchant displaying a DuitNow QR code, not just Grab-specific QR standees. The feature is rolling out to a whitelisted group of users, who also earn up to 2x GrabCoins when paying via PayLater on a DuitNow QR code.

Why: If you build or sell into Malaysian retail payments, BNPL is now effectively universal at the point of sale via DuitNow QR—any merchant with the standard national QR code is a potential BNPL checkout. SaaS founders in POS, e-commerce, or fintech should evaluate whether their flows or merchant onboarding need to account for Grab PayLater as a payment rail alongside standard DuitNow QR processing.

OpenAI, Google DeepMind, Anthropic, and Chinese firms like Alibaba and ByteDance are expanding aggressively in Singapore, with fresh AI hires earning S$70,000–S$90,000 and PhD-level specialists pulling S$200,000–S$350,000+. OpenAI committed S$300M+ and opened its first Applied AI Lab outside the US with 200+ planned technical roles, while roughly 50 Chinese AI firms have set up Singapore operations since 2024—though the article questions how durable that commitment is, noting some may simply be acquiring a Singapore address for Western market access.

Why: Malaysian developers and AI engineers now have concrete salary benchmarks for the regional market one border away—use these numbers when negotiating remote or relocation offers to Singapore. Malaysian startups competing for ML talent should expect upward pressure on local compensation and plan retention strategies accordingly, since the talent pool is shared.

OpenAI launched 'Computer History,' an opt-in feature for the ChatGPT macOS desktop app that records clicks, typing, keyboard shortcuts, and app switches to build timeline-based memories for ChatGPT. It replaces the earlier screenshot-based 'Chronicle' with input-event capture, storing files unencrypted locally for 48+ hours, with OpenAI warning other macOS user-level programs can access them. Available to Pro, Business, and Enterprise users (not EEA, UK, Switzerland, API, or Bedrock users).

Why: If you use the ChatGPT macOS desktop app on a Pro or Enterprise plan, this feature is off by default but can be enabled by admins or individuals—know what it captures before turning it on, since unencrypted local files containing your keystrokes and clicks are accessible to other processes running as your macOS user. Builders shipping agent tools should note this as another prompt-injection attack surface where sensitive user activity flows into LLM context.

Researchers at Reco have tracked an attacker dubbed "City-Forum" spending over a year harvesting data from over-permissioned Salesforce and ServiceNow guest portals worldwide, targeting telecoms, banks, cybersecurity firms, and public sector bodies since at least March 2025. The attacker used custom tooling against Salesforce Lightning Web Runtime sites via the UI API's GraphQL layer and a little-documented ServiceNow Service Portal search endpoint, exploiting misconfigured guest permissions rather than platform vulnerabilities. The busiest target logged over 560,000 enumeration events from the attacker's IP.

Why: If you ship customer or partner portals on Salesforce or ServiceNow, audit your guest user permissions and disable self-registration where possible—this campaign proves over-permissioned guest accounts are being actively and systematically raided right now. The attack vector is configuration, not a CVE, so no patch will save you; only tightening guest access and reviewing what records guests can read will.

Cloudflare's Certificate Transparency Monitoring is now generally available after being in beta since 2019, covering over 650,000 domains. The GA release fixes a major noise problem by filtering out alerts for certificates Cloudflare issues and renews on your behalf, so you only get notified about unexpected external certificates.

Why: If you previously disabled CT Monitoring because of spam from routine Cloudflare certificate renewals, you should re-enable it now; the GA version only alerts you to certificates issued outside Cloudflare, which is critical as certificate lifespans shrink to 47 days by 2029 and renewal frequency increases.

Ryanair signed a five-year Google Cloud deal covering Gemini Enterprise, Google Workspace, AlphaEvolve, and WeatherNext, weeks after renewing AWS for another five years. The airline is running a dual-cloud resilience strategy across 35,000 staff and 647 aircraft, targeting 300 million passengers by 2034, with critical systems able to switch between providers during outages.

Why: This is a concrete enterprise case of multi-cloud failover using the AWS-Google Cross-Cloud Interconnect that was announced last year—if you're evaluating whether dual-cloud resilience is practical or just marketing, Ryanair's deployment across flight ops, crew logistics, and forecasting is a reference architecture to study. It also shows Gemini Enterprise agentic AI being used for real operational decision-making (crew scheduling, maintenance planning), not just chatbots.

Twitch has added a 'Training for Generative AI' opt-out toggle in channel settings, but it is enabled by default—meaning all channel content (livestreams, VODs, clips, highlights, text, images, and chat messages) is fed into Amazon's generative AI models unless a streamer manually disables it. Twitch CPO Mike Minton openly admitted the default-on choice was because 'if it was opt-in, nobody would opt in,' and confirmed Amazon has already been using Twitch data for AI training since at least 2024. Opting out only covers future model improvements, not data already ingested, and chat messages you post in another streamer's channel are governed by their setting, not yours.

Why: If you stream or build tools on Twitch, you should go into channel settings and disable 'Training for Generative AI' now if you don't want your content feeding Amazon's models—but understand this only stops future use and doesn't retroactively remove anything already trained. For Malaysian creators and builders using Twitch as a platform, this is a concrete data-rights decision point, not a theoretical one, and the chat-message cross-channel wrinkle means your audience's messages in your channel are your responsibility to protect.

OpenAI is previewing an 'Ultrafast' API tier for GPT-5.6 Sol that delivers up to 14× the speed of Standard processing, generating up to 750 output tokens per second. The service is powered by Cerebras inference hardware, marking a notable infrastructure partnership for OpenAI. It launches first via the OpenAI API.

Why: If you build latency-sensitive AI features (real-time agents, voice assistants, interactive copilots), 750 tokens/sec is a concrete threshold that could shift your architecture from streaming-with-spinners to near-instant full responses. The Cerebras partnership signals that non-NVIDIA inference silicon is reaching frontier-model production, which matters for cost and vendor-lock-in planning. Malaysian builders shipping API-based products should benchmark whether Ultrafast pricing justifies migrating workloads currently on Standard tier.

SK Hynix is investing $720 billion to build the world's largest network of memory factories at its Yongin Cluster, with production starting in February. The company now controls 58% of the high-bandwidth memory (HBM) market and its market cap has topped $1 trillion after a fivefold jump in the past year. South Korea's president is pushing both SK Hynix and Samsung to expand capacity under a national plan backed by at least $22 billion in chip support.

Why: HBM supply constraints directly drive GPU scarcity and cloud compute pricing for anyone training or deploying AI models. If SK Hynix's Yongin fab comes online as planned in February, HBM supply could loosen, potentially easing GPU availability and cost for AI builders. Founders budgeting for AI infrastructure should track this timeline rather than assuming current compute costs are permanent.

Cisco CEO Chuck Robbins told the Q4 earnings call that Anthropic's Mythos bug-finding model is driving a network refresh 'supercycle,' as customers rush to replace unsupported (past LDOS) networking equipment they now consider too risky to operate. Robbins said buyers are pulling from security budgets to fund replacements, and cited quantum-readiness and AI network demands as the other two factors. Cisco reported $17.3B Q4 revenue (up 17%) and $63.3B for the year (up 12%).

Why: If AI bug-finding models like Mythos are systematically surfacing vulnerabilities in unsupported hardware and software, any builder running past-end-of-life infrastructure (routers, switches, firewalls, even old library versions) faces a shrinking window before those flaws become public. Audit your stack for components past their last support date and budget for replacement now—before a model finds the bug for you.

Tencent disclosed it spent $53B in capex last quarter and could rent that compute at 30%+ profit margins almost immediately, but is instead building its own models and selling tokens through products like WorkBuddy (an agent swarm) and CodeBuddy (code generation). It released the 295B open-weight Hunyuan-3 in July and says Hunyuan-4 will be larger and more capable, with products being co-designed around it.

Why: Tencent is publicly betting that selling AI tokens through applications is more lucrative than renting raw compute — a signal for SaaS founders on where margin sits in the AI stack. The 295B open-weight Hunyuan-3 is available now for builders who want a Chinese-ecosystem alternative to Llama, and Tencent Cloud's active push of CodeBuddy for cloud migration means teams evaluating Tencent Cloud should ask how bundled AI tooling affects their pricing and lock-in.

Tencent reported spending $53 billion on capex in Q2 and said it could recover depreciation almost immediately by renting compute at 30%+ profit margins, but is instead allocating that capacity to build its own models and AI applications for longer-term returns. It released the 295-billion open-weight Hunyuan-3 in July, with Hunyuan-4 promised as bigger and more capable, and is shipping agent products like WorkBuddy (agent swarm) and CodeBuddy (code generation tool tied to cloud migration).

Why: Tencent's choice to forgo instant 30%+ compute-rental margins in favor of selling tokens through its own applications is a concrete data point for SaaS founders weighing infrastructure-as-a-service vs. product-layer AI businesses. The open-weight Hunyuan-3 (295B params) is available now for teams evaluating non-Western foundation models, and CodeBuddy's role in accelerating Tencent Cloud migration suggests the vendor is using AI tooling as a cloud lock-in lever.

JetBrains CTO Vladislav Tankov describes how his team evaluates frontier LLMs against private repositories, including their monorepo, rather than trusting public benchmark scores. Claude Fable 5 posted a 44.3% Python pass rate in JetBrains' suite versus 28.2% for Opus 4.8, solving 18 tasks Opus missed while losing only 2, and despite higher per-token cost, delivered lower cost per task on complex long-running work.

Why: If you're shipping AI-assisted coding features, JetBrains' approach is a concrete template: build eval sets on your own private codebase, track separate leaderboards for quality/cost-per-task/speed, and measure cost-per-task (not per-token) because a more expensive model can be cheaper on complex work. The 16-point pass-rate gap between Fable 5 and Opus 4.8 on real code is large enough to justify re-evaluating your current model choice.

Anthropic has begun inserting invisible watermarks into Claude's editorial text outputs to comply with the EU AI Act's Transparency Code, which requires AI-generated or AI-edited content to be machine-identifiable. Some users on Reddit are upset, arguing the system will disproportionately catch casual users rather than sophisticated ones who paraphrase or route outputs through other AI services.

Why: If you ship products or workflows that surface Claude-generated text to end users — especially in EU markets — you should now expect that text to carry machine-detectable provenance signals. This affects compliance posture for SaaS products that embed Claude outputs, and it changes the calculus for anyone using Claude for drafting, summarization, or editing in workplace or academic settings where AI use is restricted.

A 16-year-old SQLite write-ahead log (WAL) checkpointing bug caused recurring database corruption in Tailscale's tailnet infrastructure starting August 2025, taking six months to diagnose. Tailscale funded SQLite maintainers to build a new virtual file system logging tool to reproduce the issue, which engineer Alex Chan described as resisting all initial debugging attempts including checks on POSIX locks, memory management, and thread safety.

Why: If you ship SQLite as a primary database under continuous backup snapshots, this postmortem is a concrete lesson in how deep storage-layer bugs can masquerade as application-level corruption for months. The debugging methodology—systematically ruling out POSIX lock, memory, and threading theories before isolating checkpointing—is worth studying before you hit a similar wall. The fact that SQLite maintainers themselves had to write new tooling to reproduce it should reset expectations about how 'reliable and well-known' doesn't mean 'bug-free' for critical infrastructure.

Twitch will now use creators' livestream content to train Amazon's generative AI models by default, requiring streamers to manually opt out. During a stream to nearly 3,000 users, Twitch CPO Mike Minton explicitly admitted the policy is opt-out rather than opt-in because 'if this was opt-in, nobody would opt in.' Twitch framed the change as adding an opt-out setting rather than announcing new AI training, causing confusion over whether content had already been used.

Why: If you build platforms with UGC, this is a concrete example of the opt-out-vs-opt-in design choice becoming a public trust crisis—Twitch's own CPO admitted the default exists to harvest data creators wouldn't voluntarily give. For AI/ML practitioners, it signals that large-scale training data acquisition is increasingly shifting to owned-platform scraping (Amazon on Twitch, Meta on Instagram) rather than open-web crawling, which affects where data licensing and consent debates go next.

Cognition, maker of the AI coding agent Devin, is reportedly in talks to raise at a $40B valuation, up from $26B just three months ago. The new valuation hinges on reaching a $1B annualized revenue run rate, double the $492M ARR it reported in May, with enterprise usage growing 50% month-over-month. Customers include Mercedes-Benz, NASA, and Goldman Sachs, with Devin primarily used for long-tail grunt work like legacy modernization and platform migrations.

Why: The revenue trajectory ($492M to $1B ARR in months) signals enterprises are paying real money for AI agents that handle migration and modernization grunt work, not greenfield development. If you're building AI coding tools or agents, the proven willingness-to-pay is in tedious legacy work, not replacing core developer workflows. For SaaS founders, the $40B valuation at $1B ARR implies a 40x revenue multiple, which sets a benchmark for what investors will pay in this category.

CoreWeave's Q2 2026 revenue doubled YoY to $2.575B, but operating expenses of $2.624B produced a $49M operating loss and $626M net loss, with total debt at $35.6B. 93% of revenue growth came from existing customers, and just three customers accounted for 72% of quarterly revenue. CEO Michael Intrator pitched AI compute as a continuous recurring loop (training, inference, evaluation, redeployment) rather than a one-time training cost, with managed inference services targeting $250M ARR by end of 2026.

Why: If you rent GPU capacity from neoclouds like CoreWeave, this signals pricing and service-model shifts ahead: they are pushing up-stack into managed inference and are financially stretched enough that contract terms or availability could change. The extreme customer concentration (three clients = 72% of revenue) and $35.6B debt mean builders should avoid single-provider lock-in for critical inference workloads and evaluate whether the 'continuous compute loop' framing matches their actual usage pattern before committing to long-term contracts.