AI Weekly Malaysia

RHB analyst Jeffrey Tan raised CelcomDigi's target price to RM3.70 (US$0.90) from RM3.50 after Q2 FY2026 results showed RM100M in quarterly operational savings (RM141M H1), about 30% of an upgraded RM470M FY2026 target. 90% of post-merger network integration is complete, with enterprise growth built around 5G, AI, cloud, and cybersecurity outpacing core mobile revenue.

Why: CelcomDigi is consolidating as Malaysia's largest telco with an explicit enterprise push into 5G, AI, cloud, and cybersecurity—Malaysian SaaS founders and developers building on local infrastructure should track their enterprise offerings and API/partner programs as potential integration or competition points as they shift from integration mode to growth mode.

A 36-page UC Berkeley case study by Merici Vinton, Melanie Girod, and Omar Morales traces the US IRS Direct File program from policy conception (2021) through its 2024 pilot launch to its shutdown in 2025. Direct File was a free government-run tax filing service that launched small, achieved high user trust in its pilot, and was ultimately shuttered despite positive results—framed as a leadership case study for high-stakes public-sector tech launches.

Why: For builders working on or pitching government digital services in Malaysia (e.g. MyDigital initiatives, LHDN e-filing, JPj digital services), the case study offers concrete lessons on navigating bureaucracy, the tension between compliance and user outcomes, starting with narrow scope before scaling, and the political fragility of even successful government tech products. The Direct File playbook in the appendix is a practical reference for anyone building citizen-facing public services.

Meta CEO Mark Zuckerberg published a 6,500-word essay titled 'The Future is for Everyone,' envisioning personal AI agents powered by Meta's models running on personal devices. TechCrunch's Equity podcast panel expressed skepticism, citing Meta's track record from the social media era—promises of connection that delivered ragebait and ads—and noting Zuckerberg is positioning himself as an 'anti-Dario' to Anthropic CEO Dario Amodei's caution.

Why: Meta is betting on on-device personal agents using its own models (including a new model called Glimmer) rather than frontier closed models, which signals where Meta sees developer and consumer distribution going. If you build AI agents or consumer AI products, Meta's open-model-plus-personal-device strategy is a competing platform path worth watching—but the article is mostly opinion, not technical or strategic detail you can act on yet.

An embedded engineer responds to Dmitry Grinberg's widely-discussed criticism of RISC-V, pushing back on what they see as a biased perspective despite acknowledging some valid technical complaints like compressed store offsets. The author switched their entire stack from STM32/ARM to RISC-V CH32 chips about a year ago and argues from that hands-on experience.

Why: If you're building IoT or embedded devices on a budget, the CH32V003 and similar RISC-V MCUs are a real cost-alternative to STM32/ARM, but this debate highlights genuine ISA-level tradeoffs you should understand before committing. The compressed store offset issue is a concrete gotcha worth knowing if you're evaluating RISC-V for production firmware.

A critical macOS Screen Sharing vulnerability (CVSS 9.8) is being actively exploited in the wild to gain remote root access and deploy Monero cryptojacking miners. CISA has elevated the bug's severity, though the article body itself contains no technical details beyond the headline.

Why: If you develop on macOS or manage Mac fleets, patch immediately and disable Screen Sharing where feasible—attackers are already using this for root-level compromise. However, the article provides no CVE ID, affected macOS versions, or patch details, so you'll need to find the actual advisory elsewhere before acting.

OpenAI's head of product design Ian Silber argues this is the best time to be a designer, noting that engineers have 10x'd with AI while design teams haven't. He shares his counterintuitive 'just do less' advice, discusses where humans still outperform AI (user understanding, invention, point of view), and outlines a vision of ChatGPT evolving into a super app.

Why: The claim that design teams haven't seen the same AI productivity leap as engineering teams is worth interrogating if you're building AI products or hiring designers — it suggests current AI tooling still under-serves design workflows, which is a gap to watch or build for. The 'just do less' framing and the human-edge list (user understanding, invention, POV) are useful for deciding where to invest human effort versus AI automation in product work.

A Google Scholar search for the exact phrase "kidney disappointment" reveals research papers that use this nonsensical term instead of "kidney failure," suggesting machine translation or AI-generated text artifacts have propagated into academic literature. The Hacker News post links to the Scholar query but the page itself returned a 403 error, so the full extent of the problem isn't documented in the source.

Why: If you use AI tools or automated translation to draft or edit research papers, technical docs, or any published content, you should verify domain-specific terminology manually—this is concrete evidence that AI-generated phrasing errors can survive into published academic work and be discoverable on Google Scholar. Builders shipping AI-assisted writing tools should consider terminology validation as a quality gate.

Corma, an AI defensive-security startup founded about a year ago by Alon Pluda, raised a $60M seed round led by Sequoia Capital with Khosla Ventures and Coatue. Pluda claims frontier models (Claude Opus 4.8, GPT-5.5, Grok 4.3, DeepSeek V4) are getting exponentially better at offensive security but lag at defensive tasks because most defensive work doesn't involve code scanning.

Why: The concrete takeaway is the claimed offensive-defensive capability gap in frontier models—if accurate, builders shipping AI agents for security or ops should not assume model proficiency at finding bugs translates to defensive orchestration. However, this is a CEO interview timed with a funding announcement, so treat the model-evaluation claims as unverified marketing until independent benchmarks appear.

Raymond Chen, a Microsoft veteran, clarified on his Old New Thing blog that PR descriptions are point-in-time persuasive writing aimed at convincing approvers to accept a change, while code comments are durable documentation about how the code works. The Register notes the distinction is timely given the volume of PRs and comments now generated by AI coding tools, some producing questionable annotations.

Why: If your team uses AI coding assistants, establish a review convention now: AI-generated PR descriptions often fail Chen's 'persuasive writing' test because they describe what the code does rather than why it should be merged, and AI-generated inline comments frequently state the obvious or are outright wrong. Reviewers should treat both with skepticism and require human-authored justification for non-trivial changes.

French startup Kog, founded solo by Gaël Delalleau, claims 30x faster LLM inference on conventional datacenter GPUs (AMD MI300X, NVIDIA H200) via software optimization. Its demo hit 3,000 tokens/second but only with a 2B-parameter model (Laneformer 2B, now open-sourced), and Kog admits customers won't fine-tune small models, so it is pivoting to accelerate larger models — a claim still unproven. The startup generated 200 business leads and is targeting software engineering workflows where Claude Code users wait hours for results.

Why: The 3,000 TPS demo is real but narrow — it runs on a 2B model, not the large models production teams actually use. Builders should treat the '30x faster' headline as aspirational until Kog shows results on production-scale models. The open-sourced Laneformer 2B is worth examining if you work on inference optimization, but don't change your serving stack based on this.

Microsoft is merging its consumer and work Copilot applications into a single entity, and pulling Mico—the anthropomorphic blob introduced less than a year ago as the face of Copilot Voice—out of the spotlight. Mico is being relocated to Learn Live, a voice-based study mode for tutoring, rather than being killed entirely. The move echoes Microsoft's history of abandoned persona assistants like Clippy, Cortana, and Microsoft Bob.

Why: If your team or product integrates with Copilot, the consumer/work app merger means you should expect API surface changes and consolidated licensing rather than two separate Copilot experiences. The Mico retreat signals Microsoft found that character-driven AI personas did not drive engagement in general voice use—relevant if you are debating whether to invest in anthropomorphic agent UIs versus plain functional interfaces.

A modder attached two desktop CPU coolers to a ZTE Nubia Z70 Ultra smartphone (Snapdragon 8 Elite SoC, 24GB RAM) and successfully ran The Witcher 3 at 1080p ultra settings, effectively using the phone as a gaming PC. The cooling modification was necessary to sustain peak SoC performance without thermal throttling.

Why: Demonstrates that current flagship mobile SoCs paired with adequate cooling can deliver desktop-class gaming performance, which is relevant if you are building or evaluating mobile-first game streaming, cloud gaming edge clients, or Android-based compute workloads. The Snapdragon 8 Elite with 24GB RAM is now in the same conversation as low-end discrete GPU setups for 1080p gaming.

Grab is testing a Women-Only Rides feature in Malaysia that lets female passengers match exclusively with female drivers, addressing safety concerns for women travelling alone or late at night. The feature requires verification, though the article text cuts off before detailing the full verification process.

Why: For founders building consumer-facing platforms in Malaysia/SEA, this signals that gender-safety features are becoming table-stakes in ride-hailing and gig platforms. If you operate a marketplace with similar trust dynamics, consider whether identity-verification-gated matching is worth implementing — Grab's rollout suggests user demand is strong enough to justify the operational complexity of segmenting supply and demand by gender.

Apple sent a new batch of spyware threat notifications on Thursday to users in 110 countries, bringing the total to over 150 countries notified to date. The notifications now appear directly on the iPhone lock screen as a push alert reading 'Apple detected a mercenary spyware attack targeted at your iPhone,' alongside updated guidance including enabling Lockdown Mode — a feature Apple says has never been bypassed in any known case.

Why: If you or anyone on your team receives one of these notifications (email, Apple ID login, or lock-screen push), the immediate action is to enable Lockdown Mode, which Apple says has zero known bypasses. Founders and developers working in sensitive sectors or regions should pre-familiarize themselves with Lockdown Mode's tradeoffs — it restricts iMessage attachments, web content, and incoming invitations — so they can act fast rather than researching under pressure.

Workday shares surged 18% and were halted multiple times on a Reuters report that private equity firm Silver Lake is in talks to acquire the HR software maker, whose market value exceeds $50 billion. Workday's stock had been pressured by fears that AI tools would upend its business model, and co-founder Aneel Bhusri was renamed CEO in March.

Why: For SaaS founders, this is a market signal that PE is still willing to bet on enterprise SaaS despite the narrative that AI will displace incumbents like Workday. If the deal materializes, it could reset valuations and M&A appetite in the enterprise software space, which affects exit expectations and fundraising leverage for founders building HR, finance, or workflow SaaS.

IBM and OpenAI announced a partnership to jointly market and build industry-specific AI solutions for financial services, government, telecom, and retail. IBM will integrate GPT-5.6, Codex, and ChatGPT Work into its IBM Consulting Advantage platform, train tens of thousands of consultants on OpenAI's stack, and create a group of 'Forward Deployed Experts' via OpenAI's Partner Network. This follows IBM's similar alliance with Anthropic less than a year prior, reflecting a model-agnostic strategy.

Why: If you sell AI solutions to enterprises in Southeast Asia, your clients may increasingly acquire OpenAI tooling through IBM Consulting rather than directly from you — factor this channel shift into your go-to-market. The mention of GPT-5.6 and Codex integration into a consulting platform signals what models enterprises will standardize on next. If you want into OpenAI's enterprise ecosystem, the Partner Network and Forward Deployed Experts program is a concrete entry point.

AWS authors walk through a continuous data loop using Strands Robots (Apache 2.0 SDK), LeRobot's on-disk dataset format (90,000+ datasets, 8,000+ publishers on HF Hub), and Hugging Face Storage Buckets (mutable, non-versioned, Xet-backed object storage announced March 2026) to record robot demonstrations, train policies on growing datasets, and deploy back to hardware like the SO-100/SO-101 arms. The core problem they address is that running this loop daily causes repeated full-dataset transfers to GPUs and redundant byte costs, which the Storage Bucket layer sitting in the hf:// namespace is meant to mitigate as a working staging layer between recording and training.

Why: If you are building robotics learning pipelines with LeRobot-compatible datasets, HF Storage Buckets give you a mutable staging layer that avoids re-copying the entire dataset to GPUs on every training run—a concrete cost and workflow decision. For everyone else, this is a niche robotics tooling walkthrough that doesn't require any change to what you ship.

Apple is reportedly in talks to pay publishers for content to power the upcoming Siri AI, proposing a variable pay-per-use compensation model rather than the industry-standard fixed licensing fees. The company has considered a nine-figure budget for these payments, with Siri AI expected to roll out later this year.

Why: If Apple normalizes pay-per-use content licensing for AI assistants, publishers and content platforms may start expecting similar variable-compensation deals from any AI product that ingests their data. Builders working on AI agents or assistants that surface third-party content should watch whether this model becomes a precedent that raises their own content-acquisition costs or creates new licensing obligations.

Anthropic updated Claude Tag, its Slack-integrated assistant, to read context across an entire channel rather than processing messages one at a time. The previous lightweight yes/no classifier is replaced with a four-option decision system (reply inline, start a thread, route to existing work, or stay silent), and Anthropic reports roughly 30% better accuracy in deciding when to proactively respond. The additional context does not count toward usage or spend limits on any plan.

Why: If your team uses Claude Tag in Slack, expect more unsolicited but context-aware interventions—test it in a low-stakes channel first to see whether the new proactive behavior helps or creates noise. If you were holding off due to spend concerns, the no-additional-cost framing removes that barrier, though it's worth watching actual token consumption over time.

Google unveiled the Pixel 11 lineup (Pixel 11, Pro, Pro XL, Pro Fold) with Gemini Intelligence, an agentic AI layer that works inside the OS to connect data across messages, calendars, maps, and other Google services and carry out multi-step actions like checking availability or starting reservations. Rick Osterloh said Gemini could eventually become the primary interface for phones and laptops, and noted memory shortages are pushing consumer electronics prices higher.

Why: For AI agent builders, the notable shift is Google pushing agentic AI into the OS layer rather than a standalone chatbot — if this pattern succeeds, it signals that consumer-facing agents will increasingly be embedded in platform ecosystems rather than shipped as independent apps. The memory shortage price pressure is a reminder that hardware costs for on-device AI inference may stay elevated.

Qualcomm has disclosed Snapdragon C specifications targeting $300 laptops, claiming 67% faster on-battery performance than Intel's N250. Notably, AC (plugged-in) performance figures were not provided, leaving a key comparison incomplete.

Why: If you spec or buy budget ARM laptops for development work or fleet deployment, the on-battery claim is promising but insufficient without AC numbers — wait for independent benchmarks before committing to Snapdragon C over Intel N250 for $300-class machines.

Researchers from Belgian and German academic institutions demonstrated at the 35th Usenix Security Symposium that commercial out-of-order RISC-V processors—specifically SiFive P550 and T-Head Xuantie C910/C920—are vulnerable to all major Spectre variants (PHT, BTB, RSB, STL), achieving up to 100% recall and 97%+ precision in proof-of-concept attacks. In-order RISC-V processors (SiFive U74, Xuantie C906, C908) appear unaffected.

Why: If you're evaluating RISC-V silicon for embedded or edge deployments, prefer in-order cores (U74, C906, C908) over out-of-order ones (P550, C910/C920) if Spectre-class side-channel leakage is a threat model concern. The T-Head Xuantie C910/C920 chips are Alibaba's designs and are among the more accessible commercial RISC-V parts in Asia, so builders sourcing from regional distributors should factor in that mitigations are not yet mature compared to the x86/ARM ecosystem.

A hacking and extortion group called Helix claims to have breached Uber Freight, exfiltrating mailboxes, cloud storage, accounts payable files, and dispatch documents dated around mid-June. Uber Freight says operations are unaffected and has not confirmed the breach. Google tracks Helix under the umbrella UNC6671 and reports the group has made at least $10.6 million in ransom payments between January and May 2026, primarily using voice phishing against IT helpdesks to reset employee passwords.

Why: The practical takeaway is the attack vector, not the victim: Helix gains cloud access by calling IT helpdesks and socially engineering password resets. If your team or startup operates a helpdesk or identity reset workflow, this is a concrete reason to enforce callback verification or MFA re-authentication before any password reset, rather than relying on the caller's claimed identity.

Oracle is reportedly planning another round of layoffs after already eliminating 21,000 full-time positions and spending most of its $2.1 billion restructuring budget. Some teams face double-digit percentage cuts, though the report does not specify which product lines or geographies are affected.

Why: If your stack depends on Oracle Cloud, Oracle Database, or Oracle-owned technologies (MySQL, Java via support contracts), continued deep restructuring raises the risk of degraded support response times and product roadmap uncertainty. Builders should evaluate whether critical workloads have viable migration paths or multi-cloud fallbacks before any service-level changes materialize.

Form Energy raised $750M to scale manufacturing of its iron-air batteries in West Virginia, which can discharge for up to 100 hours versus the few hours typical of most grid storage. Google is buying a 30GWh Form battery for ~$1B to power a Minnesota data center, and Crusoe ordered 12GWh, driven by AI data centers expected to quadruple U.S. electricity use by 2035. The batteries use iron instead of lithium/cobalt/nickel, with 80% of materials sourced from the U.S. to reduce China dependence.

Why: If you're building AI infrastructure or SaaS with heavy compute needs, energy availability and cost are becoming the binding constraint, not GPU supply. Malaysia's own data center boom (especially Johor) faces the same grid-capacity pressure this article describes for the U.S. — founders scaling compute-heavy products should factor multi-day power storage and renewable intermittency into long-term cloud cost projections, since hyperscalers will pass these energy costs through.