AI Weekly Malaysia

Cloudflare launched Turnstile Spin, an agent-mediated way to implement its CAPTCHA-free Turnstile challenge end to end: the agent creates the widget, embeds it on the frontend, and wires the Siteverify call into backend functions, plus repairs misconfigured widgets and migrates sites off other CAPTCHA providers. Normally Turnstile is a two-step manual job (render the widget, POST the token to Siteverify), and Cloudflare says it now handles roughly 3 billion verifications on a typical weekday, with more than 23,000 accounts creating a new widget in one recent week. Spin can be started from the Cloudflare dashboard, from Wrangler, or by pasting a public skill URL into an agent.

Why: If you ship sites with a coding agent and skip bot protection because the backend Siteverify step is fiddly, this removes that step - and it also fixes already-broken widget installs and migrates away from reCAPTCHA/hCaptcha. The decision to make deliberately: pasting a public skill URL lets an agent modify backend code and security config on your behalf, so decide whether that happens on a branch with review or directly against production before you point an agent at it.

The Dutch government is backing DAWO, an open community where government, industry and society jointly build a 'digitally autonomous workplace', organised as replaceable building blocks rather than one product: open/verifiable AI components, an operating system (DAWO-NixOS) with installation building blocks, autonomous and verifiable cloud infrastructure, and collaboration tooling for communication and documents. The site states five goals (digital autonomy, collaboration, security, innovation, verifiability) and that every part can be inspected and replaced; a public portal hosts calendar, news, blog and a forum where anyone can read but posting needs an account. The Hacker News thread drew 376 points and 165 comments. Note the page itself never mentions Microsoft — the 'alternative for Microsoft' framing comes from the submission title only, and the excerpt gives no pricing, migration timeline, or technical specs.

Why: The concrete shift to watch is the packaging: named component categories (AI, OS, cloud, collaboration) that are explicitly 'inspectable and replaceable', with a NixOS-based workplace image. If you sell or pitch software into public-sector or regulated buyers, this is a template for what those buyers may start asking for — swappable, verifiable components instead of one suite — which changes how you scope and price a proposal. For developers running device or workstation fleets, DAWO-NixOS is worth a look specifically because it is a reproducibility play, not a desktop-theming play. Treat it as a directional signal only: there are no dates, no budget figures, and no indication of which Dutch agencies have actually migrated.

Runway's GWM Worlds 2 is a research preview that it describes as an "autoregressive diffusion" model, turning high-fidelity video and audio generation into real-time interactive simulation. Its new WorldPrompt input format lets you fix parts of a scene (including the first frame) and then drive timestamped events or actions, even prompted live — a control layer for characters, cameras and environments, similar to scripting a game. Latent Space interviewed Runway CTO Kamil Sindi and Principal Research Scientist Robin Kahlow, and notes Runway's reported $5.3B valuation from a $315M raise in February, with rivals including Google DeepMind's Genie 3 (720p/24fps, limited to a few minutes of continuous interaction), Odyssey-2 Pro and World Labs' RTFM.

Why: WorldPrompt's timestamped-event format is the concrete thing to study here: if you are prototyping interactive video or audio experiences, it is a candidate control interface (fix first frame, then script timed actions) rather than a prompt-and-hope text box. But this is a research preview with no stated API, pricing, or general availability, and the closest comparison — Genie 3 — is documented at only a few minutes of continuous interaction, so treat real-time world models as experiment territory, not something to put in a product roadmap this quarter.

On September 4, 2026, security researcher Oren Yomtov from Accomplish reported a bug-bounty finding that a customer on a Workers Paid account could recover residual disk blocks previously used by other customers' Cloudflare Containers on the same host. The cause was dm-thin thin provisioning with a 64 KiB thin-block size and the skip_block_zeroing option, so when a deleted container volume's blocks were reassigned, a partial write left the rest of the block holding prior data. Cloudflare says it remediated the Containers fleet with no customer-side configuration changes, found no evidence of malicious exploitation, and notes the technique could not target a specific customer, workload, host, or data.

Why: If you run Cloudflare Sandboxes (built on Containers) for AI agent code execution, there is nothing to change on your side, but the underlying lesson transfers: any self-hosted sandbox stack using Firecracker plus dm-thin should check whether skip_block_zeroing (or an equivalent zeroing bypass) is enabled, because it trades write throughput for the risk that a deleted tenant volume's blocks are handed to another tenant unzeroed. If you build on a platform with this class of isolation, the decision to make now is whether you need per-tenant evidence of block zeroing or separate storage pools, rather than assuming volume deletion equals data destruction.

LiquidAI released LFM2.5-VL-DSpark, an experimental speculative-decoding draft model for its 3B vision-language model LFM2.5-VL-3B. The 279.5M-parameter drafter (4 layers, ~8.9% extra parameters over the target) reports decode speedups of 2.30x–3.13x with MLX on an M5 Max and up to 2.66x on an H100, with end-to-end latency gains of 1.56x–2.62x on-device. Day-one integrations ship for llama.cpp, MLX-VLM, and SGLang, with a recommended block size of 8 or 9 depending on hardware.

Why: If you serve image or document workloads locally (or on a single GPU), the trade here is concrete: +280M parameters for roughly 2–3x faster decoding, measured across six vision tasks (general VQA, text VQA, captioning, chart VQA, reasoning, multi-turn) via the MMSpec benchmark. The practical decision is whether your serving stack can host a second draft model for that gain — and since llama.cpp, MLX-VLM, and SGLang support landed on day one, you can benchmark it against your own image workload instead of taking the vendor's task list on faith. Note the source text truncates the llama.cpp/M3 Ultra end-to-end figure at 1.30x, so the on-device end-to-end range is only fully stated for MLX.

Meta's Muse AI personal agent hit the top of Apple's App Store within two weeks of launch, eclipsing ChatGPT, and Meta stock rose more than 20% over that period, per CNBC. Ahead of Meta Connect, Amazon has blocked the Muse app from its site, while investors have marked down financial services and online travel stocks on expectations that agents like Muse will absorb bookings and form-filling. Meta is pitching Muse for booking appointments and travel, filling out electronic forms, and monitoring home security cameras.

Why: If you run booking, travel, or form-heavy flows, Muse's stated capabilities are aimed straight at the screen your users currently fill in themselves — and CNBC reports the market already repriced financial services and online travel stocks on that basis. The Amazon block is the more actionable detail for builders: an AI agent's distribution can be switched off by a single platform, so treat any single app-store or marketplace channel as a risk, not a strategy. The text contains no Malaysia-specific detail, so any local impact is unconfirmed rather than established.

GitGuardian's 2026 State of Secrets Sprawl Report, cited in a Hacker News piece, found that commits identified as AI-assisted leak secrets at roughly twice the rate of human-written commits, and that most of the fastest-growing categories of leaked credentials now relate to AI services. The article argues coding agents accelerate sprawl because they read whole projects, write configs, call APIs, and touch Model Context Protocol (MCP) servers — each capability adding another place a credential is needed and another path it can spread. Its proposed framing is to treat this as a Non-Human Identity (NHI) problem rather than a model-behavior one.

Why: If your team runs coding agents over real repos, the 2x leak-rate figure means your existing pre-commit hooks and post-hoc repo scanning are being outrun: an agent can hardcode a key into a generated config in the time it takes a human to review one pull request. Concretely, decide now whether agent-issued credentials are scoped, short-lived, and rotatable independently of human accounts — because the article's point is that many secrets agents touch were never designed for autonomous use, so retroactive rotation after detection is the wrong default. Teams without an inventory of which credentials an agent can reach have no way to rotate safely when one leaks.

A MacAnorak piece walks through how two UK users with identical iPhones and the same paid iCloud subscription get different protection: one enabled Apple's Advanced Data Protection before Apple withdrew it for new UK users in February 2025, the other can no longer switch it on. It traces the path from the Snowden/PRISM revelations and Tim Cook's January 2014 ABC News interview with David Muir ("there is no back door"), through the 2 December 2015 San Bernardino attack that killed 14 and wounded 22 and the FBI's seizure of the iPhone 5C used by Syed Rizwan Farook, to the current UK position. The Hacker News thread drew 297 points and 292 comments.

Why: If your product's security story leans on iCloud Advanced Data Protection for user data, UK accounts created after February 2025 cannot enable it, so identical devices and identical paying customers now sit at different protection levels — that means app-level or server-side encryption you control, not the platform's strongest mode, has to be your default for UK users. If you are a founder planning UK expansion or storing customer data with US cloud providers, treat per-jurisdiction rollback of E2EE as a live risk to design around, not a hypothetical.

CTM360's report traces ClickFix from a late-2023 novelty to what it calls the leading initial-access technique in enterprise intrusions, based on two analyses: a campaign-level set of over 17,000 URLs serving fake Cloudflare verification pages (roughly 3,000 still live at publication) and a host-level teardown of a single compromised WordPress site. The technique needs no exploit, attachment, or downloaded file — it writes a command to the clipboard and asks the user to paste it into a signed system binary themselves, which is why MITRE gave it sub-technique T1204.004 in March 2025 across Windows, macOS, and Linux. Cited telemetry: Microsoft attributed 47% of its Defender Experts initial-access cases in 2025 to ClickFix, and ESET measured a 517% rise into H1 2025 plus a further 108% between H2 2025 and H1 2026. The report also describes ClickFix as now operating as a subscription product with on-chain infrastructure and a state-sponsored user base, and argues domain blocking is no longer a useful defense.

Why: If you run a public website — especially WordPress — you may be part of the delivery infrastructure rather than just a potential victim: the report's host-level analysis is of a compromised WordPress site serving the lure, and ~3,000 of the 17,000 fake Cloudflare verification URLs were still active. The practical decision is detection strategy, not blocklists: since the command is pasted by an authenticated user into a trusted signed binary, browser reputation checks, email gateway detonation, and domain blocking don't catch it, so the useful controls are clipboard-monitoring/EDR rules on the T1204.004 pattern and user-facing checks on your own site for injected fake-verification pages.

Meta used Connect 2026 to push Muse, its personal agent, as a hardware-plus-agent strategy: Muse now supports voice and real-time video, gets its own email address per user, and adds computer use on Mac ('queue up your jobs, walk away, and it keeps going'). Meta showed a connector catalog with Box, GitHub, Granola and Notion, plus commerce integrations from Walmart, Best Buy, Gap, Sephora and Instacart, and announced Muse Charm, a handheld agent device shipping in time for the holidays. A new frontier model was teased but not released; the writeup notes Muse Spark shipped three weeks earlier and that Muse has overtaken ChatGPT in the App Store, and that the post is paywalled and the transcript cuts off mid-sentence at the connector catalog.

Why: The concrete decision point is distribution, not the glasses: Muse is adding a connector catalog (Box, GitHub, Granola, Notion) and per-user Muse Mail addresses you can CC or forward into, so a small SaaS team can decide whether to ship a Muse connector or just make its workflow work over email. The commerce list (Walmart, Best Buy, Gap, Sephora, Instacart) matters for anyone selling online, because the article states Muse is free for users but may eventually take a cut of transactions — that is a future margin question for merchants, not a today one. Nothing in this text mentions Malaysia or Southeast Asia, so there is no local policy, funding, or infrastructure detail to act on here.

The Hacker News reports active exploitation of CVE-2026-87902, a CVSS 9.2 unauthenticated remote code execution flaw in WordPress disclosed with patches on Sept 22, 2026. The bug lets get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories, but only if the active parent/child theme has a top-level directory whose name starts with 'page-' and a readable target file such as pearcmd.php exists on the server. Previdian logged 68 exploitation attempts from Sept 23, first seen Sept 22 at 11:49 a.m. UTC, including requests using /usr/local/lib/php/pearcmd.php, writing to /tmp/, and pulling an uploader script from a GitHub raw URL, from an IP in New Jersey (104.194.9[.]227) and one Indonesia-based IP; Patchstack corroborated the shift from recon to active exploitation, and Previdian's Ryan Dewhurst said default WordPress auto-updates mean mass attempts but relatively few compromises.

Why: If you or a client run WordPress, this is a decision about two specific checks, not a general 'patch everything' reminder: confirm the site is on the version patched on Sept 22, and inspect whether the active theme has a top-level directory named page-* plus any readable stray .php like pearcmd.php in paths such as /usr/local/lib/php/ — both preconditions must hold for RCE, so most sites are not exploitable even though scanners are already hitting them. Malaysian agencies and founders hosting many client WordPress sites should inventory themes against that page- prefix pattern before assuming the default auto-update covers them, since a custom theme can block the fix from being the whole story.

Google released two new Gemini text-to-speech models—gemini-3.8-flash-tts and gemini-3.8-flash-lite-tts—offering 2,000+ voices, custom voice cloning from a 30-second sample, and native multi-speaker conversation support. Simon Willison built a bring-your-own-key playground (vibe-coded with GPT-6 Astra) that exploits the API's open CORS policy to let users compose, preview, and share bookmarkable TTS sessions.

Why: The open CORS policy means you can call Gemini TTS directly from browser-side JavaScript without a proxy—useful for shipping lightweight voice apps. At ~2.74 cents for 78 seconds of audio on Flash (not Flash-Lite), you should benchmark cost against your expected usage before committing. The multi-speaker conversation API is worth testing if you build agent voice interfaces or narration tools.

Unlisted's September 2026 Ghost Jobs Report measured 607,050 open postings across 15 applicant tracking systems by reading each employer's own careers site, and found 28.3% (163,057 postings) had been open more than 90 days, with 94,106 open over 180 days and a median open posting age of 36 days. The stale share varies sharply by category and by ATS: Hospitality is worst at 43.9%, Engineering sits at 32.3% (median 46 days), while Lever boards carry 48.2% stale postings versus 17.2% on Workday. The report also found 14.6% of closed postings came down within a week, and 4.2% were reposted as a new listing within 30 days.

Why: If you are job hunting, posting age is now checkable before you spend an evening on an application: Engineering listings are 32.3% likely to be over 90 days old, and if the company posts through Lever or BambooHR (48.2% and 47.9% stale) you should verify the date on the employer's own careers site first. The flip side is the signal for anyone hiring: a role that stays open past 90 days is visible as stale, and 14.6% of closures happen within a week, so fast-closing postings are the ones worth prioritizing.

DrivingBench hands frontier models control of a real Toyota Corolla's steering, accelerator and brakes on a fixed cone course, publishing per-attempt traces, videos, token counts and costs. GPT-6 Astra (Codex, medium) was the only model to finish: 100% course progress in 5:22 on its second attempt in the same chat, after attempt one stalled at 49% (DNF). Claude Fable 5.1 (Claude Code) peaked at 45%, Grok 4.6 (Cursor) 11% and GPT-5.6 Sol (Codex) 6%, all DNF; the Hacker News thread drew 258 points and 219 comments.

Why: The leaderboard ranks best-of-up-to-3 attempts inside one continuous chat and shows first-attempt results beside it, so the single success is a retry after the model reflected on its own failure — and that winning run burned 246.6M tokens / $7.74, while Grok 4.6 spent $0.29 across three failed attempts. If you run or buy agent evals, report first-attempt success and best-of-3 separately, and price the retry loop rather than the single call, because tokens per attempt vary by roughly 100x across these models. No Malaysia-specific detail appears in the source text, so treat this as an eval-methodology item, not a local one.

Cisco Talos disclosed a Windows malware called CLOSEDQUORUM that polls up to four commercial AI models (DeepSeek, Qwen, Mistral, Google Gemini) to vote on each action—steal, inject, persist, or move—instead of receiving commands from a C2 server. The public version doesn't work (placeholder API keys and webhook), and Talos hasn't observed it functioning end-to-end, but the code is at least three months old. Talos also released CAIRN, an open-source tool to detect malware that calls AI services.

Why: If you build AI agents or use LLM APIs in production, this is an early blueprint for adversarial use of the same APIs—hardcoded keys, structured-output voting, and Discord as exfiltration channel. Grab CAIRN from Talos to scan your own environment for processes making unexpected calls to DeepSeek, Qwen, Mistral, or Gemini endpoints, and treat your API keys as malware-grade secrets worth rotating.

NVIDIA released Nemotron 3 Diarization, an open-weight 100M-parameter speaker diarization model that ranks #1 on VoiceArena's Diarization-Bench leaderboard with a 14.72% Diarization Error Rate. It supports up to 8 speakers (up from 4 in the prior Streaming Sortformer), handles overlapping speech, and works in both streaming and offline modes with customizable latency.

Why: If you are building meeting transcription, call-center analytics, or voice-agent products, this open-weight model lets you attribute speech to specific speakers in real time without relying on a paid API. The jump from 4 to 8 speakers and streaming support means you can handle larger live conversations — evaluate it against your current ASR+diarization pipeline rather than assuming your vendor's solution is best.

Ema, a startup deploying coordinated teams of AI agents it calls 'AI employees' to automate multi-step HR, IT, and finance processes, raised a $77M Series B led by Creaegis with Accel, Section 32, and Prosus participating. Total funding reaches $140M, with valuation more than quadrupling since its 2024 round. Founded in 2023 by ex-Google/Coinbase exec Surojit Chatterjee and ex-Okta exec Souvik Sen, Ema wraps around existing enterprise apps and aims to let customers reduce or fully replace traditional SaaS dependencies.

Why: If you build or invest in conventional SaaS, Ema's thesis—that AI agents wrap around existing apps and then replace them—signals a concrete threat to per-seat workflow software. Prosus's continued participation is worth noting for SEA builders since Prosus actively backs regional tech. SaaS founders should evaluate whether their product's value can be replicated by an agent orchestrator, and AI agent builders should study the multi-agent coordination model for enterprise process automation.

AI is absorbing the research, drafting, coding, and admin tasks traditionally assigned to junior employees, pushing companies to restructure entry-level roles. At London ad agency Catalyst, one junior employee now manages five client accounts using AI for research, first-pass copy, and data gathering, with the human acting as the client-facing fixer in what the founder calls a 'reverse Mechanical Turk.'

Why: Founders and team leads should stop hiring for grunt-work capacity and instead test candidates on AI orchestration and output-editing skills. If one junior can now cover what previously required several, staffing plans and junior compensation structures need reworking before the next hiring round.

Malaysia's National Semiconductor Strategy (NSS), launched May 2024 with RM25 billion in fiscal support, has attracted over RM63 billion in investments within a year. The government targets 10 Malaysian companies reaching RM10 billion revenue from chip design and advanced packaging, plus 100 more approaching RM1 billion. The article profiles 8 companies including Inari Amertron, which holds RM2.14 billion in cash reserves and is pivoting from RF chip packaging for 5G phones into advanced packaging for AI server hardware.

Why: Malaysian founders and developers in or adjacent to hardware, IoT, edge computing, or data centre infrastructure should map their roadmap against NSS fiscal incentives and the RM63B investment pipeline—there are concrete government-backed opportunities for companies that can plug into the chip design and advanced packaging value chain rather than staying in assembly and testing.

Anthropic launched the Claude Marketplace, consolidating 2,000+ connectors/plugins (Atlassian, Google, Microsoft, Notion, Salesforce), Claude-powered agents and products (Cursor, Harvey, Lovable, Snowflake, CrowdStrike, Legora), and consulting partners (Accenture, BCG, Deloitte) into a single directory. Teams can use committed Anthropic spend to buy marketplace products, and builders can list connectors via Model Context Protocol (MCP) and Agent Skills, or apply to list agents/products.

Why: If you build Claude integrations, MCP connectors or Agent Skills are now a distribution path to Anthropic's enterprise customers, and listed products can be purchased with customers' existing committed Anthropic spend—removing a separate procurement hurdle. If you're a buyer, check whether your current Anthropic contract spend can be redirected to tools like Cursor or Harvey before paying separately.

Anthropic forward deployed engineers share a six-step framework for AI-driven code modernization using Claude Code, arguing that agents compress multi-year migrations into months or weeks but shift the bottleneck from writing changes to organizational review and approval. The steps are: define the target state, create a 'certificate' of correctness conditions, set a promotion policy for production, put CI/CD and review prerequisites in place, build a Claude Code agentic workflow with parallel subagents, then prove end-to-end on a small partition before scaling.

Why: If you're planning to use AI agents for large-scale code migrations, the practical takeaway is that the hard part is no longer code generation—it's pre-defining what 'done' means and building the review/approval pipeline that can keep up with agent output. Start by writing an explicit correctness certificate and promotion policy before touching the agentic workflow, or your review capacity becomes the bottleneck.

WordPress patched a critical unauthenticated vulnerability (CVE-2026-87902, CVSS 9.2) on September 22 in version 7.1.2, affecting all versions from 4.7.0 through 7.1.1. The flaw allows an attacker with no account to make a site load a PHP file outside theme folders via path traversal in template file selection, potentially enabling code execution on servers where a suitable PHP file already exists.

Why: If you run any WordPress site on versions 4.7.0 through 7.1.1, update immediately to the patched release for your branch (7.1.2, 7.0.6, 6.9.9, etc.)—there is no workaround besides updating. Sites updated as recently as September 17's 7.1.1 release are still vulnerable, so don't assume you're patched just because you updated last week.

OpenAI introduced GPT-6 Sol and Luna, two cheaper models in the GPT-6 family, with API prices cut 50% versus GPT-5.6 promotional pricing. Sol is priced at $2/$10 per 1M tokens (input/output) and Luna at $0.10/$0.50. OpenAI claims Sol at xhigh effort outperforms Claude Opus 5 at max effort on AutomationBench at 9% of Opus 5's cost per task.

Why: If you're building AI agents or SaaS on OpenAI APIs, Sol and Luna's 50% price drop directly lowers your per-task inference cost—evaluate whether downgrading from Astra to Sol for non-critical workflows, or from Sol to Luna for high-volume tasks, materially improves unit economics. The AutomationBench claim about Sol beating Claude Opus 5 at 9% cost is vendor-reported and omits full competitor cost details, so benchmark against your own workload before switching providers.

A malicious npm package called 'tw-pkgprobe-7731' was uploaded in mid-August 2026, posing as an authorized Twilio HackerOne bug-bounty probe. It published 11 versions in roughly 45 minutes, with version 1.0.4 specifically exfiltrating Twilio ACCOUNT_SID and AUTH_TOKEN environment variables via webhook, potentially allowing attackers to authorize billing and trigger communications on compromised accounts.

Why: If you integrate Twilio APIs in any project, audit your npm dependencies for 'tw-pkgprobe-7731' and verify that your ACCOUNT_SID and AUTH_TOKEN are not exposed in environment variables accessible to unvetted packages. More broadly, this shows supply-chain attackers are now narrowly targeting specific SDK ecosystems with plausible-sounding security-tool disguises, so treat any unfamiliar npm package claiming to be an 'authorized probe' as suspicious until independently verified.

Anthropic released Opus 5.5, claiming it outpaces the larger Fable model on many benchmarks while cutting output token pricing from $25 to $20 per million tokens and reducing serving compute. The model also changes communication style—less jargon, key information placed at the start of responses—and arrives just two months after Opus 5 (July 24), with Sonnet 5.5 and Haiku 5.5 promised in coming weeks.

Why: If you're building on the Claude API, Opus 5.5 offers a 20% output token price cut and faster inference, so evaluate whether swapping from Opus 5 or Sonnet to 5.5 reduces your per-request cost and latency. The communication-style change (less jargon, front-loaded key info) could affect agent prompt chains that parse model output, so re-test your parsing logic before migrating.