AI Weekly Malaysia

An analysis of reported Anthropic financials says Q3 revenue was $16.8B, up from $11.6B in Q2 and $4.8B in Q1, but the sequential dollar gain fell from $6.8B to $5.2B. Using a reported $65B July annualized run-rate (~$5.4B July revenue), it estimates monthly growth slowed to about $580M in Q3 from ~$760M in Q2, and links that flattening to pressure on 'neocloud' providers like CoreWeave whose debt assumes AI compute demand keeps growing far above consensus.

Why: If you are budgeting AI API spend or choosing infrastructure, do not assume the recent pace of AI revenue growth and falling compute costs continues in a straight line: the key detail is that Q3 added $5.2B versus Q2's $6.8B, while neocloud debt is priced on much steeper demand. For a small SaaS or AI team, keep vendor commitments short and model a scenario where inference pricing stops improving as fast.

Over Halloween weekend, some Grok Bot users found their weekly usage limits maxed out — some jumping from as low as 50% to 100% — without heavy use, and Elon Musk confirmed in an X reply on November 1, 2026 that it was not a glitch: "The cost of serving Grok Bot was unsustainably high relative to revenue." The article notes Grok Bot is being positioned as a success story for the newly public SpaceX, which reported AI at 52% of company income, a $431 million profit in its renamed "Super Intelligence" division, and $1.2 billion of one-time costs tied to its Cursor acquisition. Musk has not said how subscriber usage limits will change going forward.

Why: This is a concrete case of an agentic AI product cutting paid users' quotas mid-cycle with no published replacement limits — so if you build on Grok Bot or any third-party agent API, treat quota as a variable, not a contract, and keep a fallback path and per-user cost ceiling in your own design. If you ship your own agent product, the stated cause (serving cost outpacing revenue) is the exact failure mode to model before you set flat-rate pricing.

A Tom's Hardware report on a database of 10,000 public comments about US data centers found more than 90% were negative, only 21% mentioned AI, and 73% of meetings had no data-center supporters. Water was the top concern.

Why: If you build on cloud or AI capacity, treat water use and local permitting as the likely bottleneck, not AI backlash: the data says opponents are not primarily arguing about AI, so an 'AI progress' pitch won't answer the main objection. For Malaysian and Southeast Asian builders relying on data-center expansion, plan for delays and cost changes from community and water constraints rather than assuming capacity arrives on schedule.

Tom's Hardware reports that Nvidia's Brev GPU cloud service suffered a security breach that may have exposed SSH keys used to access customer VMs. An investigation found unauthorized activity spanning 16 days, though there is no evidence of misuse so far. The article excerpt provides no further detail on affected accounts, patching status, or notification.

Why: If you or your team rent GPU dev environments through Brev, the practical decision is to rotate SSH keys tied to those VMs and check access logs for the 16-day window rather than wait for a notification. The absence of confirmed misuse is not the same as confirmed safety, and the excerpt gives no remediation timeline to rely on.

Simon Willison reran the U.S. Census Bureau’s Business Trends and Outlook Survey AI-adoption chart using data published October 22, 2026. The survey wording changed on November 17, 2025 from AI used “in producing goods or services” to AI used in “any of its business functions”; for firms with 250+ employees, “yes” responses went from about 12% in September 2025 to about 30% by February 2026 and about 40% by October 2026. He also notes the Bureau has run into Executive Order 14434, the “Super Intelligence” order.

Why: If you cite Census AI-adoption numbers in a pitch, benchmark, or market map, do not treat the jump from roughly 12% to 40% as pure adoption growth: the question changed on November 17, 2025, so pre- and post-change figures are not directly comparable. Use the post-change “any business function” numbers only for like-for-like comparisons.

A web-archiving worker describes losing teapuppies.com, a fansite online since 2004 and largely unchanged since 2005, after it disappeared and the domain began serving online gambling ads. The post argues individuals should archive favourite or depended-on sites themselves using standard WARC-format tools, and shows an entire archived website embedded in the blog post with a downloadable archive option.

Why: If a site you rely on for docs, assets, tutorials, or reference content has been stable for years, that is not a guarantee it will stay up: this example vanished after roughly two decades and the domain was repurposed. Use WARC-compatible archiving and keep a downloadable copy rather than assuming the Internet Archive or the site owner will preserve it.

The Hacker News reports (published 2 Nov 2026) that critical flaws in Langflow could allow unauthenticated attackers to execute code on servers. The excerpt available here is truncated immediately after the headline, so it contains no CVE identifiers, no affected or patched version numbers, and no exploitation details. Treat this as a signal to check the primary advisory rather than a complete briefing.

Why: If your team self-hosts Langflow — on a VPS, a local cloud tenant, or a shared internal box — the headline claim is unauthenticated remote code execution, which means exposure does not require a leaked key or a logged-in account. Because this text gives no version numbers or fix guidance, the concrete action is to pull the actual advisory and confirm your running version before deciding whether to patch, put the instance behind auth, or take it off the public internet.

Google has pledged US$160 million (~RM650.9 million) for shared water infrastructure along the Linggi River in Negeri Sembilan, including an off-river storage reservoir and a treatment plant supplying 65 million litres of drinking water per day. Gamuda will build it before ownership transfers to MBINS, supporting both local community needs and Google's Springhill data centre campus at Port Dickson, which is slated to handle domestic computing and AI workloads for Gemini, Search, Maps, Chrome, YouTube and Workspace. Google also says it will pay for 100% of the site's electricity and grid-connection capex, backed by CGPP-linked solar PPAs including a 21-year TotalEnergies deal for a 29.99MWac Kulim plant.

Why: The article gives no operational date or pricing for the Port Dickson data centre, so Malaysian builders should treat this as infrastructure pipeline rather than available local Gemini/cloud capacity. The concrete terms to watch are the 65 million litres/day shared water plant and Google paying 100% of electricity plus grid-connection capex; those are the sustainability and permitting conditions that will shape when local AI/cloud capacity actually arrives.

Plymouth's city council voted on Sept 22 to cancel its Flock ALPR contract after the author and his wife were wrongly tracked and ambushed by four police officers; the police chief suspended all Plymouth Flock accounts the next morning and sent a formal cancellation letter by mail and email. After more than a week of silence from Flock corporate and legal, Chief Eric Fadden ordered staff to physically disconnect the cameras' power cords. The Flock-owned cameras are still mounted around the city and the department says it has no timeline for removal.

Why: This is a concrete offboarding failure for anyone who buys or sells hardware-plus-subscription: cancellation stopped at 'we sent a letter', and the devices kept sitting there powered until someone pulled the plug. If you sell a device-plus-SaaS product, write the shutdown into the contract — revocation of credentials, power-down, physical removal, and data deletion, each with a deadline and a named contact — because 'cancelled' plainly means nothing on its own. If you're the buyer, assume you may have to de-energise rented hardware yourself and check now whether you physically can.

In Q3, Meta's ad business grew 26% year over year while Google's Search and other unit grew just 12%, a gap CNBC attributes to AI: Meta's targeting tools improving for advertisers, and chatbots like ChatGPT and Claude pulling consumer attention (and clicks on blue links) away from search. Emarketer AI analyst Nate Elliott calls the habit shift "potentially catastrophic for Google's ad business." The excerpt cuts off mid-sentence while describing a recently launched Meta product.

Why: If a meaningful slice of your signups or revenue comes from Google organic, this is a direct signal that search-intent capture is weakening while Meta's ad targeting is improving — so measure what share of your acquisition is search-dependent this month, and treat paid social plus owned channels (email, community, direct) as the hedge rather than assuming SEO traffic recovers. The 26% vs 12% gap is the concrete number to cite when justifying that budget shift.

Tom's Hardware reports an open-source USB tool/UEFI unlocker that claims to remove an Nvidia 'half-speed GPU AI limiter' on Windows for RTX 20, 30, and 40-series desktops and laptops, lifting FP16 math performance by up to 65%. The supplied text is mostly page chrome and does not include methodology, benchmark conditions, safety details, warranty impact, or compatibility caveats.

Why: Builders running local FP16 AI workloads on those RTX generations have a potential up-to-65% speedup to evaluate, but should not treat it as a free win until independent benchmarks and UEFI/USB flashing risks are verified; cloud-only or non-RTX users have no direct action. No Malaysia-specific impact is stated in the supplied text.

Hector Serrano, Head of Content at AI voice-to-text tool Wispr Flow, describes building a paid user-generated-content (UGC) engine: a roster of 50 creators producing 500-600 paid UGC ads per month, with creators paid a cut of ad spend and top performers earning over $13,000/month. Serrano joined at 19 before the product had PMF; Wispr Flow has since grown revenue 30x and raised at a $2 billion valuation. He also argues the best marketers are 'allergic to AI' and calls YouTube the most underrated growth lever in SaaS.

Why: If you run a SaaS, this is a concrete alternative to bidding on the same search keywords as everyone else: a rev-share UGC model where creators are paid from ad spend rather than flat fees, which ties cost to performance. The 50-creator / 500-600-ads-per-month scale is the honest benchmark — decide whether you can sustain that volume of creative before copying the model, since a handful of ads won't replicate a 30x revenue curve.

The Hacker News reports that attackers stole roughly $2.7 million from Polymarket traders by hijacking a DebugBear script — DebugBear being a third-party web performance/monitoring service whose JavaScript runs inside customers' pages. The published excerpt is truncated at the headline and opening lines, so the article body (how the script was hijacked, when, and which pages served it) is not available here. What is concrete: a third-party vendor script was the delivery path, and the loss is measured in millions of dollars.

Why: Any third-party tag you paste into your frontend — performance monitoring, analytics, chat widgets, A/B testing — executes with full access to your page's DOM and your users' authenticated sessions. If you ship a product where a session can move money or assets, a compromised vendor script is not an SEO/performance problem, it is a wallet-drain problem. The concrete action: list every external script on your money-touching pages this week, and for each one decide whether it can be self-hosted, pinned with Subresource Integrity, or removed entirely — 'we trust the vendor' is exactly the assumption that cost $2.7M here.

Tom's Hardware reports, citing an unnamed report, that Nvidia is tightening how AI GPUs are tracked in Southeast Asia amid scrutiny of Chinese chip smuggling. The one concrete mechanism given is that cloud providers must join a monitoring program to qualify for official partner status. The article body available here is mostly site boilerplate, so there are no figures on which countries, which GPU SKUs, timelines, or enforcement details.

Why: If you rent GPU capacity from a Southeast Asian cloud provider or reseller rather than a hyperscaler, partner status is now tied to participating in Nvidia's monitoring program — so it is worth asking your provider directly whether they hold official partner status, because the practical risk is allocation and lead-time priority, not just price. The text gives no numbers, country list, or effective date, so treat this as a signal to verify with your supplier rather than a confirmed policy change.

Underdog released a browser game demo built around Woof, a text-to-speech model it says is 31.7MB with 31 million parameters and can run on most devices without an internet connection. In the demo, users type into a retro typewriter and hear the text spoken, and rotate a tuner to generate music; the model is open for download. It follows Underdog's 167MB Bark speech-to-text model for edge devices, and founder Sigil Wen said he built the demo to avoid cloud notetakers and keep data on users' devices.

Why: If the 31.7MB claim holds, builders can prototype offline browser voice features—typed-to-speech, local assistant replies, game audio—without a cloud TTS API. But the demo does not provide quality, latency, or license details, so treat Woof as a test candidate, not a production replacement.

Aeon Credit launched FacePay, which it calls Malaysia's first facial-recognition payment, live only at the Aeon Supermarket KL Midtown self-checkout counters. Users enrol their face once in the Aeon Wallet app and set a six-digit Face Code that is required for transactions above an undisclosed limit; the system uses liveness detection to block photo spoofing and falls back to QR/card if FacePay is unavailable. An adoption campaign runs 5 November to 31 December 2026, giving an extra 1 Aeon Point per RM1 (up to 6x points with existing card rewards) but capped at a total pool of 300,000 Aeon Points.

Why: This is a single-store pilot, so treat it as a spec to study rather than infrastructure you can rely on: the design pattern is biometric identification plus a six-digit code as step-up auth above a spend threshold, with card/QR fallback. If you build checkout, loyalty, or KYC flows for Malaysian retail, that two-factor-by-amount model and the 300,000-point campaign cap (which will be exhausted well before 31 December) are the two concrete things to copy or plan around.

IREN says more than $4 billion in annual recurring revenue expected in 2026 has slipped to at least January, and could extend to February, due to a customer-requested change and supplier timing. Co-CEO Daniel Roberts said on the earnings call that Microsoft is the customer and requested network infrastructure reconfiguration and upgrades to enable 200 megawatts of capacity for latest-generation frontier models. IREN reported revenue up 66% quarter over quarter to $228 million, beating the $221 million analyst estimate, with AI Cloud revenue more than doubling to $200 million.

Why: If you are planning GPU or neocloud capacity for frontier-model workloads in 2026, this is a concrete signal that advertised capacity timing can slip: over $4 billion in annualized revenue moved to January or February because Microsoft asked for network reconfiguration to support 200MW. Ask providers for delivery dates, SLAs, and fallback options rather than assuming 2026 capacity will be live on schedule.

Mark Cuban is reported to claim that Facebook knowingly runs AI deepfake scam ads, and the headline cites internal documents putting fraud-related revenue at $16B. We only have the title and excerpt — the article body could not be read — so the sourcing behind both the "knowingly" claim and the $16B figure is unverified here. The Hacker News thread drew 337 points and 156 comments, so builders are engaging with it.

Why: If you buy Meta ads or build AI video/voice tools, the actionable question is narrower than the headline: what fraction of ad inventory is impersonation or deepfake-driven, and does the $16B figure refer to revenue from scam ads or revenue lost to them? Until that number's definition and provenance are confirmed, treat it as an unverified claim — but do check whether your own brand is being impersonated in paid placements, since that is cheap to test this week.

OpenAI published a customer story on cult.fit, described as an India-based fitness company with 708 centers in 77 cities and nearly one million paid members, standardizing engineering on Codex after previously mixing several coding agents and assistants. The company says non-engineering teams have built 20+ internal applications in recent months, that rebuilding one internal capability on Codex saved $100,000+ annually in software, and that customer support costs fell 50%+. It also describes specialized agents: an SRE agent that pulls from observability platforms and logs, investigates incidents, and often opens a pull request with a proposed fix for engineer review, plus security agents.

Why: The numbers here are vendor-reported and unverified, so treat them as a pattern rather than proof: the concrete claim worth testing is that standardizing on one agent platform (instead of a mix of coding agents) let non-engineers ship 20+ internal apps and let an SRE agent open fix PRs. If you are choosing agent tooling for a small team, the decision to weigh is whether consolidating conventions — repo structure, agent instructions, skills, review loops — is worth more than picking the best tool per task; the $100k and 50% figures give you a benchmark to sanity-check your own ROI claims against, not a guarantee.

At the WSJ Tech conference, Meta President Dina Powell McCormick said Democratic midterm wins will make it harder for companies to build data centers, arguing the backlash is tied to broader negative sentiment about AI. She said Meta has data centers in 23 states and conceded the industry has "not done as good a job as we needed to explain the benefits" of those investments.

Why: If your product depends on US AI capacity, treat data-center permitting and local political sentiment as a real constraint on cost and availability, not just a capex issue. Meta's own framing suggests infra plans need a concrete local-benefits case early; SEA builders pitching AI or cloud projects should expect similar community scrutiny.

Two days after midterm voters rejected data center expansion across 41 local ballots, OpenAI published a policy blueprint and a set of commitments it says it will apply to data centers it owns and operates: paying the full cost of power, soliciting community input, publishing construction plans, and avoiding NDAs with public officials. Chief Global Affairs Officer Chris Lehane framed the blueprint as codifying lessons learned so other operators face a 'very high floor.' OpenAI also urged policymakers to turn the commitments into law.

Why: The concrete commitment is cost-shifting: OpenAI says it will absorb the full power bill for company-owned data centers, which removes the 'ratepayers subsidize AI' argument that drove the ballot losses. If you are modelling AI capacity costs, treat cheap power as a political variable now under negotiation, not a fixed input — and expect 'no NDAs with officials, publish construction plans' to become the template local governments ask of any operator, including those building in Southeast Asia.

NextDC, the Australian data center operator, jumped more than 42% on Thursday after Goodman Group and US-listed Digital Realty moved to buy stakes of up to 9.9%, via an aftermarket bookbuild priced at A$9.50 per share. NextDC's board labelled the move "opportunistic," noting it landed two weeks after the company disclosed a power supply delay at its M3 Melbourne facility and cut its fiscal 2027 guidance. Both buyers said they have no current intention of a takeover bid but reserved the right to make one, even as US data center names sold off — CoreWeave down about 9% and IREN down roughly 11.2% — on worries about tighter oversight after Democratic midterm wins.

Why: The trigger here is a power delivery delay at one Melbourne campus forcing revised FY2027 guidance — that is the same constraint shaping colo contracts and cloud region buildouts across Southeast Asia. If you are planning capacity or pricing for GPU/agent workloads in APAC, treat power availability, not land or servers, as the schedule risk, and expect incumbent operators to be repriced by consolidation before new supply lands.

OpenAI released Images 2.6 in ChatGPT, Codex, and the API on November 4, 2026, claiming 50% faster image generation and adding GIF output from still images. The API offers GPT-Image-2.6 Flare, which can generate at low quality in as little as six seconds, and GPT-Image-2.6 Sunburst for higher-quality, more consistent edits at medium or high quality. OpenAI says users create 4 billion images per week, over 500 million per day.

Why: If you call an image-generation API, the concrete decision is whether to use Flare for latency-sensitive drafts, where low quality can return in about six seconds, or Sunburst for final assets that need consistency across edit rounds. The post gives no pricing or independent benchmark data, so test both against your current model before switching. GIF support may remove a separate sprite-sheet step for simple looping animations, but the examples depend on carefully structured prompts.

DreamHost confirmed hackers accessed customer files and inboxes in a breach that began in August and was only disclosed last Thursday after causing a multi-day outage and password resets. The entry point was an unspecified vulnerability in DreamHost's file manager, and attackers stole session tokens — which keep users logged in without re-entering a password — not just credentials. DreamHost says affected customers are "well under 10%" of its 400,000 paying customers but declined to give a number, describe the vulnerability, or explain the months-long detection gap; it says the flaw is unrelated to recent PHP vulnerabilities.

Why: If you or a client site sits on DreamHost — or any shared host — a password reset alone may not be enough: stolen session tokens let an attacker stay authenticated as you, so the practical step is to kill active sessions and rotate any API keys, SSH keys, or app secrets stored in files or mail on that host, not just change the login password. With up to roughly 40,000 accounts implied by "well under 10%" of 400,000, treat any DreamHost-hosted mailbox as a possible source of leaked credentials for the third-party services those addresses reset.

Dharma-AI published a Hugging Face blog post for Dharma Field Extractor, a 2-billion-parameter model that takes a document image plus either an open request or an exact schema and returns structured JSON — invoice line items as ordered lists, ID fields under your own column names, medical requisition fields ready to schedule — with one checkpoint and no per-type fine-tuning. It follows their April DharmaOCR-LITE OCR model, and the post frames it as the opposite tradeoff: OCR gives you the whole page faithfully, the Field Extractor gives you only the fields a downstream system consumes. The post claims it outperforms every frontier LLM they tested at a fraction of the cost and latency, but the excerpt contains no benchmark numbers, no pricing, no license, and only 11 upvotes on the post.

Why: If you currently burn frontier-API calls to turn invoice, ID, or requisition images into typed JSON, a 2B checkpoint is plausibly cheap enough to self-host at batch volume — but this post gives you zero eval numbers, no price, and no license, so the only decision it supports today is 'put it on a test set', not 'migrate'. Build a 50–100 document eval from your own scans with your exact target schema and compare field-level accuracy and cost per document against your current prompt-based pipeline before touching production.