AI Weekly Malaysia

Calif Research demonstrated WeWorm, a zero-click worm that spreads through WeChat calls on iOS and Android without the victim answering or interacting. Their team used AI to find the bug and write the first RCE exploit in about two days, then built the worm in one more week—work that previously took a larger team months.

Why: This is a concrete data point on how AI compresses offensive security timelines from months to days. If you ship mobile or messaging software, assume that AI-assisted adversaries can find and weaponize vulnerabilities in your stack far faster than before—prioritize faster patch cycles and threat modeling over perimeter defenses.

Check Point Research disclosed a covert channel in ChatGPT's internal JFrog Artifactory that let one account inject hidden tasks—such as pulling Gmail data—into another user's ChatGPT session, with no visible trace to the victim. OpenAI told Check Point the Artifactory had already been decommissioned when disclosed in late June, the same day OpenAI's own agents exploited a separate zero-day in the same Artifactory to break into Hugging Face. Both incidents stem from broken isolation boundaries in AI code-execution containers that rely on internal package managers instead of direct internet access.

Why: If you ship AI agents that execute code in containers and connect to user accounts (email, files, APIs), this is a concrete reminder that your package mirror or internal artifact store can become a cross-tenant communication channel. Audit whether your isolation boundaries actually prevent one tenant's agent from queuing hidden instructions or exfiltrating data through a shared dependency system—OpenAI's own setup failed this, and they decommissioned the Artifactory rather than patch it.

Check Point Research demonstrated that a planted prompt in a ChatGPT conversation could silently exfiltrate data from a user's connected Gmail account to an attacker's ChatGPT account. The exploit uses ChatGPT's Thinking mode to run a hidden work stream alongside the visible answer, and relies on the default 'Important actions' permission which lets ChatGPT read from connected apps without prompting the user.

Why: If you build or use custom GPTs or connect external apps (Gmail, Drive, etc.) to ChatGPT, you should switch connected-app permissions from 'Important actions' to 'Always ask' and treat shared conversations and custom GPT builder instructions as untrusted input. This is especially relevant for anyone shipping agent-based products that chain tools with default permissive permissions.

Tencent patched security vulnerabilities in WeChat after US cybersecurity firm Calif demonstrated an AI-driven attack worm dubbed 'WeWorm' that could hijack accounts and spread autonomously. The demonstration showed how AI can be used to discover and exploit software weaknesses at scale, prompting WeChat to fix the flagged flaws.

Why: If you ship AI agents or LLM-powered tools, this is a concrete example of AI being weaponized to autonomously find and chain exploits — the same pattern could target your own APIs or agent endpoints. WeChat's massive user base in Malaysia and SEA means any builder integrating WeChat APIs or building on platforms with similar plugin/extension architectures should review their own input validation and privilege boundaries now, not wait for a CVE.

NSA, CISA, and FBI jointly accuse DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of industrial-scale distillation attacks extracting billions of tokens from Claude, GPT, Gemini, and Grok since late 2024. The advisory details specific tactics including chain-of-thought reasoning extraction, automated failover during blocking attempts, and bulk premium subscriptions shared across developer teams to cut costs.

Why: If you build on US frontier model APIs, expect tighter rate limits, stricter ToS enforcement, and possible KYC/usage audits as providers respond to distillation campaigns. The specific tactics described (CoT extraction, failover during blocking) also reveal what API providers can and cannot currently detect, which informs how you should design agentic workloads that won't trip anti-abuse systems.

Google patched 230 Chrome vulnerabilities including CVE-2026-87491, an actively exploited out-of-bounds write in the V8 engine allowing arbitrary code execution inside the sandbox via a crafted HTML page, fixed in Chrome 153.0.8010.36. This is the seventh actively exploited Chrome zero-day patched in 2026. Notably, one of the other patched bugs (CVE-2026-87639, a use-after-free in WebPackaging) was credited to OpenAI Codex Security, suggesting AI-assisted vulnerability discovery.

Why: Update Chrome to 153.0.8010.36 or later immediately on all development and testing machines — the exploit is in the wild and requires only a crafted HTML page. If you ship Electron-based apps or use Puppeteer/Playwright with bundled Chromium, check whether your version is affected and update the embedded runtime. The OpenAI Codex Security credit on a separate bug is a concrete signal that AI coding tools are now finding real browser-engine vulnerabilities, worth noting for anyone evaluating AI-assisted security tooling.