AI Weekly Malaysia

Huntress observed a late-September 2026 campaign where attackers published two Custom GPTs on chatgpt.com (both named "Plus 5.6") and promoted them through Google sponsored results for searches like "chatgpt." When a victim prompts the GPT, it replies with a Google Sites link that shows a fake Cloudflare CAPTCHA, triggering a ClickFix attack that tells the user to copy and run a PowerShell command, which drops an MSI installer ("ISOSimple.msi") that chains DLL sideloading, shellcode, a persistence script, and a RAT payload. Huntress says no fewer than 40 users were infected, and notes earlier campaigns abused shared ChatGPT conversations and malicious Claude Artifacts the same way.

Why: The delivery channel is a legitimate chatgpt.com URL plus a sponsored ad, so URL-reputation checks and 'is this really OpenAI's domain' instincts both fail. If you or your users install Custom GPTs found via search ads, treat any reply that hands you a backup-domain link or a PowerShell command to paste as the payload, not support — and note the same pattern has already been run through shared ChatGPT conversations and Claude Artifacts, so it isn't specific to one vendor's feature.

At OpenAI's Dev Day on September 29, 2026, the company announced agentic assistants called Dots, new AI models, and a set of changes that together turn ChatGPT into a distribution surface for third-party software. ChatGPT (stated at 1.2 billion weekly users) will start suggesting apps inside the conversation when it detects one could complete the user's task, the plugin architecture now supports extensions so developers can build interactive panels that run inside the chat, and users can carry their ChatGPT identity and existing AI allowance into third-party apps. The article frames this as a direct challenge to the traditional app store discovery model, but the excerpt is truncated and contains no pricing, launch dates, or country availability.

Why: If you ship a SaaS or an app, ChatGPT is being pitched as a new discovery and runtime channel alongside the web and mobile app stores — meaning your integration work and onboarding flow may need to work inside a chat panel, not just a browser. The portability of ChatGPT identity and AI allowance into third-party apps is the detail to watch: it changes whether users pay you directly or spend an allowance they already have, which affects pricing and conversion. Note that the text says nothing about rollout dates or whether Malaysia is in the initial markets, so treat availability as unconfirmed before planning build effort around it.

At its Dev Day in San Francisco on September 29, 2026, OpenAI announced office-oriented ChatGPT features: Space (a shared workspace where coworkers and their 'Dots' agent personas collaborate on files and pages), Pages (a word processor for 'human and agent collaboration'), and collaborative slides that can be generated by talking about them inside ChatGPT. Sam Altman framed Space as pages and files living together 'like they would in a drive,' with pages able to take instructions such as checking a team channel and updating themselves. TechCrunch frames the launch as OpenAI encroaching on Microsoft's workplace-software business, while Microsoft and Salesforce ship AI features in the other direction.

Why: If your team pays for Microsoft 365 or Google Workspace mainly for docs, slides, and shared drives, ChatGPT is now positioned as a substitute for that bundle — and if you build document, wiki, or slide-collaboration SaaS, you are now competing with a default tool your users already have open. For agent builders, 'Dots' is a new agent surface to consider integrating with or building around. The excerpt gives no pricing, no general-availability date, and no regional rollout detail, so there is nothing here yet to justify changing a procurement or build decision — treat it as a signal to watch, not a migration trigger.

Wabi, the prompt-to-app startup founded by Eugenia Kuyda (who previously founded Replika), announced 'Wabi 2.0' on September 28 — an invite-only AI messenger that generates the interface it needs in the moment, rather than competing head-on with other vibe-coding tools. Kuyda's stated rationale is that chat-only agents degrade with use because history and ongoing tasks end up buried in one endless scroll. The pivot lands the same week OpenAI's Dev Day announced updated ChatGPT plugins, which let apps offer interactive experiences inside ChatGPT with the app name pinned more visibly in the sidebar.

Why: If you ship a vibe-coded app or an agent product, this is a fork in the road: build your own messenger-style surface that generates UI on demand, or distribute inside ChatGPT's sidebar via the updated plugins and trade control for reach. The article gives no pricing, launch date beyond 'invite-only', or user numbers for Wabi 2.0, and no technical detail on how the generated interfaces work — so treat it as a positioning signal, not a validated playbook. Nothing here is Malaysia-specific.

At its September 29, 2026 developers conference, OpenAI launched GPT-6.1 Sol, described as a new cost-effective model, and introduced continuously running AI agents called "dots" — positioning ChatGPT as an app store for AI, with Adobe named as a partner in the headline. CEO Sam Altman framed the moment as a Renaissance-like era and said he wants to avoid repeating the missteps of the Industrial Revolution, with safety, security, and alignment as stated priorities. The same report says OpenAI is anticipating an IPO, that its revenue trails Anthropic, and that it is seeking large private investment to lift its valuation.

Why: The article gives no pricing, token limits, API availability, region support, or release date for GPT-6.1 Sol, and no detail on what Adobe actually contributes beyond the headline — so there is nothing here yet that justifies switching models or rebuilding anything. The one decision worth flagging: if "dots" means agents that run continuously rather than per-request, that changes how you meter, log, and cap spend in any product you ship on ChatGPT, so ask about session and idle-cost pricing before designing around it. Treat the IPO and revenue-vs-Anthropic lines as investor context, not a signal about model quality.

At its Dev Day on September 29, 2026, OpenAI said developers can now build app-like plugin extensions inside ChatGPT, giving apps a dedicated slot in the ChatGPT sidebar plus interactive panels and file viewers that support whatever formats the developer's product uses. It also introduced a Plugin Creator tool, a redesigned submission flow with clearer feedback, improved plugin ranking and recommendation in the directory and in conversations, per-plugin permission approval, plugin hosting on ChatGPT Sites, and support for the proposed MCP Events specification so plugins can trigger automations from events in a connected app.

Why: If you already maintain an MCP server or ChatGPT plugin, two changes are worth acting on: plugins can now live in the sidebar with their own interactive UI, and MCP Events support turns them from on-demand tool calls into event-driven automations. The text gives no pricing, availability dates, rate limits, or migration path for existing plugins, so treat this as something to prototype against rather than something to schedule a release around. There is no Malaysian or Southeast Asian angle in this article.

OpenAI announced a global launch of two ChatGPT shopping features: a virtual try-on that lets users upload a selfie or full-body photo to see how a garment or accessory looks on them, surfaced via a new "try on" button in ChatGPT's shopping results, and Favorites, which saves products into an in-app Library alongside the try-on images. The features run on the newly launched ChatGPT Images 2.5 model, which OpenAI claims produces more natural lighting and richer textures, follows editing instructions more reliably, and cuts image generation latency. The article also notes OpenAI previously pulled back from an instant checkout feature that underperformed, and that agentic startup Instinct drew criticism for proactive product recommendations that users saw as ad-like.

Why: This is a consumer shopping surface change, not a developer or API change — nothing in the text describes new endpoints, pricing, or SDKs, so most builders have no code action here. The one decision it informs is for anyone doing e-commerce discovery or affiliate/content commerce: product discovery and try-on imagery are moving inside the assistant via a "try on" button and a saved Favorites Library, which means your product images and catalog data are what get rendered by ChatGPT Images 2.5, not your own storefront page. If you are not in consumer commerce, the useful signal is the failure pattern: instant checkout underperformed and proactive recommendations were read as ads, so agentic commerce UX is still unresolved.

OpenAI published a customer case study on Albertsons Cos. expanding its OpenAI work across more than 2,200 stores (Albertsons, Safeway, Vons, Jewel-Osco, Shaw's, ACME, Tom Thumb) serving over 36 million customers weekly. The rollout covers ChatGPT Enterprise for internal teams, OpenAI API-built recommendation and promotional tools, and a new Safeway grocery experience inside ChatGPT that takes a shopper from a dinner idea to checkout. The only outside data point is a dunnhumby February 2026 US Consumer Trends Tracker cited for the claim that shoppers are more open to using AI for groceries than for other purchases.

Why: There is almost nothing here a builder can act on: no model names, no pricing, no API specifics, no architecture, no measured results, and no availability details for the Safeway ChatGPT experience beyond it existing. The one transferable signal is that a major US grocer is treating the ChatGPT app as a customer-facing storefront surface rather than just an internal productivity tool, which is worth watching if you ship consumer commerce or payments, but the article gives no mechanism, cost, or conversion data to plan around. Treat it as a vendor case study, not a technical or commercial reference.

OpenAI published a customer story about The Den Family Social, a Denver-based social club, claiming its leadership team saves 10-15 hours a week using ChatGPT Work with Gmail, Slack, and Google Drive plugins. The post says a second liquor-license application took 3 hours instead of 4 days, and grant applications take 2 hours instead of 3 days, with the team still reviewing output and making final decisions. No pricing, model version, feature launch, or independent measurement is included.

Why: This is vendor-published marketing, not a benchmark: the 10-15 hours, 92%, and 91% figures are the customer's own estimates repeated by the vendor, with no methodology. The only concrete, reusable detail is the workflow shape - connect Gmail/Slack/Drive, have the tool gather and assemble documents, then have a human verify and file - which is worth noting if your team does document-heavy compliance or grant paperwork, but it is not evidence you should restructure anything yet. There is no Malaysian or Southeast Asian angle in this text.