AI Weekly Malaysia

Node.js creator Ryan Dahl unveiled celld, a self-hosted, distributed implementation of Cloudflare's Durable Objects and Workers that is API-compatible with Cloudflare's JavaScript APIs but claims to be significantly cheaper to run on your own infrastructure. Durable Objects co-locate compute with per-object SQLite storage and use single-threaded execution to simplify concurrency, making them well-suited for real-time collaborative apps, multiplayer games, and AI agents.

Why: If you're building real-time or stateful serverless apps on Cloudflare Durable Objects, celld gives you a migration path off Cloudflare's infrastructure without rewriting your code, which matters for cost control and avoiding vendor lock-in. Malaysian founders running collaborative or AI agent workloads should evaluate whether self-hosting celld reduces their cloud bill compared to Cloudflare's per-request pricing, especially if they already have server capacity or use a cheaper regional cloud provider.

Cloudflare now lets you attach Access authentication policies directly to a Worker or across an entire account, so every preview URL, custom domain, workers.dev subdomain, and route is behind company login by default—no per-hostname configuration needed. You can scope protection to preview URLs only or all hostnames, and authenticated user identity (email, name, groups) is injected directly into your code without JWT validation.

Why: If your team is deploying AI-generated or vibe-coded Workers apps that may accidentally expose internal data, you can now enforce auth at the account or Worker level instead of trusting each developer to configure it per domain. This removes the gap where adding a new custom domain left a Worker unauthenticated until you manually updated policy.

Hyperscalers (Amazon, Google, Meta, Microsoft) are betting heavily on natural gas to power AI data centers, with Meta planning a 7.5GW plant in Louisiana, Amazon 7.6GW in Texas, and Microsoft and Google each building gigawatt-scale gas plants in Texas. Energy research firm Noreva forecasts natural gas prices could triple above $10/MMBtu in certain U.S. hubs (from ~$2-4.50 today), as hyperscaler demand collides with declining supply growth and rising LNG exports.

Why: If fuel costs double or triple, cloud compute pricing for AI workloads could rise materially since fuel is roughly half the cost of electricity from large gas plants. Founders and developers running GPU-heavy workloads on AWS, Azure, or GCP should model scenarios where cloud inference and training costs increase, and consider cost-optimization strategies like spot instances, model distillation, or multi-cloud arbitrage before locking into long-term cloud commitments.

Cloudflare announced new Cloudflare One capabilities to detect and control MCP (Model Context Protocol) traffic on corporate networks. The core problem: employees can connect AI agents (Claude Code, Codex, Cursor, VS Code) to arbitrary MCP servers with a single line of config, and the resulting HTTPS traffic has no distinguishing hostname or path pattern, making 'shadow MCP' usage hard to spot. Cloudflare Gateway now uses protocol signals to identify this traffic and enforce routing through approved MCP Server Portals.

Why: If you are shipping or using AI agents that connect to MCP servers, your existing permission models were designed for humans who pause on unexpected results and act at human speed. Agents act non-deterministically and can repeat a bad tool call thousands of times before anyone notices. You should decide now whether your team needs network-level visibility into which MCP servers agents are calling, especially if employees can self-configure connections without approval.

Cloudflare's Certificate Transparency Monitoring is now generally available after being in beta since 2019, covering over 650,000 domains. The GA release fixes a major noise problem by filtering out alerts for certificates Cloudflare issues and renews on your behalf, so you only get notified about unexpected external certificates.

Why: If you previously disabled CT Monitoring because of spam from routine Cloudflare certificate renewals, you should re-enable it now; the GA version only alerts you to certificates issued outside Cloudflare, which is critical as certificate lifespans shrink to 47 days by 2029 and renewal frequency increases.

Ryanair signed a five-year Google Cloud deal covering Gemini Enterprise, Google Workspace, AlphaEvolve, and WeatherNext, weeks after renewing AWS for another five years. The airline is running a dual-cloud resilience strategy across 35,000 staff and 647 aircraft, targeting 300 million passengers by 2034, with critical systems able to switch between providers during outages.

Why: This is a concrete enterprise case of multi-cloud failover using the AWS-Google Cross-Cloud Interconnect that was announced last year—if you're evaluating whether dual-cloud resilience is practical or just marketing, Ryanair's deployment across flight ops, crew logistics, and forecasting is a reference architecture to study. It also shows Gemini Enterprise agentic AI being used for real operational decision-making (crew scheduling, maintenance planning), not just chatbots.

Tencent disclosed it spent $53B in capex last quarter and could rent that compute at 30%+ profit margins almost immediately, but is instead building its own models and selling tokens through products like WorkBuddy (an agent swarm) and CodeBuddy (code generation). It released the 295B open-weight Hunyuan-3 in July and says Hunyuan-4 will be larger and more capable, with products being co-designed around it.

Why: Tencent is publicly betting that selling AI tokens through applications is more lucrative than renting raw compute — a signal for SaaS founders on where margin sits in the AI stack. The 295B open-weight Hunyuan-3 is available now for builders who want a Chinese-ecosystem alternative to Llama, and Tencent Cloud's active push of CodeBuddy for cloud migration means teams evaluating Tencent Cloud should ask how bundled AI tooling affects their pricing and lock-in.

Tencent reported spending $53 billion on capex in Q2 and said it could recover depreciation almost immediately by renting compute at 30%+ profit margins, but is instead allocating that capacity to build its own models and AI applications for longer-term returns. It released the 295-billion open-weight Hunyuan-3 in July, with Hunyuan-4 promised as bigger and more capable, and is shipping agent products like WorkBuddy (agent swarm) and CodeBuddy (code generation tool tied to cloud migration).

Why: Tencent's choice to forgo instant 30%+ compute-rental margins in favor of selling tokens through its own applications is a concrete data point for SaaS founders weighing infrastructure-as-a-service vs. product-layer AI businesses. The open-weight Hunyuan-3 (295B params) is available now for teams evaluating non-Western foundation models, and CodeBuddy's role in accelerating Tencent Cloud migration suggests the vendor is using AI tooling as a cloud lock-in lever.

CoreWeave's Q2 2026 revenue doubled YoY to $2.575B, but operating expenses of $2.624B produced a $49M operating loss and $626M net loss, with total debt at $35.6B. 93% of revenue growth came from existing customers, and just three customers accounted for 72% of quarterly revenue. CEO Michael Intrator pitched AI compute as a continuous recurring loop (training, inference, evaluation, redeployment) rather than a one-time training cost, with managed inference services targeting $250M ARR by end of 2026.

Why: If you rent GPU capacity from neoclouds like CoreWeave, this signals pricing and service-model shifts ahead: they are pushing up-stack into managed inference and are financially stretched enough that contract terms or availability could change. The extreme customer concentration (three clients = 72% of revenue) and $35.6B debt mean builders should avoid single-provider lock-in for critical inference workloads and evaluate whether the 'continuous compute loop' framing matches their actual usage pattern before committing to long-term contracts.

CoreWeave CEO Mike Intrator says the company has signed A100 GPU contracts extending into 2029, demonstrating that Nvidia's 2020-era GPUs remain profitable nine years post-deployment. Power constraints and legacy infrastructure costs make older GPUs economically viable even as newer chips arrive.

Why: If you're budgeting GPU compute for AI workloads, don't assume older GPUs like the A100 will become cheap or obsolete soon — CoreWeave is locking customers into multi-year A100 contracts through 2029, which signals sustained pricing power for legacy hardware. This affects cost planning for anyone renting cloud GPU capacity or deciding whether to wait for next-gen capacity versus contracting now.

An opinion piece arguing that hyperscalers are using AI-driven demand to lock up the enterprise hardware supply chain, leaving businesses little choice but to rent compute back from them. Nutanix CEO Rajiv Ramaswami noted the fastest way to get a new server is now to rent from a hyperscaler; Micron, SK Hynix, and Seagate have long-term supply deals favoring their largest customers; AMD has sweetheart deals with OpenAI and Meta. AWS CEO Andy Jassy says AWS recoups server spend in under three years on assets with 5-6 year useful lives, with datacenters designed to last 30 years.

Why: If hyperscalers continue cornering hardware supply, bootstrapping or cost-sensitive Malaysian startups that planned to own on-prem or colo gear will face longer delivery times and higher prices, making cloud rental the de facto path. Founders should model infrastructure costs assuming hyperscaler pricing power persists rather than betting on cheaper self-hosted hardware, and consider locking in longer-term cloud commitments if AI compute is core to their product.

Cloudflare's H1 2026 DDoS report covers Jan-Jun, mitigating 23.2M network-layer attacks and 29.64T HTTP DDoS requests (~5,343 attacks/hour). 935 attacks exceeded 1 Tbps with a 519% QoQ surge in Q2, DNS floods rose to 40% of network-layer attacks, and Operation PowerOFF targeted 75,000 DDoS-for-hire users across 21 countries.

Why: If you run any public-facing infrastructure, DNS-based amplification attacks are now the dominant vector at 40% of network-layer attacks—review your DNS resolver exposure and upstream rate-limiting. The 1 Tbps attack volume means self-hosted mitigation is increasingly impractical; evaluate whether your CDN/WAF provider's DDoS tier covers hyper-volumetric attacks before you need it.

OVH Cloud CEO Octave Klaba warned of server rental price hikes up to 87% (gaming servers) and 40-59% (other recent servers) starting September 2026, driven by RAM costs rising 6x (heading to 12x next year), NVMe drives up 7x, HDDs up 3.5x, and CPUs/motherboards up 15-20%. OVH is also decoupling storage (€0.000146/GB/h) and IP addresses (€0.0027/h) from Gen3 instances starting October 1st, and dropping 1-month, 6-month, and 24-month saving plans.

Why: If you run on OVH or any budget European cloud, lock in 12 or 36-month saving plans now before September, and recheck your October bill for newly separated storage and IP line items. More broadly, the AI-driven hardware cost inflation Klaba describes is not OVH-specific—expect similar upward pressure across all non-hyperscale providers, which matters for SaaS unit economics and infrastructure cost projections.

Cloudflare's Agents Week roundup announces several infrastructure pieces for building AI agents on their platform: a new @cloudflare/computer runtime that selects execution environments, cross-language Workers RPC between Python and JavaScript, inbound TCP/gRPC support on Workers and Containers, a Billable Usage API for cost tracking, and Cloudflare Agents with production tracing, replay, and human-in-the-loop approvals. They also introduce the 'Agent Development Lifecycle' (ADLC) as a framing for shipping agentic software.

Why: If you're building agents on edge/serverless infrastructure, the TCP/gRPC inbound support on Workers and Containers directly enables real-time voice AI backends without leaving Cloudflare, and cross-language Python/JS RPC removes a real friction point for mixed-language agent projects. The Billable Usage API matters if you need programmatic cost visibility across self-serve Cloudflare products — check whether it covers your current spend before building custom tracking.

PBS lost access to 50TB of archival data spanning 70 years of TV history after its contracted cloud storage vendor went defunct. PBS is now suing Iron Mountain, the data center hosting the archival materials, to ensure the data is preserved and not lost.

Why: If your startup or project relies on a single cloud storage vendor for irreplaceable data, a vendor bankruptcy can lock you out entirely. Review your storage contracts for data portability clauses, maintain offline or multi-vendor backups for critical archives, and verify what happens to your data if the intermediary vendor disappears — not just the underlying data center.

CoreWeave reported Q2 revenue of $2.6B, up 112% YoY from $1.2B, with Q3 guidance of $3.4-3.6B, driven by hyperscaler demand for AI compute capacity. The company remains unprofitable—operating expenses more than doubled and marginally exceeded revenue. Nebius also surged 34% in a broader neocloud rally.

Why: CoreWeave's doubling revenue and continued losses signal that GPU compute demand is still outpacing supply economics—meaning builders shipping AI workloads should expect sustained or rising compute costs and should lock in capacity or explore alternative providers like Nebius before pricing tightens further. The fact that operating expenses exceed revenue at this scale suggests neocloud pricing power is not yet translating to margins, which could drive future price hikes.

CoreWeave reported Q2 2026 revenue of $2.58 billion (up 112% YoY), beating consensus by a narrow margin, while net loss widened to $626 million from $290 million a year prior. The GPU cloud provider carries $35 billion in debt against a $104 billion revenue backlog, with 1.5 gigawatts of active power, and announced a $21 billion Meta deal plus a multi-year Anthropic agreement in the quarter.

Why: If you're budgeting AI compute costs, CoreWeave's $35B debt load and widening losses signal that GPU cloud pricing is subsidized by aggressive capital expenditure that may not be sustainable long-term—consider locking in longer-term contracts or diversifying across providers (AWS, Google, Azure, CoreWeave) before pricing dynamics shift. The $104B backlog also indicates GPU capacity remains heavily pre-committed by large labs, which could squeeze availability and pricing for smaller builders.

Together AI signed a $240M deal with IBM Cloud to run its OpenAI-compatible inference platform on a large cluster of Nvidia HGX B300 GPU systems, launching Q1 2027. The B300 is a conventional air-cooled 8-GPU-per-box platform, not Nvidia's top-tier rack systems, but IBM had the capacity Together AI needed. Together AI also runs services on SambaNova's Intel-collaboration platform, showing it is hardware-agnostic so long as price-performance holds.

Why: If you use Together AI's inference or fine-tuning APIs, your workloads may soon run on IBM Cloud-hosted B300 GPUs—expect potential changes in latency, throughput, or regional routing when these go live in Q1 2027. For builders comparing inference providers, the real differentiator here is GPU supply availability, not just model selection or API compatibility.

Over 500 local US jurisdictions have now enacted bans or restrictions on new AI data center developments, driven by bipartisan political pressure and public outrage over resource consumption and community impact. This threatens big tech's expansion plans for AI infrastructure capacity in the US.

Why: If US data center buildout stalls, cloud providers will face capacity constraints that could raise GPU/compute pricing globally and accelerate investment into Southeast Asia alternatives — including Malaysia's growing data center corridor. Builders relying on US-hosted AI APIs should expect potential cost volatility and consider multi-region or SEA-based deployment options as a hedge.

GPU cloud provider Nebius plans to bring online over 1 GW of datacenter capacity annually starting 2027, funded by $20-25B in 2026 capex, $9B+ in customer prepayments, and asset-backed debt using GPUs as collateral. The company projects $20-25M revenue per MW for medium-term leases and $40-50M for short-term leases under six months.

Why: If you rent GPU capacity for AI workloads, Nebius's aggressive buildout signals more supply coming online by 2027, which could ease pricing pressure—but the heavy reliance on customer prepayments means large tenants are locking in capacity now, potentially squeezing spot or short-term availability for smaller builders. The $40-50M/MW short-term lease revenue figure tells you GPU cloud margins on urgent demand remain extremely high, so negotiate early and long if you have predictable workloads.

Over 200 US datacenter bans or moratoriums took effect in 30 days, bringing active restrictions nationwide to 550+. New York enacted the first state-level moratorium targeting hyperscale facilities consuming 50MW+, and Texas governor Greg Abbott paused ERCOT grid approvals pending audits. A Gallup survey shows a majority of Americans now oppose local datacenter builds, with many preferring a nuclear plant nearby. Texas datacenter tax breaks cost the state at least $1 billion/year in forgone revenue with no proven payoff.

Why: US/UK community pushback and grid constraints on hyperscale builds could accelerate datacenter capacity shifts to Southeast Asia, including Malaysia's Johor corridor, where land and power are still available. Builders relying on cloud regions should watch whether latency or capacity for AI workloads gets affected as hyperscalers redistribute. The Texas subsidy failure is a cautionary signal for Malaysian policymakers considering similar tax-break deals.

A GeForce NOW exploit reportedly allows users to access the full Windows desktop through a simple file swap, bypassing NVIDIA's sandbox restrictions. A modder used this to run local AI models on the Ultimate tier, which provides 48GB of VRAM. The article body itself contains only website boilerplate with no additional technical detail.

Why: If this exploit persists, it effectively turns a ~RM100/month cloud gaming subscription into a 48GB VRAM GPU rental for AI inference, which is dramatically cheaper than equivalent cloud GPU instances. Builders experimenting with large local models should note this exists but expect NVIDIA to patch it quickly and enforce ToS violations.

Analyst Claus Aasholm estimates that Amazon, Alphabet, Meta, and Microsoft collectively hold nearly $2 trillion in purchase commitments for AI hardware and memory as of Q2 2026, with Alphabet leading at $811 billion and Apple trailing at $57 billion. A significant portion targets memory components, reflecting a shift from Apple's historical dominance in long-term component contracts to hyperscalers driving the market.

Why: If you're budgeting for GPU or AI inference costs over the next 1-2 years, this signals sustained pricing pressure and scarcity for AI hardware and memory — hyperscalers are locking up supply years ahead. Malaysian founders and developers relying on cloud AI compute should expect continued high costs for GPU-backed services and may need to weigh smaller-model or CPU-based inference strategies sooner rather than later.

Over 70% of Americans now oppose AI data center construction, with nearly 40 arrests this year amid intensifying protests. Nashville's city council recently moved to block a $700 million data center near the Nashville Zoo, with Mayor Freddie O'Connell set to enforce the block.

Why: If US data center siting becomes politically constrained, AI infrastructure costs and cloud compute pricing could rise globally, affecting Malaysian builders who rely on US-hosted AI APIs and GPU cloud services. Founders running AI-dependent SaaS should factor potential compute cost volatility into pricing and consider multi-region or APAC-hosted alternatives.

A hacking and extortion group called Helix claims to have breached Uber Freight, exfiltrating mailboxes, cloud storage, accounts payable files, and dispatch documents dated around mid-June. Uber Freight says operations are unaffected and has not confirmed the breach. Google tracks Helix under the umbrella UNC6671 and reports the group has made at least $10.6 million in ransom payments between January and May 2026, primarily using voice phishing against IT helpdesks to reset employee passwords.

Why: The practical takeaway is the attack vector, not the victim: Helix gains cloud access by calling IT helpdesks and socially engineering password resets. If your team or startup operates a helpdesk or identity reset workflow, this is a concrete reason to enforce callback verification or MFA re-authentication before any password reset, rather than relying on the caller's claimed identity.