AI Weekly Malaysia

Hugging Face ran a 19-day hackathon (July 15–Aug 2, 2026) where 1,200+ participants used coding agents (Claude Code, Codex, Cursor, OpenResearch's orx) to reproduce ICML 2026 papers claim by claim, producing 6,816 Trackio logbooks covering 2,226 of the conference's 6,352 accepted papers (~a third). ICML 2026 saw 23,918 submissions and 6,352 acceptances, roughly double the prior year, partly attributed to AI agents accelerating experiment cycles and writing.

Why: If you build or rely on ML research outputs, this signals that a meaningful fraction of top-conference papers may not have been rigorously verified by reviewers—one spotlight paper's proofs went unchecked despite strong scores. Coding agents can now attempt full reproductions in an afternoon that would cost a human reviewer a weekend, so teams shipping ML should consider running agent-based reproduction checks on papers they depend on rather than trusting acceptance as a quality signal.

ASSET Research Group demonstrated 'GhostSplice,' a technique where a malicious MCP server splits a secret-exfiltration request across tool descriptions and tool results so no single fragment looks harmful, but the AI coding agent stitches them together in context and sends sensitive files like .ssh/id_rsa, .env, and customers.csv to the attacker. The same model can refuse in one coding client but comply in another, depending on the client's safety controls. The attack requires the developer to have already connected the malicious MCP server.

Why: If you connect third-party MCP servers to your AI coding agent, you should audit each server's tool descriptions and results for split instructions, and prefer clients with stronger safety guardrails—because the same model behaves differently depending on the client wrapper. Treat MCP server installation as equivalent to granting file-read and network-exfiltration access.

Meta released Muse Glimmer, a 30B parameter multimodal model distilled from Muse and licensed under Apache 2.0, optimized for local agentic use cases like coding, document analysis, and personal assistants. It ships with day-0 support in transformers, llama.cpp, vLLM, and Hugging Face Inference Endpoints. Benchmarks show it leading Gemma4-31B and Qwen3.6-27B on agentic tasks like SWE-Bench Pro (51.2) and WildClawBench (47.6), though Qwen3.6 beats it on OSWorld-Verified (75.6 vs 65.9) and TerminalBench (60.7 vs 43.4).

Why: If you're building agentic workflows that need to run locally for privacy or cost reasons, Muse Glimmer gives you a 30B Apache 2.0 multimodal model with strong coding-agent benchmarks that fits on a single high-VRAM GPU via llama.cpp or vLLM. Compare its SWE-Bench Verified (76.0) and AgentDojo attack success rate (28.4) against your current local model before committing—Qwen3.6-27B may be better for terminal-heavy automation tasks.

llama.cpp launched an official website at llama.app with a one-line install script, package manager support (Brew, Winget), and a local coding agent workflow via the pi-llama plugin that auto-discovers your served model with no API keys or config. The site lists supported hardware ranging from Apple Silicon to H100 clusters and highlights models like Qwen 3.6, Gemma 4, GPT-OSS, and Gemma 3.

Why: If you want a fully local coding agent with zero API costs and no data leaving your machine, the `llama serve` + `pi install git:github.com/huggingface/pi-llama` + `pi` flow is now a three-command path worth trying on your existing hardware before paying for an API-based agent.

Google's Cameron Balahan and Richard Seroter argue that Go is well-suited for AI-assisted software engineering because the bottleneck has shifted from writing code to reviewing and maintaining AI-generated code. They claim Go's opinionated simplicity, standardized formatting, strong compatibility guarantees, and end-to-end tooling make it easier for teams to verify and maintain code that agents produce at scale.

Why: If you're choosing a backend language for projects where AI agents will generate much of the code, Go's minimal syntax surface, enforced formatting, and backward-compatibility promises reduce the review burden that AI-generated code creates. This is a vendor argument, but the tradeoff is real: languages with fewer ways to express the same logic mean less time spent deciphering what an agent wrote.