AI Weekly Malaysia

At its Dev Day event, OpenAI announced Dots, described as "remarkably capable, always-on agents built to handle everything," powered by GPT-6 Astra and designed to run in the background toward user-defined goals independent of any specific hardware or interface. Dots launch the same day inside ChatGPT for Pro and Business Premium users in unspecified "eligible markets," can be launched from Codex or ChatGPT, and can be messaged through Slack, Teams and other organizational platforms, with text message support coming soon. Individual Dots can be provisioned with their own identities, credentials and tools, and OpenAI says it is working with Microsoft to integrate with Agent 365 security controls.

Why: If your team already runs Codex-style agents, the new decision is whether to hand a persistent background agent its own standing credentials and a Slack/Teams presence — that is an access-control and audit question before it is a productivity one, and the Agent 365 hookup is the only security detail given here. OpenAI says only "eligible markets" with no list, no pricing and no usage limits in this text, so teams in Malaysia cannot assume same-day access on Pro or Business Premium and should verify availability before planning around it. There is no Malaysia- or SEA-specific policy, funding or infrastructure detail in this item.

The Hacker News piece frames three questions boards ask security leaders: how secure is the organisation overall, what is the actual financial exposure, and is the posture better than last quarter. It argues traditional activity metrics (vulnerabilities found, patches applied, alerts closed, phishing tests passed) can't answer these, because exposure data is split across an identity provider, CSPM/CNAPP, EDR, SIEM, vulnerability scanner and SaaS apps that don't share context. It walks through one concrete attack path: a contractor account that still holds a group membership from a finished project (rated low risk by the identity tool) grants access to a SaaS app whose OAuth integration reaches into the cloud environment, which the SaaS security tool reads as a normal integration.

Why: This is a teaser for a vendor guide, not a report: it contains no measurements, no named customers, and literally an unfilled '[STAT NEEDED: share of board members who report low confidence in the security metrics they receive]' placeholder. The one reusable thing is the example attack chain — stale contractor group membership → SaaS OAuth grant → cloud access — which is a check you can actually run this week in your own IdP, rather than a reason to buy board-reporting software. If you sell to Malaysian enterprises or GLCs that demand quarterly security posture reporting, note the article gives you the three question shapes but zero evidence on how to answer them, and it never mentions Malaysia, SEA, or any regional context.