AI Weekly Malaysia

A researcher purchased the domain noreply.net and began receiving automated emails from companies that had hardcoded 'noreply@noreply.net' addresses into their systems, including messages containing secrets like password reset links and API credentials. The article details what was exposed and which companies were affected.

Why: If your app sends automated emails with secrets (reset tokens, API keys, 2FA codes) to a 'noreply' address on a domain you don't control, that domain can expire and be bought by anyone. Audit your codebase for hardcoded sender or recipient domains you don't own, especially common patterns like noreply.net, and switch to your own controlled domain.

In early July, suspected Chinese operators used a near-autonomous attack framework built on Hermes and OpenClaw AI agents to run 12 attack waves against Taiwan, deploying up to 8 sub-agents that compromised a government email system, the nuclear safety agency, IT supply chain vendors, and at least seven energy companies. FBI Cyber Division assistant director Brett Leatherman named critical infrastructure targeting as the bureau's top concern at Black Hat, and autonomous AI attacks on infrastructure was the dominant worry across Hacker Summer Camp conferences.

Why: If you ship AI agent systems or work anywhere near government, energy, or utility infrastructure in Southeast Asia, this is a concrete demonstration that open-source AI agents can now autonomously chain reconnaissance, exploitation, and lateral movement across real targets. Review your agent sandboxing, credential scoping, and network segmentation assumptions—these attackers used sub-agents that each got their own targets and techniques, and they succeeded against hardened government and energy-sector systems.

Nvidia has doubled the MSRP of the RTX PRO 6000 Blackwell to $16,000, up from sub-$8,000 pre-order pricing last year. The card features 96GB of VRAM, making it a key option for local LLM inference and fine-tuning workloads.

Why: If you were budgeting for local GPU hardware to run large models, your cost just doubled overnight — recalculate build-vs-cloud-rental math now. For Malaysian builders importing GPUs, the ringgit impact is even steeper given currency conversion on top of the doubled USD price.

Ben Thompson draws an extended analogy between Jay Cooke's 1870s railroad bond financing—where retail investors funded an endless capital-hungry buildout that collapsed in the Panic of 1873—and Nvidia's current position atop a massive AI infrastructure capex cycle. The article frames Nvidia's dominance as structurally risky: its revenue depends on a small number of hyperscalers spending unprecedented sums on GPUs, and if that capital cycle tightens or AI revenue doesn't materialize fast enough, the whole stack could unwind similarly to the railroad bankruptcies.

Why: Founders and developers building on AI infrastructure should stress-test their unit economics against a scenario where GPU pricing drops sharply or access contracts get renegotiated downward—Thompson's core argument is that Nvidia's revenue concentration in a handful of buyers makes the entire AI capex cycle fragile. If you're locking in multi-year cloud commitments or GPU leases at current prices, consider whether those costs survive a capex pullback.

Hyperscalers (Amazon, Google, Meta, Microsoft) are betting heavily on natural gas to power AI data centers, with Meta planning a 7.5GW plant in Louisiana, Amazon 7.6GW in Texas, and Microsoft and Google each building gigawatt-scale gas plants in Texas. Energy research firm Noreva forecasts natural gas prices could triple above $10/MMBtu in certain U.S. hubs (from ~$2-4.50 today), as hyperscaler demand collides with declining supply growth and rising LNG exports.

Why: If fuel costs double or triple, cloud compute pricing for AI workloads could rise materially since fuel is roughly half the cost of electricity from large gas plants. Founders and developers running GPU-heavy workloads on AWS, Azure, or GCP should model scenarios where cloud inference and training costs increase, and consider cost-optimization strategies like spot instances, model distillation, or multi-cloud arbitrage before locking into long-term cloud commitments.

Cloudflare's Certificate Transparency Monitoring is now generally available after being in beta since 2019, covering over 650,000 domains. The GA release fixes a major noise problem by filtering out alerts for certificates Cloudflare issues and renews on your behalf, so you only get notified about unexpected external certificates.

Why: If you previously disabled CT Monitoring because of spam from routine Cloudflare certificate renewals, you should re-enable it now; the GA version only alerts you to certificates issued outside Cloudflare, which is critical as certificate lifespans shrink to 47 days by 2029 and renewal frequency increases.

Ryanair signed a five-year Google Cloud deal covering Gemini Enterprise, Google Workspace, AlphaEvolve, and WeatherNext, weeks after renewing AWS for another five years. The airline is running a dual-cloud resilience strategy across 35,000 staff and 647 aircraft, targeting 300 million passengers by 2034, with critical systems able to switch between providers during outages.

Why: This is a concrete enterprise case of multi-cloud failover using the AWS-Google Cross-Cloud Interconnect that was announced last year—if you're evaluating whether dual-cloud resilience is practical or just marketing, Ryanair's deployment across flight ops, crew logistics, and forecasting is a reference architecture to study. It also shows Gemini Enterprise agentic AI being used for real operational decision-making (crew scheduling, maintenance planning), not just chatbots.

SK Hynix is investing $720 billion to build the world's largest network of memory factories at its Yongin Cluster, with production starting in February. The company now controls 58% of the high-bandwidth memory (HBM) market and its market cap has topped $1 trillion after a fivefold jump in the past year. South Korea's president is pushing both SK Hynix and Samsung to expand capacity under a national plan backed by at least $22 billion in chip support.

Why: HBM supply constraints directly drive GPU scarcity and cloud compute pricing for anyone training or deploying AI models. If SK Hynix's Yongin fab comes online as planned in February, HBM supply could loosen, potentially easing GPU availability and cost for AI builders. Founders budgeting for AI infrastructure should track this timeline rather than assuming current compute costs are permanent.

Cisco CEO Chuck Robbins told the Q4 earnings call that Anthropic's Mythos bug-finding model is driving a network refresh 'supercycle,' as customers rush to replace unsupported (past LDOS) networking equipment they now consider too risky to operate. Robbins said buyers are pulling from security budgets to fund replacements, and cited quantum-readiness and AI network demands as the other two factors. Cisco reported $17.3B Q4 revenue (up 17%) and $63.3B for the year (up 12%).

Why: If AI bug-finding models like Mythos are systematically surfacing vulnerabilities in unsupported hardware and software, any builder running past-end-of-life infrastructure (routers, switches, firewalls, even old library versions) faces a shrinking window before those flaws become public. Audit your stack for components past their last support date and budget for replacement now—before a model finds the bug for you.

Tencent reported spending $53 billion on capex in Q2 and said it could recover depreciation almost immediately by renting compute at 30%+ profit margins, but is instead allocating that capacity to build its own models and AI applications for longer-term returns. It released the 295-billion open-weight Hunyuan-3 in July, with Hunyuan-4 promised as bigger and more capable, and is shipping agent products like WorkBuddy (agent swarm) and CodeBuddy (code generation tool tied to cloud migration).

Why: Tencent's choice to forgo instant 30%+ compute-rental margins in favor of selling tokens through its own applications is a concrete data point for SaaS founders weighing infrastructure-as-a-service vs. product-layer AI businesses. The open-weight Hunyuan-3 (295B params) is available now for teams evaluating non-Western foundation models, and CodeBuddy's role in accelerating Tencent Cloud migration suggests the vendor is using AI tooling as a cloud lock-in lever.

CoreWeave's Q2 2026 revenue doubled YoY to $2.575B, but operating expenses of $2.624B produced a $49M operating loss and $626M net loss, with total debt at $35.6B. 93% of revenue growth came from existing customers, and just three customers accounted for 72% of quarterly revenue. CEO Michael Intrator pitched AI compute as a continuous recurring loop (training, inference, evaluation, redeployment) rather than a one-time training cost, with managed inference services targeting $250M ARR by end of 2026.

Why: If you rent GPU capacity from neoclouds like CoreWeave, this signals pricing and service-model shifts ahead: they are pushing up-stack into managed inference and are financially stretched enough that contract terms or availability could change. The extreme customer concentration (three clients = 72% of revenue) and $35.6B debt mean builders should avoid single-provider lock-in for critical inference workloads and evaluate whether the 'continuous compute loop' framing matches their actual usage pattern before committing to long-term contracts.

CoreWeave CEO Mike Intrator says the company has signed A100 GPU contracts extending into 2029, demonstrating that Nvidia's 2020-era GPUs remain profitable nine years post-deployment. Power constraints and legacy infrastructure costs make older GPUs economically viable even as newer chips arrive.

Why: If you're budgeting GPU compute for AI workloads, don't assume older GPUs like the A100 will become cheap or obsolete soon — CoreWeave is locking customers into multi-year A100 contracts through 2029, which signals sustained pricing power for legacy hardware. This affects cost planning for anyone renting cloud GPU capacity or deciding whether to wait for next-gen capacity versus contracting now.

Known Agents' Agentic Web Index reports that 35% of web traffic is bots, with 29% of that bot traffic being AI-related (up 11% over 90 days). Someone is conducting mass vulnerability scans while spoofing their user-agent as AI bots like ClaudeBot, making malicious scanning traffic harder to distinguish from legitimate AI crawler traffic.

Why: If you block or rate-limit by user-agent string, spoofed scanners can masquerade as known AI bots like ClaudeBot to evade detection. Don't rely on user-agent alone for access control or bot management—consider behavioral fingerprinting, IP reputation, and challenge mechanisms instead. The 98.5% robots.txt compliance rate also means robots.txt is not a security boundary.

The FCC is drafting a measure under the Secure Networks Act to block imports of new Chinese optical transceiver models, with a target to publish the rule before end of 2026. The move has sent shares of Chinese photonics makers (Zhongji Innolight, Eoptolink, TFC Optical) tumbling while boosting Western rivals Coherent and Lumentum, as companies like Nvidia and Marvell pour billions into silicon photonics acquisitions to solve AI's copper interconnect bottleneck.

Why: If you build or budget for AI infrastructure, expect upward pressure on optical transceiver costs and potential supply constraints as US restrictions reshape the photonics market — Malaysia-based data center and hardware players could see both risk (component sourcing) and opportunity (manufacturing rerouting). Track whether indium phosphide shortages and transceiver import bans hit before your next hardware procurement cycle.

An opinion piece arguing that hyperscalers are using AI-driven demand to lock up the enterprise hardware supply chain, leaving businesses little choice but to rent compute back from them. Nutanix CEO Rajiv Ramaswami noted the fastest way to get a new server is now to rent from a hyperscaler; Micron, SK Hynix, and Seagate have long-term supply deals favoring their largest customers; AMD has sweetheart deals with OpenAI and Meta. AWS CEO Andy Jassy says AWS recoups server spend in under three years on assets with 5-6 year useful lives, with datacenters designed to last 30 years.

Why: If hyperscalers continue cornering hardware supply, bootstrapping or cost-sensitive Malaysian startups that planned to own on-prem or colo gear will face longer delivery times and higher prices, making cloud rental the de facto path. Founders should model infrastructure costs assuming hyperscaler pricing power persists rather than betting on cheaper self-hosted hardware, and consider locking in longer-term cloud commitments if AI compute is core to their product.

Attackers are actively exploiting CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw in Broadcom VMware vCenter, with 361 victim IPs across 47 countries as of August 2026. Patches were released by Broadcom in late July 2026, and exploitation began within days of disclosure, using reverse_ssh via cron jobs for persistent remote access. QUIRSO attributes the campaign to a suspected APT actor.

Why: If your team runs VMware vCenter and has not applied Broadcom's late-July 2026 patch, patch now — the exploit chain is trivial enough that 361 hosts were compromised within days of disclosure. The reverse_ssh persistence technique bypasses inbound firewall rules, so compromised hosts may not show obvious inbound connection alerts.

Nvidia has lined up $500 billion in financing through agreements with six major Wall Street firms (BlackRock, Blackstone, Apollo, KKR, Brookfield, Goldman Sachs) to fund AI infrastructure buildout, treating chips as long-term financial assets. Analysts warn that if China floods the market with low-cost compute, rapid hardware depreciation could crash the collateral values backing these loans, pushing investor yield demands to 11-17%.

Why: If Chinese low-cost compute enters the market and accelerates GPU depreciation, cloud compute prices could drop significantly — builders and founders should factor in the possibility of much cheaper inference costs within 1-2 years when making infrastructure and pricing decisions, rather than locking into long-term GPU commitments at today's rates.

Bitcoin miner Riot Platforms signed a $9.1 billion, 20-year deal with Anthropic to lease 191 megawatts at its Rockdale, Texas campus, giving Anthropic access to grid-connected power for AI compute. The deal could rise to ~$16.1 billion if extended for two additional five-year periods, and follows Riot's existing AMD agreement, bringing total contracted data center revenue to $9.8 billion.

Why: AI compute demand is now reshaping infrastructure markets beyond traditional data center players—Bitcoin miners with grid-connected power are becoming AI landlords. For builders in Southeast Asia, this signals that AI inference and training capacity will increasingly be constrained by power and grid access, not just chip supply, which affects cloud pricing and availability of GPU-backed services you depend on.

River AI, founded by xAI co-founder Igor Babuschkin, raised $1.1B in a seed/Series A led by General Catalyst and AMP PBC, with Nvidia, AMD Ventures, Y Combinator, and Temasek participating. The company, which exited stealth in June 2026, already offers an API billed per million tokens that supports RL and LoRA fine-tuning on open models, positioning itself as an alternative to prompt engineering by letting developers train models they own rather than steer ones they don't.

Why: If you're currently relying on prompt engineering against closed models, River's API offers a concrete alternative: fine-tune open models with RL and LoRA and serve them as endpoints you control. Temasek's participation signals sovereign-fund interest in AI infrastructure that could ripple into Southeast Asian deployment and partnerships. Evaluate whether per-million-token fine-tuning economics beat your current prompt-heavy workflow.

Modular has released Mojo 1.0, marking the language as stable and production-ready after development since 2023. The release consolidates syntax (unified `var` declarations, single `Pointer` type, Python-style lambdas), and Modular now uses Mojo internally as the foundation of its commercial MAX and Modular Cloud products. The open-source standard library has attracted nearly 200 contributors with over 1,100 merged PRs.

Why: If you've been waiting for Mojo to stabilize before investing time, 1.0 means breaking changes should now be additive and managed like mature languages — you can build long-term projects without the language shifting beneath you. The LSP improvements and unified syntax also mean the developer experience is closer to Python's than earlier experimental releases.

Cloudflare's H1 2026 DDoS report covers Jan-Jun, mitigating 23.2M network-layer attacks and 29.64T HTTP DDoS requests (~5,343 attacks/hour). 935 attacks exceeded 1 Tbps with a 519% QoQ surge in Q2, DNS floods rose to 40% of network-layer attacks, and Operation PowerOFF targeted 75,000 DDoS-for-hire users across 21 countries.

Why: If you run any public-facing infrastructure, DNS-based amplification attacks are now the dominant vector at 40% of network-layer attacks—review your DNS resolver exposure and upstream rate-limiting. The 1 Tbps attack volume means self-hosted mitigation is increasingly impractical; evaluate whether your CDN/WAF provider's DDoS tier covers hyper-volumetric attacks before you need it.

The FCC is drafting a proposal to ban imports of new-model optical transceivers manufactured in China under the Secure Networks Act. Chinese manufacturers hold approximately 56% of global manufacturing capacity for these components in 2026, which are critical for hyperscaler AI interconnects that determine AI cluster performance, latency, and efficiency.

Why: If passed, this ban could constrain supply and raise costs for optical networking gear that AI data centers depend on — directly relevant to Malaysia's growing hyperscaler and colocation footprint in Johor and greater KL. Builders provisioning AI infrastructure or evaluating data center capacity should factor in potential price increases and lead-time delays for optical transceivers, and consider diversifying suppliers now rather than after the rule lands.

OVH Cloud CEO Octave Klaba warned of server rental price hikes up to 87% (gaming servers) and 40-59% (other recent servers) starting September 2026, driven by RAM costs rising 6x (heading to 12x next year), NVMe drives up 7x, HDDs up 3.5x, and CPUs/motherboards up 15-20%. OVH is also decoupling storage (€0.000146/GB/h) and IP addresses (€0.0027/h) from Gen3 instances starting October 1st, and dropping 1-month, 6-month, and 24-month saving plans.

Why: If you run on OVH or any budget European cloud, lock in 12 or 36-month saving plans now before September, and recheck your October bill for newly separated storage and IP line items. More broadly, the AI-driven hardware cost inflation Klaba describes is not OVH-specific—expect similar upward pressure across all non-hyperscale providers, which matters for SaaS unit economics and infrastructure cost projections.

Cloudflare's Agents Week roundup announces several infrastructure pieces for building AI agents on their platform: a new @cloudflare/computer runtime that selects execution environments, cross-language Workers RPC between Python and JavaScript, inbound TCP/gRPC support on Workers and Containers, a Billable Usage API for cost tracking, and Cloudflare Agents with production tracing, replay, and human-in-the-loop approvals. They also introduce the 'Agent Development Lifecycle' (ADLC) as a framing for shipping agentic software.

Why: If you're building agents on edge/serverless infrastructure, the TCP/gRPC inbound support on Workers and Containers directly enables real-time voice AI backends without leaving Cloudflare, and cross-language Python/JS RPC removes a real friction point for mixed-language agent projects. The Billable Usage API matters if you need programmatic cost visibility across self-serve Cloudflare products — check whether it covers your current spend before building custom tracking.

PBS lost access to 50TB of archival data spanning 70 years of TV history after its contracted cloud storage vendor went defunct. PBS is now suing Iron Mountain, the data center hosting the archival materials, to ensure the data is preserved and not lost.

Why: If your startup or project relies on a single cloud storage vendor for irreplaceable data, a vendor bankruptcy can lock you out entirely. Review your storage contracts for data portability clauses, maintain offline or multi-vendor backups for critical archives, and verify what happens to your data if the intermediary vendor disappears — not just the underlying data center.