AI Weekly Malaysia

An engineer at Softjourn asked an AI agent to recommend a package for a common task; the agent returned a plausible-sounding name that turned out to be a malware package recently registered by attackers exploiting AI-hallucinated package names—a technique now called 'slopsquatting.' The engineer caught it only because company policy required checking GitHub source code and download counts before installing anything an AI recommends.

Why: If you use AI agents or LLMs to suggest packages, you need a mandatory verification step before installing—check download counts, creation date, and skim the source on GitHub. Attackers are now deliberately registering packages under names that AI models commonly hallucinate, betting developers will install first and check later. This is a supply-chain attack vector that specifically targets AI-assisted workflows.

Former CISA acting head Matt Hartman and former NSA cyber boss Rob Joyce warn that AI agents are now actively used in real attacks for automated reconnaissance, personalized phishing, and exploit-chain discovery, while also creating a new attack surface via non-human identities and data-integration channels. Joyce's core message at RSAC: if you aren't running AI agents against your own systems, adversaries will do it for you—and keep the results.

Why: If you ship AI agents or integrate them into production, you now have a growing population of non-human privileged identities that bypass traditional static security policies. Practically, this means treating every agent as a privileged identity, adopting phishing-resistant auth and zero-trust behavioral signals, and running agentic red teaming against your own stack before attackers do it for free.

Matt Pocock released /wayfinder, a skill that acts as an orchestrator layer for the planning stage of AI agent workflows, particularly for greenfield projects where the end state is unclear. It splits planning into multiple threads, handles prototyping and research, and consolidates everything into a central document so you can produce detailed specs to hand off to AFK (Away From Keyboard) agents for overnight execution.

Why: If you're using AI agents for project work, the planning stage is typically the bottleneck where context window management becomes painful. /wayfinder automates session splitting and handoff management so you can produce richer specs without manually tracking tokens or thread depth — directly enabling longer unattended agent runs. Try it on your next greenfield project where you can't fully specify the end state upfront.

MCP servers, the middleware that lets AI agents connect to external tools and data, are becoming a major security blind spot by holding plaintext credentials, API tokens, and service account keys in configuration files. The article identifies three core exposure vectors: plaintext config files, over-permissioned access, and prompt injection—often before security teams even know the server is running. Because MCP turns AI agents into active identities with non-human credentials, a leaked secret grants attackers the ability to take action, not just read data.

Why: If you are building or deploying MCP servers for AI agents, you need to audit what secrets your MCP server configs hold and whether they are stored in plaintext—this is the concrete, immediate action the article demands. Over-permissioned NHIs (non-human identities) are the second thing to check: scope down API keys and tokens to least privilege. For Malaysian teams shipping AI agents into production, this is a practical checklist before connecting any MCP server to cloud infrastructure or internal databases.

Dharma-AI built a constraint-aware GPU allocator and benchmarked it against a FIFO scheduler across seven scenarios on identical hardware. GPU utilization rose by up to 33 percentage points and priority-weighted output rose by up to 105%, purely by changing the order of allocation decisions. The core problem is that batch-like workloads (training, batch inference, quantization) need contiguous uninterrupted GPU blocks while real-time inference is elastic and demand-driven, creating incompatible allocation shapes competing for the same GPUs in the same timestep.

Why: If you operate or pay for GPU clusters for mixed AI workloads, this post argues that scheduling order—not hardware—is the primary lever for utilization. The concrete takeaway: a FIFO scheduler with a fixed real-time inference reservation leaves significant GPU capacity stranded under contention, and a constraint-aware allocator that treats GPU-job-timestep as a binary grid can recover that capacity without buying more hardware.

Thunderbird will move to a fortnightly release cadence starting September, matching Firefox's accelerated two-week schedule. Thunderbird 154 adds Microsoft Graph API support for Microsoft 365, which is timely because Exchange Web Services is being deprecated for Microsoft's cloud products. Firefox 154 adds GeForce NOW support, Mac profile backups, and an AI-powered 'Smart Window' feature.

Why: If you manage Thunderbird deployments connected to Microsoft 365, you should plan migration from EWS to the new Graph API support in version 154 before EWS stops working. IT teams who prefer stability should pin to version 153 ESR, which remains supported for the next year while the new two-week release cycle begins.

Anthropic's blog interviews Slack CPO Jaime DeLanghe on building human-agent teams, arguing that workplace conversation in public channels is the context agents need to be useful. The core advice: default to public channels so agents can see decisions, ask agents to reconstruct reasoning rather than just retrieve records, and widen the surface area of accessible context across tools like Slack and Claude.

Why: If you're deploying agents in a Slack-heavy org, the practical takeaway is to shift team norms toward public-channel communication now—DMs and private threads are invisible to agents and permanently lost as training context. This is a culture change, not a tooling change, and it's worth deciding whether your team will commit to it before investing in agent integrations.

Sixteen typosquatted RubyGems packages (e.g., ubnuler, brumdler, activesupmport) were discovered on August 15, 2026, distributing a Windows info-stealer called StubMaker that harvests browser credentials, crypto wallets, seed phrases, and Telegram data. The packages have been yanked, but the campaign exploited a RubyGems design flaw where yanked package names can be reclaimed by new accounts, allowing the same malicious name to be revived after removal.

Why: If you ship Ruby applications, audit your Gemfile.lock against the 16 listed package names and pin dependencies to known-good versions. The broader lesson: RubyGems allows namespace reuse after yanking, so a package name that was safe yesterday is not guaranteed safe today—treat gem names as untrusted identifiers and prefer bundler checksum verification or private gem mirrors for production.

Swedish electric trucking company Einride plans to add 500 Tesla Semis to its fleet over 24 months starting September, tripling its fleet to serve customers like Amazon. Einride will manage the Tesla trucks through its Saga AI fleet management platform, which handles routing, charging, and deployment. Tesla only began volume production of the Semi in April 2026 and has already pulled back on volume production promises due to 4680 battery cell constraints.

Why: The deal hinges on Tesla actually delivering at scale, which its own Q2 shareholder letter says is constrained by 4680 cell production—so the 500-truck timeline is uncertain. For builders, the only actionable detail is that Einride's Saga AI platform is positioned as the orchestration layer for mixed-fleet electric trucking, which is a working example of AI-as-fleet-management-software rather than a model or agent product.

This is a paid-subscriber-only Lenny's Newsletter community roundup covering favorite Product Pass tools, AI's impact on hiring, and onboarding priorities for new employees. The full content is paywalled with no substantive details available in the excerpt.

Why: No actionable detail is available from the excerpt; the article is fully paywalled and only reveals topic headings. Readers cannot extract specific tools, hiring trends, or onboarding advice without a paid subscription.