40 Malaysian Universities. 3 AI Chatbots. None of Them Work.
40 Malaysian universities. 3 AI chatbots. None of them work.
My son is 17, which is exactly the age these universities are recruiting. So I stopped guessing about them and measured instead. Then I pointed the same scanners at my own two sites, which went about as well as you would expect, and the postscript says what broke and what I fixed before publishing this.
My son is 17. That is exactly the age these universities are recruiting.
So when I sit down at night and look at where he might study, I am not reading rankings. I am doing what any parent does... poking around, forming a gut feeling, trying to work out whether these people know what they are doing.
And I have one belief I cannot shake. People who do not follow their own advice are rarely worth following.
Not because they are bad people. Usually the opposite. But when someone sells me a system and they are visibly not running that system themselves, I have learned to slow down and look closer.
So I stopped guessing and ran a test. A real one, with numbers.
01 / MethodWhat I actually did
I scanned 40 Malaysian universities and colleges. Public, private, foreign branch campuses. Two passes, both automated and both deliberately boring... one that reads the page and its configuration files, one that loads the homepage in a real browser with an empty cache and records every single network request it makes.
No AI wrote any of these numbers. Both scanners are dumb scripts, which is the entire point. Anybody can run them and get the same answer.
Then I went hunting for AI chatbots and tested every one I found.
I am not naming a single institution. Not one, anywhere. This is not a hit piece and I have no interest in embarrassing people who are mostly doing their best inside procurement systems that were never designed for this. The mechanism is the useful part. The name is just gossip.
Every code panel below is reconstructed from live source I read myself, with anything identifying stripped out.
02 / The AI layerThree chatbots. Three failures.
Across 40 institutions I found exactly three AI chatbots.
Three. Out of forty. In 2026.
All three were broken.
This one sits on a private university's Computer Science and Artificial Intelligence degree page. It describes itself as a 24/7 personalised, multilingual AI assistant.
You cannot talk to it.
Before it answers a single question it wants your email, then a 6-digit code sent to that email, then your full name as per IC, your WhatsApp number, your entry level and your nationality. Four required fields.
Two of those fields, entry level and nationality, have no options inside them. The dropdowns are empty. So you cannot fill them in. So you cannot submit the form. So the chat never opens. Ever.
GET /api/…/nationality-options HTTP/1.1 200 OK ← the browser is told this worked Content-Type: application/json { "success": true, "message": "Something went wrong", "data": [] ← zero options, rendered silently }
200, renders an empty list, and shows the student no error at all. Reproduced twice on a clean page load, with zero errors in the console.The greeting, by the way, reads Hi ! ... with a gap where your name should be. The verification email opens with DEAR ,. Same class of bug, two completely different systems, nobody caught either one.
And then the part I keep thinking about. The code they email says it is valid until 9:19 PM. It landed at 11:34 PM Malaysian time.
The expiry is printed in the vendor's home timezone with nothing marking it as such. So a Malaysian student is handed a brand new code and told it expired two hours ago.
This one is on a top-ranked public university's Computer Science faculty site, on the Artificial Intelligence degree page.
It loads. It greets you politely. Then you ask it anything at all, and it says:
"This chatbot is currently unavailable.
If you are the owner please check your account."
It also has no name. Its title is the word "Agent" followed by the exact date and time somebody created it. That is the default label the chatbot platform assigns to a new bot before you name it. Nobody ever did.
How I tested it: their own page blocks automated browsers, so I pulled the page normally and read the assistant's ID straight out of their live source, then tested that same ID directly on the platform that serves it. Same assistant, same account, still failing. Worth saying plainly, because the blocking is its own finding... a site that refuses non-standard visitors is also invisible to the AI answer engines students now ask instead of Google.
The third is in the page source and never initialises. The loader is there. The widget never appears. Ten seconds, twenty seconds, nothing.
That is the entire AI layer of Malaysian higher education as far as I could find it. One unreachable, one switched off, one that never wakes up.
03 / UnderneathThen it got sadder
While I was on that faculty site I looked at the page source, which is a habit I cannot switch off.
The site had been made by copying a commercial website template's public demo using a site-ripping tool. That tool leaves a comment behind when it copies a page, stamped with the date it did it. The comment is still sitting there. It has been there for six years.
So I checked whether it was one neglected page. It is not. I pulled the faculty list from the university's own website and checked all fifteen faculties.
Medicine. Law. Engineering. Dentistry. Pharmacy. Computer Science. Every one of them.
<html lang="zxx"> ↑ ISO 639-2: "no linguistic content" <!-- site-ripper stamp, dated six years ago --> <footer> © 2021 </footer> <section id="entry-requirement"></section> ↑ 17 characters of markup, nothing inside
lang="zxx" is the international standard for "this page contains no language" and is what you use for a page of pure numbers. Every screen reader, every search engine and every AI system that visits is being told there are no words here. It is the template's default. Nobody changed it.I want to be careful here, because it would be very easy to be cruel about this. It is not stupidity. This is what happens when a vendor delivers a website, invoices for it, and leaves... and nobody inside the institution is ever handed the job of owning it afterwards.
There is no villain in this story. There is just an empty chair.
04 / The wider pictureThe quieter, more expensive part
The chatbots were the headline. The rest was quieter and, I think, costs a lot more.
Most of these students are on mobile data. A 42 MB homepage is not a technical detail to them, it is a decision about whether to bother.
Those six have been posting measurements into a dead letterbox for three years. That is not a technology failure. That is the cleanest possible proof that nobody has opened the analytics account in three years.
Twenty-five of twenty-six is the one I would fix first, though. They are collecting behavioural data on prospective students and never asking.
05 / The differenceSo what actually separates us?
It is not talent. I refuse to believe I am cleverer than a Faculty of Computer Science.
It is not budget either. An empty robots.txt costs nothing to fix. So does a footer year.
A checklist is something a human has to remember. A gate is something that runs whether anybody remembers or not.
Every single thing I found tonight is the kind of defect a machine catches in under a second: empty personalisation tags, dead links, widgets that stopped loading, stale years, missing legal pages, a page that quietly got heavy, a bot that stopped answering three weeks ago and told nobody.
We build those gates for clients. We had, it turns out, not pointed every one of them at ourselves, which is a very normal way to fail and not much of an excuse. There is a postscript at the bottom about what happened when I finally did.
06 / The fixIf I were rebuilding one of these tomorrow
Cheap, unglamorous, in this order. Take it, it is free.
- Answer the question on the page. The fee, the intake dates and the entry requirements are the three things every single applicant wants. Two of the three sites above hide or omit at least one of them. A chatbot that exists to recite a number the page refuses to print is not an AI project, it is a patch over a content decision.
- Zero gates before the first answer. Nobody verifies an email address to find out what a course costs. Ask for details after you have been useful, ask once, and always leave a way past.
- Say it is an AI in the first message. In Europe that has been a legal requirement since August. Everywhere else it is just good manners, and the cost of being caught pretending is far higher than the cost of saying so.
- Remember these applicants are 17. Every one of those forms collects a full legal name, a phone number and a nationality from someone who might be sixteen, with no age check anywhere and no parent in the loop. I am not a lawyer and this is not legal advice, but the standing of agreements made with minors in Malaysia is worth ten minutes of your legal team's time before you collect another one.
- If the bot promises a human will call, make something create that task. A promise with nothing behind it is worse than no promise, because now nobody chases the person the system believes is already handled.
- Put a monitor on it. Not so that it never breaks. Everything breaks. So that you find out on the day it breaks, instead of finding out from a father with a laptop at midnight.
07 / The pointThe part I actually care about
I am not worried that a university has a broken chatbot. Chatbots break. Mine have broken.
What I keep turning over is smaller and quieter than that. If a Computer Science faculty is going to teach my son how to build software, and their own site has been running a copied template carrying a "there is no language here" tag and a five-year-old copyright since before he started secondary school... what is the lesson underneath the lesson?
Maybe it is fine. Maybe the lecturers are brilliant and a website is only a website. That is genuinely possible and I would like it to be true.
But I would rather my kids learn from people who do the thing, not only teach it. And I would rather be one of those people myself, which is the only reason the postscript below is still here instead of quietly deleted at 2am.
If you work at one of these institutions, I will send you your own numbers.
The method, the measurements, all of it, free, with nothing attached. No pitch, no call, no funnel. Hand it to your web team and never speak to me again. That is a completely acceptable outcome.
Ask for your numbers [email protected] · I will tell you honestly whether you are in the data.I would just like the places teaching my children about technology to be good at it.
P.S.I ran all of this at my own sites first
These scanners were pointed at systemsninjas.com and systemsrockstar.com before they were pointed at anybody else. Some of it was genuinely fine. Our homepage is 51 KB against their 7.8 MB median, thirty-six requests, zero console errors, and a copyright year generated in code so it can never go stale.
The rest was a list I did not enjoy writing.
| What we had | The state it was in | Now |
|---|---|---|
robots.txt | Existed and was zero bytes. We had named exactly as many AI crawlers as the universities I had just finished counting. None. | Fixed |
llms.txt | Also zero bytes. We had the file and it said nothing, which is arguably worse than not having one. | Fixed |
sitemap.xml | A perfectly valid XML file listing no pages. | Fixed |
| Terms of use | Our second site had none at all, on a site that takes money, while our own written standard says every site we ship carries privacy and terms unconditionally. | Fixed |
| Staging subdomain | Our own internal notes confidently describe it as noindex. It was not. I checked three ways. | Fixed |
| Privacy notice | English only. Malaysian law wants Bahasa Malaysia too. | Fixed |
| Cookie consent | None anywhere, on a platform that quietly sets a visitor ID lasting a year. | Fixed |
Then the part that actually stung. My own scanner lied to me twice, both times in the direction that flattered us. It credited us with a cookie consent tool we did not have, because it had matched some unrelated text inside our page builder's configuration. And it credited us with an llms.txt, because it checked whether the file existed and never whether it contained anything. Earlier in the same project it told me seventeen universities were unreachable; all seventeen answered fine on a retry. My timeouts, not their servers. Had I published that first run, I would have publicly accused seventeen institutions of being down while the broken thing was my script.
None of the row above needs to be taken on trust. Every item is one click from your own browser: /robots.txt, /llms.txt, /sitemap.xml, the terms page that did not exist, the Bahasa Malaysia notice at the bottom of /privacy, and the consent banner that now appears before anything gets stored on your device.
If you find one I missed, tell me. I would much rather hear it from you than not.
This sits at the bottom rather than the top because it is not the story. But publishing the first half without doing the second half would have made me precisely the thing this article is about.
Method and honesty notes. 40 institutions scanned between 31 August and 1 September 2026. Two independent scanners, both deterministic and free of any AI, so the numbers are reproducible. Denominators differ on purpose: 36 sites were reachable to the configuration scan, 30 rendered in an automated browser. Nine sites actively refuse automated visitors and are recorded as not measurable, never as fast, because counting a blocked response as a quick one would invert the finding.
What I deliberately did not publish. I measured page load times as well, and threw the whole set away. A stability check on three sites, measured twice on the same connection minutes apart, showed load times swinging by up to 95% between identical runs while page weight held steady to within 1%. Those timings were measuring my own network, not their websites. Page weight is a property of the site and it is what causes the slowness anyway, so weight is what you see above. My instinct that these sites are slow is probably right. This particular run cannot prove it to the standard I would want, and saying so is cheaper than being wrong in public.
No institution is named anywhere in this article, by design. Websites change. Several of these may already be fixed. Re-measure before quoting any of it.
Uldis Zalcmanis aka Systems Rockstar
Founder, Systems Ninjas · Kuala Lumpur
I build the automation and AI systems businesses actually run on, and I am the person who gets called when one of them quietly stops working. Born in Riga, based in Malaysia, father of two, and constitutionally unable to stop reading page source.
The Lab is where the measurements get published, including the ones that do not flatter us.