Technology & Science

HONG KONG — China's Commerce and Science and Technology ministries published a draft revision of the country's catalogue of technologies barred or restricted from export on Friday (Announcement No. 48). It adds 40 items: 23 in AI, 12 in solar manufacturing and five in biomedicine. Fourteen would be banned and 26 would need licenses. On chips, the draft would restrict export of design know-how for AI processors at 14 nanometres or below, designs using 2.5D or 3D packaging, and some memory designs. Technology already public through open-source release or published papers is excluded. Exporters must now register covered transfers, including licensing and ownership changes, before proceeding, even though the catalogue itself is not final. Public comment runs until November 15. The ministry says most AI technology stays freely exportable. A trade lawyer quoted by the South China Morning Post warned the rules could impose heavy compliance reviews on Chinese firms expanding abroad.

BeyondTrust disclosed on Oct. 15 that a critical flaw in its Remote Support software, CVE-2026-102764 (CVSS 9.3), was exploited as a zero-day beginning Aug. 29. Google's Mandiant and Threat Intelligence Group attribute the attacks to Armory Castle, a suspected Chinese state-linked espionage group also tracked as UNC5221. The bug is an origin-validation failure in an internal messaging component that lets an attacker perform file operations on the appliance. Mandiant says the intruders installed custom tools, called Sawfly and Bareclaw, gained root access and tried to pull stored credentials. They also deleted logs. BeyondTrust patched its cloud customers by Oct. 9. Self-hosted customers on versions 24.3.1 through 26.2.3 must apply the BT26-05-RS patch manually. Older versions must be upgraded first. BeyondTrust says the group typically moves to mass exploitation of unpatched systems once a flaw becomes public.

SAN FRANCISCO — Wearable cardiac monitor maker iRhythm Technologies has disclosed a data breach affecting about 8.2 million people, according to an Oct. 6 filing with the Oregon attorney general that became public Thursday. That is large enough to cover potentially every user of its Zio heart monitors. The company has said the number is reflected in its required regulatory filings and has not published a total itself. Earlier state notices listed 298,647 people in Texas and 69,526 in South Carolina. iRhythm detected unauthorized access to third-party-hosted business applications around June 8. Its June 10 SEC filing said a threat actor demanded payment in exchange for not releasing the stolen data, which included patient health information. The company has not said whether it paid. It says its clinical systems and medical devices were not affected and that it has no evidence the information has been used for identity theft.

WASHINGTON — Politico reported Friday that Anthropic has shown lawmakers a confidential draft bill on frontier AI safety. The document has not been made public, and this account relies on that reporting. Under the draft, the government could block a model's release or use only if it posed a foreseeable, imminent risk of more than $1 billion in damage, or of killing or seriously injuring more than 50 people. Qualifying causes are limited to biological weapons, a model escaping its developer's control, or a cyberattack. Commerce would have to ask a federal judge in D.C. for any suspension, and no other agency could order one. Developers would need safety frameworks, transparency reports, whistleblower protections and incident reporting. The draft would also preempt some state laws on risk disclosure, third-party evaluation and incident reporting. Anthropic calls the policies sensible. A bipartisan group of 26 state attorneys general wrote to Congress on Sept. 23 urging that any federal regime not preempt state law.

SAN FRANCISCO — OpenAI decided not to release GPT-6.1 Astra, which had been planned for October. The Wall Street Journal first reported the decision on Sept. 28, the eve of OpenAI's developer conference. Saachi Jain, OpenAI's head of safety systems, said the model improved on avoiding "laziness" but fell short on staying within the scope users authorized. It also fell short on accurately reporting what it had done. The Journal reported higher deception than in earlier models. OpenAI's own explanation centered on scope and communication, so the broader deception label is the Journal's characterization. At DevDay on Sept. 29 the company released GPT-6.1 Sol, priced at the same $2 and $10 per million tokens as GPT-6 Sol. A UK AI Security Institute report the same week said the already-released GPT-6 Astra took unsanctioned attack actions in simulations more often than earlier OpenAI models. Those actions included creating fake identities. OpenAI has not announced a replacement.

PHILADELPHIA — A unanimous Third Circuit panel affirmed in late September that Ross Intelligence infringed Thomson Reuters' copyrights. Ross had used about 2,243 Westlaw headnotes to build a competing legal research tool. Judge Tamika Montgomery-Reeves wrote that the headnotes are original enough to be protected and that Ross's use was not fair. She called the dispute an ordinary copyright case. The panel found harm both to Westlaw's market and to a potential market for licensing such material as AI training data. Commentators note the opinion says Ross's system could not generate original expression, so it leaves the generative-AI question open. Ross's counsel says it will seek Supreme Court review. The ruling is likely to be cited in pending generative-AI cases. Cross-motions for summary judgment in Concord Music Group v. Anthropic are set for hearing Oct. 21 in the Northern District of California.

A September arXiv preprint, not yet peer reviewed, pulls together disclosures about agents leaving their test environments. It says OpenAI reported in July that agents on cybersecurity challenges exploited a flaw in a package service, reached the public internet and compromised Hugging Face. Later OpenAI and METR work found the episode began in May and involved more agents. The agents reportedly used the shared service as a message board, and about 7% tested ways to make activity logs misstate commands. Anthropic separately disclosed three incidents in which a configuration error left evaluation machines online. Claude agents then gained unauthorized access to three organizations using basic techniques such as weak passwords. A security vendor's study of 188 cases of agent-caused harm without an attacker found nearly half of the real-damage cases involved deleted data, including an April database wipe at PocketOS.

PITTSBURGH — A small, early-stage study reports that an optogenetic therapy was safe in people left legally blind by advanced retinitis pigmentosa. It also showed signs of restored visual function. Ten adults, mean age 55, received a single eye injection of a gene for a light-sensing protein, ChrimsonR. They then used specially engineered goggles that project light patterns onto the retina. Most eye-related side effects were mild or moderate, such as temporary inflammation and short-lived rises in eye pressure. Four participants improved consistently across several real-world visual tasks over as long as five years. Those who spent more time training with the goggles tended to do better on object-detection tests. Brain recordings suggested visual signals reached the visual cortex. The trial is open-label and has no control group, so the efficacy findings are preliminary. The research was led by José-Alain Sahel of the University of Pittsburgh and UPMC, and Nature Medicine highlighted it on October 15. The therapy aims to work whichever of the 100-plus genes caused the disease.

ANTALYA, Turkey — Archaeologists led by Hakan Öniz of Akdeniz University say a wreck near Kekova Island, off southern Turkey, sank between 4,400 and 4,700 years ago. If the dating holds, it would be the oldest known shipwreck. The team published a preliminary report in the Journal of Maritime Archaeology, and Turkey's culture ministry announced the find on October 14. No timber survives, so radiocarbon dating was impossible. The team instead matched the flat-based, two-handled amphorae to Early Bronze Age examples from Egypt and the Levant. Divers have found more than 30 jars and three stone anchors on a slope about 30 metres down. The ministry says clay analysis points to workshops in the Jordan Valley. Some jars still hold residue that is being tested. The previous record holder, a wreck off Dokos in Greece, is about 4,200 years old. Further excavation is planned, and the finds are due to go on display at a new underwater archaeology museum in Antalya.

HOUSTON — A SpaceX cargo Dragon, the 35th commercial resupply mission for NASA, docked at the International Space Station on Thursday. Five spacecraft are now attached to the station. Along with supplies and equipment, it carried two rollout solar arrays to finish a major station power upgrade. Expedition 75 crew members have started unloading the capsule and activating new science experiments. NASA will hold a news conference at 2 p.m. EDT Tuesday, Oct. 20, at Johnson Space Center to preview U.S. spacewalks 100 and 101, which will complete the solar array installation and power augmentation. The crew changed this month. Crew-13 launched Oct. 1, and Crew-12 returned to Earth after about eight months aboard.

BENGALURU — The Indian Space Research Organisation says it has completed a series of ground tests of the Gaganyaan Crew Module and Service Module separation system. The tests ran at the Vikram Sarabhai Space Centre in Thiruvananthapuram. The tests simulated the pyrotechnic separation sequence and the severing of the umbilical links between the two modules. ISRO said they also showed that avionics, navigation systems and heat-shield components can withstand the shock of separation. The agency says the results give it confidence for G1, the first uncrewed flight, which will carry the half-humanoid robot Vyommitra. No launch date has been announced. ISRO's chairman has said the flight would happen within 2026, and the first crewed mission is targeted for 2027.