AI Brief, 17 October 2026: China's draft export controls, and the three words they turn on

China's Ministry of Commerce and Ministry of Science and Technology published a draft revision of the Catalogue of Technologies Prohibited or Restricted from Export at 16:00 Beijing time on 16 October, 08:00 UTC. It adds 40 technologies, 23 of them in AI, and it is the first proposal by any major jurisdiction to bring the public release of open model weights inside an export-control perimeter rather than carving it out.

Two things are worth separating, because most coverage has not. Nothing is banned yet. The catalogue is a consultation draft, open for comment until 15 November, with no legal effect. What took effect on 16 October is narrower: anyone exporting a technology on the draft list must now register it with the ministry first, by self-assessment, including exports already under way. A notification duty switched on; a licensing regime was proposed.

The draft's headline is that core technologies of a large model — explicitly its weight parameters, key checkpoints, underlying source code and architecture design — fall into the restricted tier if the model meets any one of three tests: computation of at least 10^26 floating-point operations, a parameter count of at least 2 trillion, or capability "reaching globally leading level", defined as a global top-10 ranking. Restricted means a licence, not a prohibition; the only outright ban is for a model trained on China's "core data".

The reason to read the text rather than the wire copy is that two of those three thresholds turn on words the document never defines, and the third turns on leaderboards it never names.

• The parameter test does not say total or active. On total parameters exactly two open Chinese models cross it today; on active parameters none come close.
• The compute test does not say "training", and no Chinese lab publishes a compute figure.
• Open-sourcing gets automatic licensing, technology already public is out of scope, and API access, apps and SaaS are exempt outright.
• Reflection AI's Beam weights landed 16 October at 10:34:28 UTC, twelve days after the announcement: 188 shards, 1,002.67 GB, Apache 2.0 with nothing attached. The first outside score puts it 19th of 120.
• The NIST P-curve seeds were never a hash of anything. They are drand48 output seeded with a 1997 timestamp, and the finding is checkable in nine lines of Python.
• For a measure that could govern every frontier open-weight release from China, the best-performing Hacker News thread about it has three comments.

Three thresholds, and the words they turn on #

The parameter threshold is written 参数量≥20,000亿 — at least two trillion. It does not say whether that counts every parameter in the checkpoint or only the ones a token activates. For dense models the distinction is meaningless. For the sparse mixture-of-experts architecture every large Chinese model now uses, it is the difference between a rule that binds the flagships and one that binds nothing.

The compute threshold has the same problem one level deeper. The text says 计算量, "amount of computation", without saying training and without giving a convention. Take Qwen3.8-2.4T-A95B, 2.45 trillion parameters with 95 billion active. Training compute is conventionally approximated as

$$C\approx 6ND$$

with $N$ the parameters a token actually activates and $D$ the number of training tokens. Read that way, reaching ${10}^{26}$ would need

$$D=\frac{{10}^{26}}{6\times 95\times {10}^9}\approx 1.75\times {10}^{14}$$

which is 175 trillion tokens, several times any disclosed training run, so the model sits comfortably under. Substitute total parameters and a plausible 30 trillion tokens gives $6\times 2.4\times {10}^{12}\times 3\times {10}^{13}\approx 4.3\times {10}^{26}$ , comfortably over. Same model, same run, either side of the line depending on a convention the draft omits.

The third test will bite widest, and it is the strangest clause in the document. A model is controlled if, at the time the export occurs, it ranks in the global top 10 in public assessments by "mainstream" evaluators or large industry platforms, across overall performance, specialised capability, global invocation volume, safety, or training efficiency. No leaderboard is named, no adjudicator identified, and one of the five dimensions is usage rather than capability. Binding at export time rather than at release, a model's status is not fixed when it ships: it moves when a board moves.

What keeps this from being a shutdown is the exemptions. Technology already public through open-sourcing or published papers is out of scope; open-sourcing of in-scope technology gets automatic licensing, which the ministry's briefing calls essentially file-and-ship; API access, apps and SaaS are exempt outright. Dean Ball of OpenAI, quoted secondhand in the Decoder's account, reads it as Beijing taking the option to stop future open-weight releases rather than stopping them: a switch installed, not thrown.

One comparison is worth making precisely, because the obvious claim is wrong. This is not the first export control on model weights. The United States created ECCN 4E091 in January 2025 for closed-weight models above the same ${10}^{26}$ figure. Both regimes picked that number and diverge on one thing: the American rule explicitly excluded published weights, and the Chinese draft brings publication in.

Beam's weights exist, and the first outside number is not Reflection's #

Reflection AI announced Beam on 5 October as a 501B-parameter open-weight model and shipped no weights. This brief said so on the 6th, 7th, 9th, 10th, 11th and 12th. On 16 October at 10:34:28 UTC the repository took its first commit, titled "Beam is available": 188 safetensors shards, 1,002.67 GB, 501,331,850,176 parameters in BF16, about 23B active.

Two details settle open questions. The repository's creation date reads 7 October, which some coverage has taken for an upload date; there is no commit from that date, because the namespace was reserved and private and the whole tree arrives in one root commit on the 16th. And the licence is Apache 2.0 with nothing attached — byte-identical to the canonical text, no acceptable-use annex, no revenue threshold of the kind Meta, Liquid AI and Mistral each attached to releases covered here this fortnight. On openness this one survives the check.

The architecture repeats a pattern this brief described on 4 October. Of 52 layers, 43 are sliding-window attention at a 512-token window and 9 are full attention, and rotary embeddings are applied only in the sliding layers, so the nine global layers carry no positional encoding and instead scale queries by $(1+n/2048{)}^{0.1}$ , where $n$ is the sequence length. Nothing there is indexed to a length, so nothing needs rescaling to reach the stated 1,048,576-token context. It is also why the model is cheap to serve long: 9 layers of 52 hold a full cache, about 37 MB per thousand tokens at fp16.

The part that matters is the evidence. For eleven days every Beam figure was Reflection's own. Artificial Analysis now lists it at Intelligence Index 30, 19th of 120. Reflection's card reports Terminal-Bench v2.1 at 80.1, SWE-bench Verified at 81.6 and GPQA Diamond at 90.6, numbers that would put it at the frontier; the one external composite does not. It carries its own caveat — Artificial Analysis had pre-release access and is thanked in Reflection's launch post, so this is a cooperating second party, not an arm's-length reproduction — and no one has reproduced a single headline capability score.

The cleanest outside measurement is on the efficiency claim. Reflection says Beam uses "approximately 3x fewer inference-time reasoning tokens". Artificial Analysis spent 79 million output tokens completing its index against a 130 million median. That is a real advantage, and it is about 1.6x.

A 25-year-old question, answered so that nobody has to take it on trust #

The NIST prime curves under most of the web's ECDSA signatures come from seeds the NSA supplied in 1997 and never explained. The standard calls them verifiably random: pick a seed, hash it with SHA-1, derive the curve. For two decades the suspicion was that someone had searched for a seed giving a weak curve, and the folklore, from NSA cryptographer Jerry Solinas in 2015, was that the hash input had been a joke phrase like "Bob and Jerry rule". He died in early 2023 without remembering it, and Filippo Valsorda posted a bounty that October, pitched at password crackers, because everyone was hunting a preimage.

There is no phrase. Anthropic published on 16 October that the seeds are raw output of the 48-bit linear congruential generator in the standard C library, seeded with the Unix timestamp of the moment the program ran. For P-256 the timestamp is 871696354 — 01:52:34 UTC on 16 August 1997 — and the published seed is the 1,842nd twenty-byte candidate it emits. All ten prime-order seeds fall out the same way from six timestamps between May 1997 and April 1998.

The result is worth reporting because of what it does not require:

# NIST P-256's seed: srand48(871696354) = 1997-08-16 01:52:34 UTC,
# then the 1842nd 20-byte candidate.
state, out = (871696354 << 16) | 0x330E, []        # the state srand48(t) sets
for i in range(20 * 1842):
    state = (0x5DEECE66D * state + 0xB) % 2**48    # one step of the LCG
    if i >= 20 * 1841:                             # keep the 1842nd candidate
        out.append(state >> 40)                    # top byte of the state
print(bytes(out).hex().upper())
# C49D360886E704936A6678E1139D26B7819F7E90 — the SEED printed in FIPS 186

Nine lines, no dependencies, no network, about fifteen milliseconds. The target value appeared in Valsorda's bounty page three years before anyone knew the answer, so it cannot have been fitted after the fact. Valsorda reimplemented the algorithm in Go to check it, published his own run including intermediate candidates absent from Anthropic's write-up, and paid the bounty: $36,864, directed to ISRG.

Two things stay open, and the sceptics in the 766-point thread are right to press them. Valsorda finds about twice as many valid seeds as were published and cannot account for the gaps, and one selection rule in the 1997 code is still unrecovered. And the discovery story is far weaker evidence than the discovery. Anthropic reports that an unnamed internal model found this in under half an hour once an employee asked without supplying the misleading hint; the prompt is not published, the model is not named, and the post concedes colleagues had chased the wrong theory first. Greg Maxwell notes in the thread that an agent aimed at the same problem on 20 September turned up nothing. The answer needs no trust. The stopwatch does.

Also notable #

• An Apache-2.0 image model, and eighteen minutes to the first fork. Two Hugging Face repositories empty since 11 October took their first commit at 07:48:19 UTC on 16 October, publishing MOSS-Image: a 5.08-billion-parameter diffusion transformer under Apache 2.0 over a frozen Qwen3.5-9B text encoder, from MOSI.AI with authors at Fudan, Shanghai Jiao Tong and SII. At 08:06:32 UTC an unaffiliated account published a quantised repack. By day's end there were 23 derivative repositories and nine Spaces, none official, the most-liked being an 8-step distillation pushed live at a checkpoint every half hour, reporting no measurement of any kind and carrying the commit message "probably overcooked, lower the lora weights". Read the benchmarks carefully: the model leads the authors' own new LongLongTextBench at 96.3, but on the pre-existing LongTextBench it is fifth, a result relegated to an appendix, and its second-place human-preference score belongs to a system whose prompt enhancer calls GPT-6. No outlet has covered it.
• The decision-model board answered a question asked here all week. autotrust/JEV-35B reached the community Decision Index on 15 October, flagged as absent here on the 12th, 14th and 15th. It sits 25th of 173 at 59.73, exactly the figure AutoTrust claimed for itself, and the board publishes the calibration the vendor would not: ECE 0.0846 and Brier 0.3587 over 34,411 scored requests, against the 0.050 vision-only ECE on the model card. Its knowledge-area calibration error is 0.1438, nearly three times the figure its author chose to print. It is listed under a maintainer exception, having reproduced 98.42% decision agreement against a 98.5% bar.
• NVIDIA shipped a 4B model whose compute budget is a runtime setting. Dory 1.0, created 18:25:29 UTC on 16 October under the permissive OpenMDW-1.1 rather than NVIDIA's usual licence, is a looped model: 8 input layers, a shared 20-layer recurrent block applied repeatedly with the input reinjected, 8 output layers, pre-trained natively in NVFP4. Raising the loop count buys accuracy with no retraining, and only the last loop's cache is kept. From 1 to 4 loops SWE-bench Verified goes 50.3 to 61.8 and Terminal-Bench 2.1 goes 12.5 to 22.2, but GPQA Diamond and HLE are flat or worse past two loops: the elasticity buys agentic work, not knowledge. All figures are NVIDIA's.
• NVIDIA also published a speculative-decoding drafter for Meta's model, a 4.38B DFlash2 draft head for Muse Spark Open, about thirteen hours after those weights went live; four of its five published DFlash drafters target other companies' models. Tencent's DSpine landed the same day under Apache 2.0, reporting mean acceptance length 7.83 tokens on Qwen3-8B. Note what that is not: its paper's +27.8% acceptance gain yields +23.3% throughput, and the gap is the drafter's own cost, paid every iteration whether its tokens are accepted or not.
• PostgreSQL 19 slipped to 19 November, which The Register attributes to AI-assisted review finding defects faster than committers can triage. The release team's own posting cites scheduling and back-branch fixes, so that framing is the outlet's.

What to watch #

• Whether the consultation defines 参数量 and 计算量. The window closes 15 November. Total versus active parameters decides whether the threshold binds two flagship models or none, and the compute convention moves a single model across the line by an order of magnitude. Both are one-word fixes, and the comment process exists for exactly this.
• Which leaderboard, if any, gets named for the top-10 test. A control binding at export time against unnamed "mainstream" evaluators, one of whose five criteria is call volume, is not administrable as drafted. Watch too whether any Chinese lab delays or re-licenses a release before November. None has commented publicly.
• Whether anyone reproduces a Beam capability score. The weights are downloadable under an unencumbered licence and the harnesses are public, so Terminal-Bench v2.1 at 80.1 is checkable by anyone with the hardware. The gap between Reflection's table and 19th of 120 is the open question about this model.
• Whether any decision-model vendor publishes a fail-open rate. Asked here on 10, 11, 12, 13, 14, 15 and 16 October, now eight days running. The board supplied the calibration numbers instead; the nearest thing to a vendor answer came from a guardrail repository with zero likes.