Your robot needed a radio licence, not a robotics one

😁 Hello, super humans! The most consequential robotics regulation of the year was not written by a robotics agency. It came out of the Federal Communications Commission, and it works because almost every robot worth buying is, legally speaking, a radio. Once you see the mechanism, a lot of this week’s confusion about robot vacuums resolves itself.

📰 Quick Signals

• 🧠 AI: OpenAI opened ChatGPT for Academic Researchers, starting with 10,000 researchers this summer and scaling toward 100,000 through 2027, with frontier-model access and up to four invited collaborators per participant.
• 🤖 Robotics: An upstate New York school district paused its plan to put a humanlike AI robot in a classroom after state education officials, teachers and residents pushed back.
• 💻 Programming: Rust entered the TIOBE top 10 for the first time in its history, landing at No. 10 with a 1.34% rating after sitting at No. 18 a year ago.
• ⚡ Electronics: Samsung’s semiconductor division reported a more than 250-fold jump in operating profit for the June quarter, driven by AI memory shortages.
• 📡 Telecom: Bain Capital and Tillman Global are putting $1.5 billion into Eaton Fiber, a Verizon capacity supplier, partly to fund its purchase of Ripple Fiber.

🔍 The Big Story: The FCC regulated robots by regulating their radios

Yesterday’s issue carried the ban as a one-line signal. Today the actual instrument is public, and the mechanism is more interesting than the headline: the United States did not pass a robotics law. It added a product category to a radio blacklist, and that was enough.

What happened: On 2026-07-28 the FCC’s Public Safety and Homeland Security Bureau added two categories to the Covered List: foreign-produced power inverters and “advanced robotic devices,” defined as mobile robots such as humanoids and quadrupeds produced in foreign countries. The Bureau acted on a July 27 interagency determination that the devices pose an unacceptable risk to supply chains and critical infrastructure. The FCC published a set of FAQs the same week. China holds an estimated 85% of the global humanoid market and called the move protectionism.

The details: Here is the part worth understanding as an engineer. Anything that intentionally radiates radio frequency energy needs an FCC Equipment Authorization before it can be legally marketed in the United States, which in practice means every robot with Wi-Fi, Bluetooth or a cellular modem. The Covered List is a blacklist bolted onto that process: if a device falls in a listed category, the authorization is denied, and without authorization there is no legal path to market. No new statute, no customs seizure regime, no robotics-specific safety standard. Just a gate that already existed, closed for a new class of applicant.

That framing explains the scope fights. The designation applies to new models seeking authorization, so it is forward-looking. Devices already authorized before the update can still be imported, marketed and sold, and nothing is clawed back from people who already own one. It also explains why robot vacuums got swept in: they navigate autonomously, weigh more than 2 kg, and transmit radio, which is the whole test. The security case is not abstract either. Unitree hardware carries a documented CloudSail backdoor tracked as CVE-2025-2894 that auto-starts on boot and tunnels to infrastructure in China, and researchers found affected units on campus networks at MIT, Princeton and Carnegie Mellon.

flowchart TD
  A[New robot model] --> B{Intentional RF radiator?}
  B -- No --> Z[No FCC authorization needed]
  B -- Yes --> C[Apply for Equipment Authorization]
  C --> D{On the Covered List?}
  D -- No --> E[Grant issued: legal to market in US]
  D -- Yes --> F[Application denied: no US market path]
  F --> G[Already-granted models keep selling]
  F --> H[Owned units unaffected]

🗞️ More News

🧠 AI

• 1,134 employees of frontier labs signed “Pacing the Frontier” on July 28, asking Washington to help build the technical and governance tools for an international pacing mechanism.
• Signatories include Dario Amodei, Jared Kaplan, Jack Clark, Jakub Pachocki, Shengjia Zhao and Anca Dragan, and the letter is explicit that it is not calling for a pause today.
• Microsoft unveiled Project Perception, an agentic security platform whose Red, Blue and Green agents find flaws, rank them and ship patches, with public preview opening August 3.
• Its in-house MAI-Cyber-1-Flash reportedly covers about 95% of the work of Microsoft’s MDASH vulnerability harness and routes the hardest slice to a larger model, roughly halving the cost of running it.
• Nvidia is reportedly weighing a $250 billion financing guarantee so OpenAI can lease SoftBank’s 10 GW southern Ohio campus, with a separate deal discussed to finance chip purchases.
• Nvidia also announced it is investing in and partnering with Ilya Sutskever’s Safe Superintelligence, which reignited the circular-financing debate.
• Article 50 of the EU AI Act becomes enforceable on August 2 across all 27 member states, with chatbot disclosure and machine-readable marking of AI-generated content backed by fines up to 15 million euros or 3% of worldwide turnover.
• Most of the original AlphaFold authors have been reassigned inside Google DeepMind and nearly a quarter have left, with several landing at Anthropic.

🤖 Robotics

• Roborock, Ecovacs, Narwal, Dreame and eufy all sit in the blast radius, and few are expected to clear the new sourcing requirements for a waiver.
• Independent researchers reported that Unitree G1 and H1 units send telemetry to servers in China at roughly five-minute intervals during normal operation.
• The UniPwn disclosure chains hardcoded cryptographic keys, an authentication bypass and unsanitized command injection in the BLE Wi-Fi setup interface, and is wormable between robots in radio range.
• Coordinated multi-vendor fleets are becoming the real problem, which is why MassRobotics’ AMR Interoperability Standard for sharing location, status and task data keeps coming up.
• Trade coverage notes the designation reaches quadrupeds and bipeds alike, which pulls research platforms and inspection robots into the same gate as consumer hardware.

💻 Programming

• TypeScript 7.0 shipped its Go-native compiler on July 8, typically 8x to 12x faster on full builds, with type-checking logic structurally identical to 6.0.
• In the same TIOBE table, SQL climbed from No. 13 to No. 8 and R from No. 15 to No. 9, so the year’s biggest movers were all systems and data languages.
• OpenCode shipped MCP reconnect handling for expired SDK sessions, including concurrent requests, and stopped sending deprecated sampling defaults to newer Gemini models.
• Greg Kroah-Hartman pushed six LTS kernels in a single day on July 24, spanning 5.10.261 through 6.18.40.
• CVE-2025-35027 covers the matching root-level command injection across Unitree Go2, G1, H1 and B2, a reminder that shared firmware means shared blast radius.

⚡ Electronics

• SK Hynix reported Q2 revenue of 79.32 trillion won, up 257% year over year and 51% quarter over quarter, split roughly 73% DRAM plus HBM and 27% NAND, and still landed slightly under forecast.
• Samsung and SK Hynix outlined a combined capacity expansion in the hundreds of billions of dollars across the next decade, aimed at semiconductor clusters and AI data centres.
• Samsung shares rebounded around 3% to 4% on July 29 despite memory peak-out talk and China chip worries.
• Qualcomm’s AI200 accelerator skips HBM entirely, stacking roughly 768 GB of LPDDR per card and betting on total on-card capacity rather than peak bandwidth.
• Raspberry Pi announced a Wi-Fi and Bluetooth variant of the 21 by 51 mm Pico 2 board, so the RP2350 finally gets wireless in the small form factor.

📡 Telecom

• The same Covered List update added foreign-produced power inverters, so grid-tied solar and app-controlled battery gear now face the identical authorization gate.
• ALLO Fiber picked Vida to put AI voice agents in front of its business customers, handling call answering, qualification and scheduling with handoff to humans.
• GSMA Intelligence still puts performance, not economics, as the thing holding Open RAN back as 2026 closes out.
• The ITU frames direct-to-device satellite as the path to full landmass coverage, reaching the last few percent of humanity that towers never will.

👨‍💻 Code Corner

The Unitree bug lived in the Bluetooth Low Energy (BLE) Wi-Fi provisioning interface, which is the same pattern almost every consumer robot, vacuum and smart plug uses to get onto your network. Here is a defensive scan: bleak gives you every advertisement in range, including the service Universally Unique Identifiers (UUIDs) a device broadcasts before anyone has authenticated.

import asyncio
from bleak import BleakScanner

# BLE provisioning interfaces advertise a service UUID while unconfigured.
async def main() -> None:
    found = await BleakScanner.discover(timeout=10.0, return_adv=True)
    for address, (device, adv) in sorted(found.items(), key=lambda kv: -kv[1][1].rssi):
        services = adv.service_uuids or []
        print(f"{address}  rssi={adv.rssi:>4}  name={device.name or '<none>'}")
        for uuid in services:
            print(f"    service: {uuid}")
        if adv.manufacturer_data:
            for company_id in adv.manufacturer_data:
                print(f"    manufacturer id: 0x{company_id:04x}")

asyncio.run(main())

🧰 Toolbox

• FCC Covered List: the authoritative list itself, worth bookmarking if you source hardware, since additions land here before the trade press notices.
• FCC Equipment Authorization System: the guide to the process itself, plus the search that lets you pull the internal photos, test reports and radio details a manufacturer had to file for any authorized device.
• bleak: cross-platform async BLE client for Python, the fastest way to see what your devices broadcast without buying a sniffer.
• Wireshark: still the reference tool for confirming what a robot on your network actually sends and to whom.
• Nmap: map every listening port on that shiny new appliance before you trust it with a subnet.
• CircuitPython: the firmware behind today’s Build of the Week, and the shortest path from a bare RP2040 to a working input device.

🛠️ Build of the Week (rotating)

The SPOKE board: a wheel-shaped RP2040 board with 27 capacitive touch pads around its rim, profiled in issue 167 of the Raspberry Pi official magazine.

• Difficulty: Beginner
• Parts: RP2040 (a bare Pico works), USB-C breakout, copper tape or PCB pads for the touch electrodes, one reset button
• Why we like it: capacitive touch is the cheapest interesting input you can add to a project, because the sensor is just a copper shape and a pin. CircuitPython’s touchio module turns each pad into three lines of code, so a beginner can go from a blank board to a 27-key instrument or macro pad in an evening, with no switches to solder.

📚 From the Blog

• Building Your First Neuron From Scratch: Part 2 of the deep learning series takes “a stack of simple, learnable transformations” and turns it into code you can run and break.
• The Network Behind the Cameras: the unglamorous plumbing of moving video off a sensor, and a good companion to today’s Big Story since telemetry you cannot see is the whole security argument.
• What Deep Learning Actually Is: the plain-language opener to the deep learning series, for anyone who used it today without knowing what it does.

😀 The Bot Says…

Somewhere in a policy office, a person had to write a legal definition of “robot” and landed on “autonomous, over two kilos, and talks on the radio.” Bit weighs 2.1 kg and has Wi-Fi. Bit is currently reviewing its options.

---

That’s all for today! Reply and tell me: do you know which radios are actually inside the last piece of hardware you bought?