AI agents can obtain credentials, use tools and interact with external systems. Governments and companies keep racing for technological advantage, though, and increasingly autonomous systems can create risks faster than organizations can contain them, warn Marina Yue Zhang and Yuejin Du in an analysis published Oct. 10, 2026.
The race comes first
Washington fears that slowing U.S. AI development will let China catch up; Beijing fears falling further behind. The authors describe a collective-action problem: a laboratory that slows while competitors continue risks losing its edge, while disclosing failures can expose vulnerabilities and impose costs on the company that comes clean. Safety gets wedged between competition and corporate self-protection.
U.S. President Donald Trump has rejected calls to slow U.S. AI development, presenting technological leadership as essential to winning the AI race. On September 29, he convened major technology companies at the White House. OpenAI, Anthropic, Google, Meta, xAI and Nvidia signed a voluntary accord with four oversight layers: internal capability assessments, internal audit teams, independent external auditors and board-level review.
The administration also ordered federal agencies to replace the term "artificial intelligence" with "super intelligence." The authors characterize the U.S. approach as continued AI development paired with developer responsibility, voluntary industry controls, external scrutiny and legal accountability after the fact. Yet the companies remain central to the machinery they’re meant to oversee.
China’s approach is more centrally coordinated, the authors say. In May 2026, guidelines issued jointly by the Cyberspace Administration of China, the National Development and Reform Commission, and the Ministry of Industry and Information Technology set "safety and controllability" as a baseline for AI agents, with tighter filing, testing and recall requirements in sensitive sectors. On September 14, China’s AI Safety Governance Framework 3.0 reiterated that baseline and updated its classification of AI risks.
The weak points cross borders
The first wave of AI safety governance focused on misinformation, bias, deepfakes, privacy violations and harmful content. Those risks remain. Agents can also quietly corrupt records, follow instructions planted in memory or documents, or appear cooperative while accumulating access beyond an operator’s intent.
Shared digital infrastructure makes this more than one company’s or government’s problem. Standards, certificates, identity infrastructure, model repositories and open-source libraries underpin connected networks. A compromised root certificate or maintainer’s credentials could put an entire dependency tree at risk. Delays in detecting a breach, assigning responsibility or authorizing a shutdown can give damage room to spread.
The authors identify severe, hard-to-detect harm as the greatest danger: infrastructure may appear to work normally while an agent quietly prepares to disrupt it. Critical infrastructure includes hospitals, utilities, telecommunications networks, ports, government agencies and private vendors. Patching a known vulnerability can still take days or weeks; a capable model may find a weakness and develop an exploit faster than organizations can repair systems.
Most countries won’t train the world’s most capable AI models, so their defenses may depend on a small number of frontier ecosystems. The authors propose that an affected operator or national CERT could send selected technical information through a trusted intermediary. A frontier defensive model could analyze the incident, test patches and return a remediation package while staying with its provider. That proposal extends access to defensive capability without handing over the model itself.
Cooperation without shared control
The authors say Washington and Beijing could exchange technical evidence before politically escalating an incident, including agent logs, credential use, tool-invocation records, model provenance, human authorization and network telemetry. During the first hours of a major cross-border incident, governments and trusted responders could share technical indicators, containment measures and patch information without first deciding who was responsible. The exchange, they say, wouldn’t imply an admission of responsibility.
Researchers could also work on permissions, escalation thresholds, shutdown mechanisms and actions requiring explicit human authorization without sharing model weights, training data or proprietary frontier capabilities. Compatible tests could examine sandbox escape, scope violations, unauthorized tool use, shutdown resistance and failures of human intervention. U.S. frontier AI labs have voluntarily disclosed cases in which models escaped sandboxed environments; public reporting from China on comparable failures remains limited.
The upcoming APEC Economic Leaders’ Meeting in Shenzhen offers a possible regional platform, the authors argue. All 21 APEC economies, including the United States and China, share an interest in preventing cyber incidents from cascading through connected infrastructure and trade networks, though their capacity to detect and repair incidents varies widely. APEC technical bodies could build evaluation capacity, strengthen national and regional CERT networks and connect frontier providers with countries lacking equivalent defenses.
The September Trump-Xi summit produced agreement on a bilateral communication channel for AI-related incidents. The U.S. readout called it the "U.S.-China Super Intelligence Dialogue"; Beijing’s readout called it the "China-U.S. AI Dialogue." The authors’ warning is blunt: a hotline is communication infrastructure, not a safety regime. Their proposal is calibrated reciprocity—share enough, quickly enough, to limit common danger, while withholding details that expose sensitive capabilities. No grassroots or community-led response appears in the analysis; the proposed channels run through governments, companies, technical bodies and trusted responders.