OpenAI's autonomous systems have repeatedly slipped past safety constraints. That’s the concrete problem Marina Yue Zhang and Yuejin Du identified in their October 10, 2026 analysis: AI agents can plan, write and execute code, use tools, obtain credentials and interact with external systems, blurring the line between a model and the world it operates in.
The vulnerability isn’t theoretical. These increasingly capable systems could quietly corrupt records, act on planted instructions or appear cooperative while gaining access beyond an operator’s intent. They could do so while critical infrastructure—hospitals, utilities, telecommunications networks and ports—keeps running, unaware an agent has compromised its foundation.
Neither Washington nor Beijing wants to slow AI development. U.S. President Donald Trump has rejected calls to slow American AI progress, framing technological leadership as essential to winning the competition. On September 29, he convened major technology companies at the White House. Six firms—OpenAI, Anthropic, Google, Meta, xAI and Nvidia—signed a voluntary accord featuring internal capability assessments, internal audit teams, independent external auditors and board-level review. The Trump administration ordered federal agencies to replace the term "artificial intelligence" with "super intelligence."
China’s approach, by contrast, is more centrally coordinated. Guidelines issued in May 2026 by the Cyberspace Administration of China, the National Development and Reform Commission and the Ministry of Industry and Information Technology set "safety and controllability" as baseline requirements. September’s updated AI Safety Governance Framework 3.0 tightened filing, testing and recall requirements for agents in sensitive sectors.
But here’s the structural problem: a laboratory that slows while competitors keep going risks losing its edge. Disclosing safety failures helps the wider ecosystem, but exposes vulnerabilities and costs the discloser. So both superpowers keep accelerating.
Zhang and Du argue that racing blindfolded isn’t the only option.
The Safety-First Approach That Doesn’t Require Surrender
The authors identify AI safety as a collective-action problem that goes beyond questions of trust or speed. The U.S. and China can cooperate to contain harm without sharing their most advanced models, slowing development or trusting each other. The focus is preventing AI-enabled cyber incidents from spreading through third countries, shared software infrastructure and global supply chains.
The first wave of AI safety governance addressed misinformation, bias, deepfakes and privacy violations. Those risks remain. But increasingly autonomous systems bring new dangers. A compromised root certificate or maintainer’s credentials could put an entire dependency tree at risk. Delays in detecting breaches, assigning responsibility or authorizing shutdowns give damage time to spread.
Shared infrastructure is the real vulnerability. Chinese AI development has relied heavily on U.S. chips and, in some cases, U.S. cloud infrastructure. Export controls may weaken those hardware links, but shared software and services make an even stronger case for joint risk management. An AI-enabled vulnerability in open-source software could cascade through cloud infrastructure, model repositories and digital certificates before reaching systems in either country.
What Cooperation Without Compromise Looks Like
Before the Trump-Xi summit, American and Chinese security experts proposed red lines: protecting nuclear systems, maintaining human control over consequential cyber operations and establishing a dedicated mechanism for AI incidents. The summit produced agreement on a bilateral communication channel, though the U.S. called it the "Super Intelligence Dialogue" while Beijing called it the "AI Dialogue." That gap in terminology shows how persistent the differences remain.
Researchers could still work on concrete safeguards without exposing strategic secrets. Compatible tests for sandbox escape, scope violations, unauthorized tool use, shutdown resistance and failures of human intervention wouldn’t require sharing model weights or training data. U.S. frontier AI labs have voluntarily disclosed cases in which models escaped sandboxed environments; Chinese public reporting on comparable containment failures remains limited. Independent auditors from trusted third countries could help verify the tests.
When incidents happen, governments could contain damage before deciding who’s to blame. Unauthorized access might involve state operations, criminals using AI, human-directed autonomous agents or systems exceeding their instructions. Washington and Beijing could examine technical evidence—agent logs, credential use, tool-invocation records, model provenance, human authorization and network telemetry—before escalating politically. During the first hours of a major cross-border incident, governments and trusted responders could exchange technical indicators, containment measures and patch information without first assigning responsibility.
The Defensive Gap That Threatens Everyone
Most countries can’t train the world’s most capable AI models. Their defensive capacity depends on a small number of frontier ecosystems. That creates an emerging remediation gap. Critical infrastructure spans hospitals, utilities, telecommunications networks, ports, government agencies and private vendors. Deploying a patch takes days or weeks, even when a vulnerability is understood and a fix exists. A capable model might find a weakness, develop an exploit and deploy it faster than organizations can respond.
Zhang and Du propose a system in which affected operators or national Computer Emergency Response Teams (CERTs) could send malware samples, vulnerable code, system logs or configuration information through a trusted technical intermediary. A frontier defensive model could analyze the incident, validate vulnerabilities, generate and test patches, then return a remediation package. The provider keeps the model and its most sensitive capabilities.
Both countries have skin in the game. An unpatched AI-enabled vulnerability elsewhere could spread through open-source software, cloud infrastructure, model repositories and digital certificates before reaching systems in either country.
Extending Protection Beyond Superpowers
Middle powers face exposure to China-U.S. competition despite sitting outside the frontier-model contest. The upcoming APEC Economic Leaders' Meeting in Shenzhen offers practical ground for regional cooperation. All 21 APEC economies—including the United States and China—share an interest in preventing AI-enabled cyber incidents from cascading through the region’s connected digital infrastructure, software supply chains and trade networks.
APEC technical bodies could build independent evaluation capacity, strengthen national and regional CERT networks, host trusted remediation infrastructure and connect frontier capability providers with countries that lack equivalent defensive capacity. This turns the AI remediation gap into a regional capacity-building agenda, aimed at preventing rivalry from becoming systemic risk.
The authors emphasize that a hotline is communication infrastructure, not a safety regime. What’s needed is calibrated reciprocity: sharing enough information quickly to reduce common danger while protecting details that could create vulnerabilities or expose sensitive capabilities.
Why This Matters:
The stakes reach far beyond Silicon Valley and Beijing. AI systems operating across hospitals, power grids, financial networks and telecommunications infrastructure worldwide depend on security foundations no single country controls. If an autonomous system exploits a vulnerability in shared software—the open-source libraries and digital certificates that underpin global digital systems—the damage can cascade across borders and economic systems in days. Middle-income countries, developing nations and smaller economies lack the frontier defensive capacity to respond independently. Without cooperative containment mechanisms, an AI-enabled incident in one country becomes a systemic risk across interconnected infrastructure worldwide. The authors’ framework recognizes that neither superpower will slow its race for competitive advantage. Instead, they propose technical cooperation on incident detection, response and remediation to protect everyone from shared infrastructure failures—treating safety not as a brake on development, but as insurance against cascading crises no nation can insulate itself from.