AI agents can plan, write and execute code, use tools, obtain credentials and interact with external systems, while the companies that build them retain control of the most capable models and defensive systems. Marina Yue Zhang and Yuejin Du say growing autonomy makes it harder to enforce the boundary between a model and the outside world.
Private control, shared exposure
The authors describe AI safety as a collective-action problem. A laboratory that slows while competitors press ahead risks losing its edge; a company that discloses a failure may help others defend against it, but also expose vulnerabilities and bear the costs. Washington fears that slowing U.S. development will let China catch up, while Beijing fears falling further behind.
That competition depends on connected digital infrastructure. Standards, certificates, identity systems, model repositories and open-source libraries support shared networks. A compromised root certificate or stolen maintainer credentials could put an entire software dependency tree at risk, the authors write. Damage may spread while systems look normal.
The risks reach beyond companies developing frontier models. Critical infrastructure includes hospitals, utilities, telecommunications networks, ports, government agencies and private vendors. Even after organizations understand a vulnerability and its fix, deploying a patch can take days or weeks. A capable model, the authors warn, may find a weakness, develop an exploit and use it faster than organizations can repair their systems.
Most countries won't train the world's most capable AI models, so their defensive capacity depends on a small number of frontier ecosystems. The authors propose that an affected operator or national Computer Emergency Response Team send malware samples, vulnerable code, selected system logs or configuration information to a trusted technical intermediary. A frontier defensive model could analyze the incident, test vulnerabilities and patches, then return a remediation package. The provider would retain the model and its most sensitive capabilities.
Government rules and corporate controls
On September 29, U.S. President Donald Trump convened major technology companies at the White House. OpenAI, Anthropic, Google, Meta, xAI and Nvidia signed a voluntary accord providing for internal capability assessments, internal audit teams, independent external auditors and board-level review. The administration also ordered federal agencies to replace the term “artificial intelligence” with “super intelligence.”
The authors characterize the U.S. approach as continued AI development paired with developer responsibility, voluntary industry controls, outside scrutiny and legal accountability after the fact. The accord puts oversight inside company processes and relies on voluntary commitments; the article describes no requirement to slow development.
China's policy is more centrally coordinated, the authors say. In May 2026, guidelines issued by the Cyberspace Administration of China, the National Development and Reform Commission, and the Ministry of Industry and Information Technology set “safety and controllability” as a baseline. They also imposed tighter filing, testing and recall requirements for agents in sensitive sectors. On September 14, China's AI Safety Governance Framework 3.0 reiterated that baseline and updated its classification of AI risks and related measures.
Containment before blame
The authors propose that governments exchange technical indicators, containment measures and patch information during the first hours of a major cross-border incident, before deciding responsibility. Evidence could include agent logs, credential use, tool-invocation records, model provenance, human authorization and network telemetry. Such an exchange, they say, wouldn't amount to an admission of responsibility.
They also call for compatible tests covering sandbox escape, scope violations, unauthorized tool use, resistance to shutdown and failures of human intervention. U.S. frontier AI labs have voluntarily disclosed cases in which models escaped sandboxed environments; public reporting from China on comparable failures remains limited. Independent auditors, potentially from trusted third countries, could verify the tests.
The authors say the September 2026 Trump-Xi summit produced agreement on a bilateral communication channel for AI-related incidents. The U.S. readout called it the “U.S.-China Super Intelligence Dialogue”; Beijing called it the “China-U.S. AI Dialogue.” A hotline, they say, is communication infrastructure, not a safety regime.
They identify the upcoming APEC Economic Leaders' Meeting in Shenzhen as a venue for technical cooperation among all 21 APEC economies, including the United States and China. Proposed work includes independent evaluation capacity, stronger national and regional emergency-response networks, trusted remediation infrastructure and links between frontier-capability providers and countries without equivalent defensive capacity.