AI agents can plan, write and execute code, use tools, obtain credentials and interact with external systems, Marina Yue Zhang and Yuejin Du write in an analysis published Oct. 10, 2026. Their growing autonomy makes control harder. The authors cite incidents in which OpenAI's autonomous systems slipped past their constraints. They argue that the U.S. and China can work together to contain AI-enabled cyber incidents without slowing their own development or sharing their most advanced models.
A race with shared risks
Washington fears slowing U.S. AI development will let China catch up, while Beijing fears falling further behind. The authors describe safety as a collective-action problem: a laboratory that slows while competitors continue risks losing its edge, and disclosing failures can expose vulnerabilities and impose costs on the discloser. Neither side wants to give up ground.
Risks can cross national boundaries even when U.S. and Chinese systems remain separate. Shared software infrastructure, cloud services, digital certificates, model repositories and global supply chains can carry damage between systems. A compromised root certificate or a maintainer's credentials could put an entire dependency tree at risk, the authors write.
The most serious danger, they say, may be hard to detect. Infrastructure could appear to operate normally while an agent prepares to disrupt it, or quietly corrupt records, act on instructions planted in memory or documents, or accumulate access beyond an operator's intent. Delayed detection, responsibility decisions or shutdown authorisation can allow damage to spread.
Different controls, limited common ground
On September 29, U.S. President Donald Trump convened major technology companies at the White House. OpenAI, Anthropic, Google, Meta, xAI and Nvidia signed a voluntary accord with four oversight layers: internal capability assessments, internal audit teams, independent external auditors and board-level review. The administration also ordered federal agencies to replace the term “artificial intelligence” with “super intelligence.” The authors describe the U.S. approach as continued development paired with developer responsibility, voluntary industry controls, external scrutiny and ex-post legal accountability.
China's approach is more centrally coordinated, the authors say. In May 2026, the Cyberspace Administration of China, the National Development and Reform Commission, and the Ministry of Industry and Information Technology jointly issued guidelines setting “safety and controllability” as a baseline for AI agents. Agents in sensitive sectors face tighter filing, testing and recall requirements. China's AI Safety Governance Framework 3.0, issued on September 14, reiterated that principle and updated its classification of AI risks and related measures.
Researchers could work on permissions, escalation thresholds, shutdown mechanisms and actions requiring explicit human authorisation without sharing model weights, training data or proprietary frontier capabilities, the authors say. They also call for compatible tests covering sandbox escape, scope violations, unauthorised tool use, shutdown resistance and failures of human intervention. That work doesn't require shared models.
Incident response and middle powers
At the September 2026 Trump-Xi summit, the countries agreed on a bilateral communication channel for AI-related incidents. The U.S. readout called it the “U.S.-China Super Intelligence Dialogue,” while Beijing's readout called it the “China-U.S. AI Dialogue.” The authors say the different names illustrate the limits of shared terminology. A hotline is communication infrastructure, not a safety regime.
They propose exchanging technical indicators, containment measures and patch information during the first hours of a major cross-border incident, before governments settle attribution. Evidence could include agent logs, credential use, tool-invocation records, model provenance, human authorisation and network telemetry. Such an exchange, they say, wouldn't imply an admission of responsibility.
The authors identify an AI remediation gap: patches for critical infrastructure can take days or weeks to deploy, while a capable model may find a weakness and develop an exploit faster. They propose that affected operators or national CERTs send selected technical material through a trusted intermediary. A frontier defensive model could then test vulnerabilities and return a remediation package without transferring the model or its sensitive capabilities.
They identify the upcoming APEC Economic Leaders' Meeting in Shenzhen as a possible platform. All 21 APEC economies, including the United States and China, share an interest in preventing incidents from cascading through connected digital infrastructure, software supply chains and trade networks. The authors propose regional evaluation capacity, stronger CERT networks and trusted remediation infrastructure, rather than a common AI regulatory regime.