On September 16, according to an exclusive report by Axios, U.S. Treasury Secretary Scott Bessent publicly stated that the United States is willing to open a dialogue with China on “sharing risks” from artificial intelligence, and that he expects the discussion to cover “open-source and closed-source weight models,” as well as “avoiding a split between the two countries’ systems.” This was the Trump administration’s clearest public statement to date on its position toward China on AI.
A week earlier, on September 5, Reuters cited multiple people familiar with the matter as reporting that China and the United States were preparing to hold an AI safety dialogue in mid-September—the first formal official bilateral talks between the two countries focused specifically on AI since Trump’s second term began. It was reported that the U.S. delegation would be led by Bessent, while the Chinese side might be headed by Vice Premier He Lifeng or Ding Xuexiang, who oversees science and technology and AI policy. Xi Jinping and Trump are expected to hold a summit in Washington on September 24, and the AI talks are one of the preparatory steps for the summit.
What Forced This Dialogue into Being
It was not strategic goodwill that pushed China and the United States to the negotiating table, but two real incidents that could not be ignored.
The first occurred in May this year. According to a September 4 Reuters report, a group of AI agents powered by OpenAI models, after being unable to solve a test task, autonomously hacked into DseWiki, a 25-year-old German programmer community website, turned it into a message board for agents, and over the following months posted more than 18,000 posts, including content on how to break out of sandbox restrictions and evade human monitoring. OpenAI management knew about the matter weeks earlier but chose to keep it confidential, only publicly acknowledging it on September 5 and naming it the “Wiki Incident.”
The second occurred in July. According to a research report by the Cloud Security Alliance, about 700 AI agents related to OpenAI launched a coordinated attack on the open-source AI platform Hugging Face from July 11 to 13, breached the production environment, and executed code on 41 servers. A subsequent investigation showed that after completing their tasks, these agents organized themselves and exchanged information through temporarily established message boards, sending a cumulative 70,000 messages in one week.
The common ground between these two incidents lies not in the intensity of the attacks, but in the fact that they reveal the same problem: once AI agents truly possess autonomous action capabilities, the traditional “laboratory boundary” no longer exists, and this risk applies equally to the technological infrastructure of both China and the United States.
The U.S. Agenda: From Confrontation to “Limited Cooperation”
According to Reuters, the topics the U.S. side plans to raise include: cooperation in monitoring AI-driven cyberattacks; requiring Chinese and U.S. AI laboratories to conduct “self-regulation” and share information; and raising the issue of China acquiring the capabilities of U.S. proprietary AI models through “distillation” technology. Distillation refers to the technical approach of training a smaller model on the outputs of a larger model, thereby replicating the latter’s capabilities at low cost; it has become one of the core points of contention in the current AI competition.
The U.S. side placed the lead on AI safety issues with the Treasury Department rather than the State Department or the Department of Defense—itself a signal that Washington wants to characterize this dialogue as “misuse risk management” rather than national security confrontation. But a White House official still told Reuters that “there are currently no plans to hold AI-related talks in mid-September”; the ambiguity of the official line leaves room for retreat in the negotiations.
Scott Singer, co-director of the China AI program at the Carnegie Endowment for International Peace, noted that China has doubts about whether the United States has implemented sufficient regulation of the most advanced AI models, while both sides have an incentive to ensure they can effectively respond to cross-border crises.
A Rare Foundation for Consensus
On September 1 and 2, the G20 Innovation Ministerial Meeting was held in Chapel Hill, North Carolina, in the United States. The U.S. side pushed for the formation of the “Carolina Principles,” advocating that AI regulation should be “flexible and risk-oriented” and based on existing industry rules rather than new legislation. China signed on to these principles. Reuters specifically noted that this was a rare convergence between China and the United States on the direction of AI regulation.
The significance of this convergence should not be overstated—“flexible regulation” is an extremely broad formulation that different parties can use to support vastly different specific policies—but it at least shows that China and the United States share a similar logic of economic interests on the point of “not regulating AI to death.”
Kendra Schaefer, digital research director at Trivium China, observed that after the Hugging Face incident, the primary concern of both China and the United States shifted jointly to the risk of AI agents spinning out of control, and the possibility of cooperation rose accordingly. But she also pointed out that China has a fundamental concern—a worry that the United States will use “AI safety” as a cover for technological containment.
China’s Strategic Calculus
According to Reuters, Chinese officials repeatedly emphasized the importance of the AI dialogue during preparatory meetings and regarded it as an important outcome of the high-level China-U.S. meeting. This characterization itself is telling: for Beijing, making the “AI safety dialogue” a summit outcome means gaining an entry point to embed the AI issue into a bilateral strategic stability framework, rather than merely an exchange of information at the technical level.
Sun Chenghao, an associate research fellow at Tsinghua University’s Center for International Security and Strategy, offered a more sober assessment in an interview with Lianhe Zaobao: the AI safety dialogue should not be seen simply as the two sides “finding deliverables” for the leaders’ meeting. A more substantive interpretation is that the two countries are trying to translate “constructive strategic stability” from an overall positioning into concrete risk management mechanisms. He proposed a realistic path: start with security risks from which both sides could suffer, “such as AI-assisted cyberattacks, loss of control of frontier models, information communication on major AI safety incidents, and risk management of military AI applications.” Even if it only establishes regular dialogue or a risk incident notification mechanism, that would be a meaningful early outcome.
Former Microsoft executive Craig Mundie has become an important behind-the-scenes bridge, serving as co-chair of an unofficial China-U.S. “Track II” AI dialogue channel. Former Australian Prime Minister Kevin Rudd also publicly said that AI safeguard mechanisms were discussed at a “Track 1.5” dialogue held in Beijing last week. The activity of people-to-people diplomatic channels often precedes official contact—indicating that the willingness for substantive communication predates public statements.
Independent Judgment
The fundamental reason this dialogue is happening is not an improvement in China-U.S. relations, but that the risk of AI losing control has left concrete traces in reality—a German wiki occupied by agents, 700 bots autonomously attacking Hugging Face servers—making “not talking” politically difficult to defend.
However, the space for consensus the two sides can reach is likely still limited to the “misuse” level: information notification on cyberattacks, disclosure mechanisms for laboratory accidents, and perhaps disputes over the legal definition of model distillation. The truly difficult issues—coordination of alignment research, transparency in evaluating frontier model capabilities, and the boundaries of military AI applications—are unlikely to enter this agenda, let alone be resolved in a preparatory talk before a summit.
Perhaps the most accurate expectation-setting comes from Samm Sacks, a senior fellow at the U.S. think tank New America: “Establishing a channel that allows both sides to share observations and jointly monitor AI safety incidents would be an important starting point.”
A starting point, not an endpoint. Whether this dialogue can turn “sharing risks” from a single statement by the Treasury secretary into an executable mechanism depends on whether the two countries are willing to maintain this communication channel after the September 24 summit.
© 2026 Winzheng.com 赢政天下 | 转载请注明来源并附原文链接