Flashpoints | Economy | Security | East Asia

The US and China Cannot Slow the AI Race, But They Can Make It Safer

The United States does not need to trust China, share frontier models with China, or slow its own AI development to have a national security interest in AI safety cooperation.

The most important shift in artificial intelligence (AI) is not that models are becoming more intelligent, but that they are becoming more capable of acting.

Much of the first wave of AI safety governance focused on misinformation, bias, deepfakes, privacy violations and harmful content. Those risks remain. But increasingly capable AI agents can plan, write and execute code, use tools, obtain credentials, and interact with external systems. Recent incidents in which OpenAI’s autonomous systems slipped past their constraints show that as agents gain tools and autonomy, the boundary between a model and the outside world becomes harder to enforce.

That makes AI safety a collective-action problem. The AI superpowers face a prisoner’s dilemma. If one laboratory slows while competitors continue, it may lose its edge. Disclosure creates a similar tension: reporting failures can make the wider ecosystem safer, but the discloser bears the costs and may expose vulnerabilities to attackers. Governments face the same strategic impasse as the firms. Washington fears that slowing its AI development will allow China to catch up; Beijing fears that doing so will leave it further behind. 

Yet cooperation can be narrow on AI safety. The United States does not need to trust China, share frontier models with China, or slow its own AI development to have a national security interest in such cooperation. It has an interest in ensuring that AI-enabled cyber incidents are contained before they cascade through third countries, shared software infrastructure and global supply chains. China has the same systemic interest.

This collective action has significant implications for middle-power countries. Helping others repair a vulnerability can be a form of systemic containment and a public good.

The Accelerating AI Race

The AI arms race is intensifying. 

U.S. President Donald Trump has rejected calls to slow U.S. AI development, framing continued technological leadership as essential to winning the AI race. On September 29, he convened major technology companies at the White House, where six firms – OpenAI, Anthropic, Google, Meta, xAI and Nvidia – signed a voluntary accord built around four layers of oversight: internal capability assessments, internal audit teams, independent external auditors, and board-level review. His administration ordered federal agencies to replace the term “artificial intelligence” with “super intelligence,” presenting the technology as a source of economic and strategic leadership. 

Taken together, these moves point to a U.S. approach combining continued AI power with developer responsibility, voluntary industry controls, external scrutiny, and ex-post legal accountability.

China approaches the problem through a more centrally coordinated system. In May 2026, guidelines on AI agents, issued jointly by the Cyberspace Administration of China, the National Development and Reform Commission, and the Ministry of Industry and Information Technology, made “safety and controllability” a baseline requirement for agent development and deployment. Governance is tiered, with tighter filing, testing and recall requirements for agents used in sensitive sectors. 

On September 14, China’s AI Safety Governance Framework 3.0 reiterated “safety and controllability” while updating its classification of AI risks and associated technical and governance measures.

Despite their institutional differences, the two approaches converge on one point: neither country wants safety policy to halt AI development, and both increasingly recognize that greater autonomy creates new problems of control.

Common Ground and Shared Risks

AI systems rest on overlapping technological foundations. Chinese AI development has relied heavily on U.S. chips and, in some cases, U.S. cloud infrastructure. Export controls may weaken those hardware links, but the stronger case for joint risk management lies in the software and services AI systems share.

Standards, certificates, identity infrastructure, model repositories, and open-source libraries support trust across networks. A compromised root certificate or a maintainer’s credentials can put the entire dependency tree at risk.

AI risks vary along two dimensions: severity of harm and whether responsible actors can recognize it in time. The biggest danger is severe and invisible harm, where nothing visibly breaks for days or weeks, yet time compounds the severity of the incident. An AI agent could quietly corrupt records, act on instructions planted in its memory or in documents it consults, or appear cooperative while accumulating access beyond operator intent. Infrastructure may operate normally while the means to disrupt it are already in place. 

The dependencies and shared risks determine which code a system runs, which credentials it accepts, and which updates it trusts. Harm can cross borders quietly even when models and their owners remain separate.

That makes the speed of response critical. Delays in detecting a breach, assigning responsibility or authorizing a shutdown can allow damage to spread. Both China and the United States therefore need warnings to reach personnel with the authority and technical means to respond.

There is no obvious diplomatic agreement that can resolve the paradox built into the AI race: it rewards speed and secrecy, while safety depends on collective restraint and disclosure.

China-U.S. cooperation should instead focus on measures that improve safety without requiring either side to slow unilaterally, transfer its most advanced models, or expose commercially and strategically sensitive capabilities. Four areas stand out:

1. Keeping humans in control

Before the Trump-Xi summit, American and Chinese security experts in a long-running bilateral dialogue proposed red lines around nuclear systems, human control over consequential cyber operations, and a dedicated mechanism for AI incidents. 

When an AI agent can search, authenticate, write code, call external tools, and act within minutes or seconds, where should human intervention occur? Requiring approval for every step would undermine the autonomous value of AI agents; waiting until something goes wrong may make intervention too late.

The harder questions concern permissions, escalation thresholds, shutdown mechanisms and which actions should always require explicit human authorization. Researchers could cooperate on these engineering challenges without sharing model weights, training data, or proprietary frontier capabilities.

2. Test the guardrails, not each other’s secrets

Sandboxing, monitoring, permission controls, and model-level refusals are often treated as established safeguards. 

The underlying technical risk is broad: with appropriate tools and access, advanced models could identify previously unknown vulnerabilities and develop exploits across well-protected systems without step-by-step human direction. The key question is not whether a developer has guardrails, but whether they still work as agents become capable enough to search for ways around them.

While frontier AI labs in the U.S. have voluntarily disclosed instances of their models escaping from sandboxed environments,........

© The Diplomat