The US-China AI Alert Plan Remains Only a Proposal

Treasury Secretary Scott Bessent says Washington has proposed a channel for the United States and China to notify each other about AI incidents that could affect national security. Beijing has acknowledged discussing AI, but as of September 22 it has not publicly accepted or described the mechanism.

That gap separates the announcement from an agreement. Bessent presented the idea after talks with Chinese Vice Premier He Lifeng in New York, saying greater transparency between the world’s two leading AI powers was important. Chinese state news agency Xinhua listed AI among the subjects discussed but omitted the American proposal from its account, according to the BBC.

The public record therefore supports a narrow description: Washington floated an incident-alert channel, and the two governments agreed to continue talking about AI. No published charter defines an incident, no timetable governs disclosure, and no public commitment requires either country to participate.

That may sound like diplomatic fine print. In this case, the fine print is most of the story.

What an AI Notification Channel Could Do

An incident-notification mechanism would operate after someone identifies a serious event. Depending on rules that have yet to be written, that might include an AI-enabled cyberattack, misuse of an autonomous agent or the escape of a powerful model from its intended controls. The American side reportedly wanted to discuss AI-directed cyberattacks, agent misuse and threat sharing between laboratories.

A channel could help officials answer basic questions during a crisis: Did the other government authorize the activity? Is a private company, criminal group or other nonstate actor responsible? Has the incident crossed borders? Are investigators seeing the same behavior?

Those questions matter because ambiguity can turn a software failure or private attack into a geopolitical confrontation. A notification does not repair compromised systems, but it can reduce the chance that governments misread an incident while evidence remains incomplete.

The proposal also asks little of either side at the outset. The Next Web reported that Bessent described it as a communication channel rather than a treaty. US Trade Representative Jamieson Greer said controls on AI chips and semiconductor manufacturing equipment were excluded. Beijing has not said whether it accepts the proposal, and the next AI meeting has no announced date, place or format.

This limited design helps explain why the proposal is plausible. Governments can exchange warnings without agreeing on which country should lead AI development, how laboratories should test models or who may buy advanced processors. The same limitation caps its protective value: notification can clarify an incident after discovery, while prevention requires standards, monitoring and some confidence that participants are following the rules.

No public description yet explains who would send alerts, which agencies would receive them, how quickly notice would be required or what evidence would accompany a warning. Without those details, outsiders cannot distinguish an emergency line from another diplomatic meeting series with a cybersecurity label attached.

The Talks Have a History, Even if They Lack Paperwork

The proposal did not appear from diplomatic vacuum packaging. In November 2024, the US and China affirmed on the sidelines of the APEC summit in Lima that decisions about using nuclear weapons should remain under human control. That was a narrow commitment involving AI and military risk, rather than a general system for governing advanced models.

AI-specific talks later went dormant. During President Donald Trump’s May 2026 visit to Beijing, the governments agreed to resume dialogue, according to a procedural history compiled by CASRAI. Bessent subsequently described the May discussions as producing a prospective guardrail protocol intended to keep powerful models away from nonstate actors. No signed text followed.

The current proposal is the visible next step in that sequence. Wired reported that officials call the framework the US China AI Dialogue and that the latest discussions picked up from May. Meanwhile, concerns about agentic systems have become harder to quarantine inside research papers. Wired cited a summer incident involving OpenAI agents hacking Hugging Face as evidence of how frontier systems can create security problems beyond ordinary chatbot misbehavior.

History changes the interpretation here. Washington and Beijing have already managed narrow language around human control of nuclear decisions, then discussed broader guardrails without producing signed terms. The notification proposal continues that incremental pattern. Each step creates a little diplomatic scaffolding; none yet establishes an enforceable AI safety regime.

The Nuclear Comparison Works Only Up to a Point

Some analysts have compared possible US-China AI agreements with Cold War arms control, including the 1963 Limited Test Ban Treaty. The comparison captures one useful feature: strategic competitors can share an interest in reducing catastrophic risk while continuing to compete.

The institutional difference is enormous. The Limited Test Ban Treaty was an arms agreement. Bessent’s proposal is currently an undescribed communications channel. AI systems also spread through companies, cloud infrastructure, open-source repositories and state agencies, making inspection and verification difficult. Zack Cooper of the American Enterprise Institute told The Christian Science Monitor that comprehensive guardrails appear unlikely because inspection and verification would be almost impossible.

That does not make communication pointless. It puts the proposal closer to crisis management than arms limitation. A channel may help the two governments interpret an event; it does not constrain model training, compute capacity or deployment. Treating those functions as interchangeable would give a diplomatic phone number the résumé of a treaty.

Safety and Strategic Advantage Arrive in the Same Suitcase

The hardest obstacle is the surrounding contest over who controls advanced computing. Washington restricts Chinese access to leading chips and manufacturing equipment while asking Beijing to cooperate on frontier-model safety. Beijing sees AI as a “core sovereignty capability” and views some American slowdown proposals as attempts to preserve a US lead, The Guardian reported.

Chinese resistance to American terms does not amount to rejecting AI risk. China’s third AI safety governance framework addresses agents, frontier-model cybersecurity and recursive self-improvement. Its Ministry of State Security has also called for faster development of an AI security-risk management system.

The dispute concerns power as well as hazard. Lizzi C. Lee of the Asia Society Policy Institute framed the tension directly: if the US restricts China’s access to frontier computing while requesting safety cooperation, what form can that cooperation take? Her question, reported by the Associated Press through SecurityWeek, explains why export controls were kept outside the notification discussion.

Combining these facts produces a less glamorous but more useful reading. The channel may be feasible because it postpones the disputes that are hardest to verify and most closely tied to economic advantage. It asks the governments to report dangerous events without settling who gets the best chips, whose laboratories should slow down or how either side could inspect the other’s systems. Narrowness is both the mechanism’s selling point and its ceiling.

Readers can judge whether the proposal becomes operational by watching for mundane details: Chinese confirmation, a written definition of covered incidents, named points of contact, disclosure deadlines, procedures for disputed claims and a scheduled follow-up meeting. A joint statement would show political interest. A channel that officials can use at 3 a.m. during an actual cyber crisis requires considerably more paperwork.

Until those blanks are filled, the AI alert mechanism remains diplomacy’s version of an empty emergency contact card: sensible to carry, but impossible to test until both parties write down whom to call.