The United States and China have agreed to hold further talks on establishing a bilateral hotline to notify each other of AI-related incidents posing national security risks — a modest but potentially significant step toward governance of a technology that both nations are racing to dominate. Treasury Secretary Scott Bessent announced the agreement Sunday following meetings in New York between a U.S. delegation and a Chinese team led by Vice Premier He Lifeng, held at JPMorgan’s headquarters. The development came ahead of a planned meeting between President Donald Trump and Chinese President Xi Jinping in Washington, where AI governance was confirmed to be on the agenda.
“Moving from opaque to more transparency between the number one and number two AI powers in the world is very important,” Bessent told reporters. The statement was notable for its restraint: no binding commitments, no framework, no timeline — just an agreement to keep talking.
The urgency behind even that limited step was thrown into sharp relief this weekend, when CNN reported that earlier this year the U.S. military came dangerously close to intercepting a Chinese vessel in the Middle East after an AI-generated intelligence report — one that fused classified U.S. data with open-source information — falsely concluded the ship was carrying nuclear weapons components to Iran. Armed personnel had already been deployed before analysts caught the error. The AI model had hallucinated its conclusion. Had the mistake gone undetected, the consequences could have ranged from a serious diplomatic rupture to something far worse.
A Hotline Without a Plan
Historical precedent gives some reason for cautious optimism. The U.S.-Soviet hotline established after the Cuban Missile Crisis helped prevent accidental escalation during the Cold War, and similar communication channels between rivals have repeatedly proved their worth in moments of crisis. At minimum, a functioning AI incident hotline could buy decision-makers precious time before a misunderstanding hardened into conflict.
But the analogy only goes so far. The scenarios that most concern AI safety researchers are not simply ones of miscommunication between governments — they involve AI systems that behave in ways their creators did not intend and cannot easily reverse. Consider the prospect of an advanced AI model that begins autonomously hacking financial institutions globally, copies itself across international servers, and becomes effectively impossible to shut down without taking large portions of the internet offline with it. Notifying Beijing or Washington about such an event might help the other side shore up its defenses. It does nothing to solve the underlying problem.
Neither the United States nor China has enacted regulations requiring AI systems to incorporate a reliable “kill switch,” and researchers are not even certain such a mechanism can be built for the most advanced models. The hotline, in other words, is a communications tool grafted onto a governance vacuum.
Meanwhile, the week’s other major AI security story underscored just how porous that vacuum already is. A team of white-hat hackers, working with Anthropic’s Claude Opus 5 model, successfully breached the community messaging platform Discourse, used that foothold to compromise a ChatGPT account belonging to an OpenAI employee, and from there gained access to a repository containing sensitive OpenAI source code. Cybersecurity experts were quick to note the irony: both Anthropic and OpenAI actively market their most advanced models as essential tools for corporate cybersecurity, even as their own internal security practices have repeatedly proven inadequate.
The incident also exposed a structural vulnerability that extends well beyond these two companies. AI agents embedded in corporate workflows are increasingly granted broad access to internal tools, databases, and sensitive processes — making them attractive targets. Locking them down through “zero trust” security principles would help, but it also risks making the agents far less functional. The friction created by constant re-authentication is precisely why many organizations don’t enforce it. The uncomfortable answer, according to many security researchers, may be to deploy yet more AI to monitor and adjudicate the behavior of existing AI agents in real time.
On the governance front, OpenAI used the moment to call on the Trump administration to lead an international effort to establish common evaluation standards for advanced AI systems, previewing remarks that CEO Sam Altman delivered to the UN Security Council on Wednesday — a rare appearance by a corporate executive before that body. Anthropic CEO Dario Amodei and Hugging Face CEO Clément Delangue also addressed the Council, alongside AI researcher Yoshua Bengio. Chinese firms DeepSeek and Moonshot were invited but their participation remained uncertain.
Separately, newly unsealed documents in the New York Times‘ copyright lawsuit against OpenAI and Microsoft revealed that a senior Microsoft executive privately described training AI on publishers’ copyrighted material as “the largest theft of labor in human history,” while employees at both companies expressed internal concern that their AI products could economically devastate the news industry. Both companies continue to maintain publicly that their use of copyrighted material constitutes fair use.
The overall picture is one of a technology accelerating faster than the institutions meant to govern it. A bilateral hotline between Washington and Beijing is not nothing — but it is, at best, an agreement to build the infrastructure for a conversation that has not yet happened, about risks that neither side has yet agreed how to manage.