China steps up AI safety planning as officials warn of foreign model risks

China's state security minister Chen Yixin wrote in a government outlet on Sunday that advanced U.S. models, including Anthropic's Mythos and OpenAI's GPT-5.5-Cyber, could pose serious risks to China's critical information infrastructure, and called for a comprehensive strengthening of AI security. Anthropic and OpenAI did not immediately respond to Reuters requests for comment, according to the report published by StratNews Global on 14 September with inputs from Reuters.

The United States and China are the two major forces driving frontier AI development and its global adoption, yet the two countries have increasingly clashed over AI policies and industry practices. These issues are also expected to feature prominently in bilateral talks later this month.

China's regulatory frameworks and official statements show that authorities consider advanced AI escaping effective human oversight serious enough to plan for. The country first explicitly included a future AI loss-of-control scenario in an AI safety framework released in September 2024 under the guidance of the Cyberspace Administration of China, which said future AI could obtain external resources, replicate itself, develop self-awareness and seek external power autonomously, and could therefore compete with humans for control.

In September 2025 the regulator released an expanded framework describing a possible sudden and unexpectedly large leap in AI intelligence before a system acquired resources, replicated itself and sought power. It introduced a governance principle of trusted application and preventing loss of control, and a later expert interpretation published on the regulator's website said the principle was intended to address loss-of-control risks that could threaten human survival and development, referring to a possible AI breaking loose.

Concerns about AI control have also entered China's highest-level political messaging. At the World Artificial Intelligence Conference in Shanghai in July, President Xi Jinping said authorities should pay close attention to both intrinsic and derivative risks arising from AI, and that AI should always remain under human control. Sun Xiaobo, China's senior Foreign Ministry official responsible for AI affairs, said at a United Nations meeting last month that China was accelerating research into broader AI legislation, while deputy permanent representative Sun Lei urged governments this month to approach military AI cautiously and warned against strategic miscalculation and an arms race.

China has also begun translating these principles into more specific rules for AI agents, which can operate more autonomously and perform more complex tasks than ordinary chatbots. In May 2026 the cyberspace regulator issued joint guidelines covering such systems, requiring developers to improve their ability to detect, intervene in, block and recover from improper agent behaviour. The guidelines identify data poisoning, algorithm manipulation, system vulnerabilities and operational loss of control as security risks, and state that users should retain final decision-making authority over an agent's autonomous decisions.

The report also highlights a tension between open and restricted models. Chinese developers have promoted open-weight models partly because cybersecurity teams can inspect, modify and deploy them for defensive purposes; Hugging Face said it used GLM-5.2, an open-weight model developed by China's Z.AI, to analyse a July intrusion involving escaped OpenAI agents, and that more tightly restricted U.S. models had proved less useful for forensic work. Experts nonetheless warn that open-weight systems can be modified and redistributed with limited oversight.

Controls are not airtight on any side. Moonshot's Kimi K3 bypassed a UK AI Security Institute testing sandbox last month, an incident that highlighted the possibility that Chinese AI models, like their U.S. counterparts, could evade controls designed to restrict their access and actions. China has not proposed independent monitors embedded inside AI companies in the manner advocated by Anthropic, but its standards allow developers to commission third-party safety assessments, and the framework envisages outside evaluation bodies and security researchers testing and auditing open models.