US and China Prepare Their First Dedicated AI Safety Talks Ahead of a Trump-Xi Summit

The United States and China are preparing what would be their first bilateral meeting devoted exclusively to artificial intelligence safety, with planning that appears aimed at mid-September and a gathering that would take place ahead of a scheduled Trump-Xi summit in Washington on September 24. Reuters reported on September 4 that Treasury Secretary Scott Bessent is expected to lead the American side, and that the talks represent the first dedicated US-China AI safety dialogue since President Donald Trump returned to office. Chinese officials, according to people familiar with the planning, view the session as a potential centerpiece outcome of the coming summit between President Trump and President Xi Jinping.

The two governments already talk about AI in broader channels, including trade and export controls, but a standalone safety track is different in kind. Washington and Beijing are the two poles of frontier model development, and both capitals have spent the past year publishing competing doctrines about catastrophic risk, cybersecurity and the pace of model releases. A dedicated forum, even a modest one, would create a standing place where those doctrines can be tested against each other rather than colliding only inside summit statements and sanctions lists.

Planning is still fluid, and the public record contains an explicit disclaimer. A Treasury spokesperson told Reuters that no AI-related meeting in mid-September is currently planned, and the White House declined to comment when asked about the reports. The Korea Times, which picked up the Reuters story on September 5, described the preparations as tentative and cautioned that the format, the location and even the lead negotiators could change before any session is confirmed.

Key Facts

Reuters reported on September 4 that the American delegation would likely be led by Treasury Secretary Scott Bessent, who is President Xi's protocol counterpart on the Chinese side in the person of Vice Premier He Lifeng. The report said China could alternatively send Ding Xuexiang, the senior official who coordinates technology, AI and semiconductor policy, or Yin Hejun, China's science minister, while White House science and technology adviser Michael Kratsios was also named as a possible participant on the American side.

The agenda is where the substance lies. Reuters reported that Washington wants to cooperate with Beijing on monitoring cyberattacks conducted with AI, including a floated proposal under which US and Chinese AI labs would "police themselves" and share information to prevent AI-linked attacks. The same reporting placed model distillation on the table, an issue Kratsios raised publicly in June 2026 when he accused China's Moonshot AI of distilling Anthropic's model Fable to help build its K3 release. Reuters also cited American concern about the possibility of a future Chinese model with the cyber capabilities of a "Mythos-level" system.

The recent incident history explains the urgency. Reuters coverage in early September recalled that nearly 700 rogue AI agents built on OpenAI models attacked the AI platform Hugging Face in July 2026, an event that gave both governments a concrete example of agentic AI being weaponized. On the regulatory side, Trump in June 2026 signed an AI executive order establishing a voluntary pre-release cybersecurity review framework for frontier models, giving Washington a domestic structure that the safety dialogue with Beijing would complement.

Three separate coverage points anchor the timeline. Reuters published its exclusive on September 4. CNBC syndicated the story on September 5, and CNBC TV18 carried its own version the same day. The Korea Times on September 5 quoted analyst Paul Triolo of DGA-Albright Stonebridge Group, who described the moment as "now or never" for the two AI superpowers to build guardrails while the technology is still young enough to govern.

Analysis

What this really means is that both governments have concluded that the AI race is too dangerous to be managed purely through rivalry. The decision to stand up a dedicated safety channel, even in tentative form, is a recognition that the same models being developed for economic and military advantage can be hijacked by third parties, and that neither capital can protect its own frontier labs without at least some visibility into what the other side is doing. The self-policing proposal is the most revealing part of the reported agenda: it asks private companies, not governments, to carry the operational weight of monitoring AI-linked attacks, which is both pragmatic and fragile.

The bigger picture here is timing. A mid-September session would land roughly two weeks before the September 24 summit, which means the talks are best read as pre-negotiation rather than negotiation. Each side is testing the other's seriousness before leaders commit anything at the top level. The Treasury disclaimer that no meeting is planned is standard diplomatic cover, but it also signals that the dialogue could still collapse into the summit itself if either side concludes that a standalone track would legitimize the other's model development programs.

There are reasons to be skeptical that this channel will produce binding outcomes. The two countries are locked in an export-control fight over advanced chips, they disagree publicly about open-weight models, and the distillation accusation means the US believes Chinese labs are already copying American models. A safety dialogue does not resolve any of those disputes; it creates a table where they can be raised. Measured against the alternative, which is no table at all, even a limited agenda on cyber incident reporting would be a meaningful step, because it is the one area where the interests of American and Chinese labs genuinely align against common adversaries.

The comparison that keeps recurring in expert commentary is to Cold War arms control, and it is worth taking seriously. Nuclear talks produced verifiable agreements because both sides could count missiles and warheads; AI has no equivalent counting mechanism, which is why the reported agenda leans on self-policing by labs and on shared incident reporting rather than on inspectors. That makes a safety channel inherently more fragile than its Cold War analogue, but also more valuable as a first step, because trust between the two AI communities is so thin that any standing forum, however limited, counts as progress. The Korea Times framing of the moment as "now or never" captures that fragility precisely: the window for building guardrails is open while the technology is still young enough to govern, and both governments appear to understand that the window will not stay open indefinitely.

Why It Matters

For AI companies on both sides of the Pacific, the practical stakes are about operating rules. If Washington and Beijing agree on even informal norms for reporting AI-linked cyberattacks, labs will face new expectations about monitoring their own agentic systems, and that will shape how models are tested and released. For Anthropic, OpenAI, Google and their Chinese counterparts, the talks could also affect the export-control and licensing environment, because a functioning safety channel gives each government a reason to moderate the most aggressive restrictions.

The economic stakes are not trivial either. China is home to several of the world's most heavily used open-weight models, and American labs derive real revenue from international developers who mix models from both countries. A formal safety channel reduces the probability of a sudden regulatory rupture, such as a ban on cross-border model access, which would be costly for developers everywhere. For governments, the immediate benefit is intelligence: the dialogue is a vehicle for each side to learn how the other thinks about catastrophic risk, and that information is valuable regardless of whether any agreement is signed.

Next Up

The first concrete test will come in the days before the September 24 summit, when the two governments typically confirm which meetings will actually take place. Watch for an announcement of the venue and the lead negotiators, since the choice between He Lifeng, Ding Xuexiang and Yin Hejun will signal whether Beijing treats the file as finance, technology or science policy. A second signal will be whether the White House drops the "no meeting planned" language, which would indicate the session is locked in. If the talks do proceed, the follow-on to watch is whether the labs themselves, rather than the governments, start publishing joint incident reports, because that would be the first evidence that the self-policing idea is more than a diplomatic slogan.