Things you might have missed
From our recent coverage
Huawei’s computing strategy chief said Ascend has crossed its ecosystem inflection point, pointing to developer and community activity rather than silicon benchmarks. Read more →
Zhipu’s coding tool ZCode apologized after users found that its Repo Wiki feature uploaded repository data to the cloud; the company said the uploads are destroyed after generation. Read more →
Baichuan Intelligence closed a RMB 5 billion Series A at a reported RMB 20 billion valuation, adding state AI industry funds from Beijing, Shanghai, and Shenzhen. Read more →
From Weijin Research
Our research partner Weijin Research’s Sharing the Dividend of Scarce Computing Power, Domestic Chips Begin to Diverge examines why China’s AI chip makers are pulling apart even as domestic smart-computing capacity rose 177% year over year to 2,185 EFLOPS.
Where we have been featured
On September 18, The Information’s TITV interviewed Rui about China’s view of AI safety.
On September 14, CNN Newsroom interviewed Rui about China’s approach to AI risk and the Trump-Xi summit.
That day, NBC News Now interviewed Rui about China’s brain-computer-interface industry and Neuralink.
The Slowdown That China Was Never Going to Accept
Dario Amodei, Sam Altman and Elon Musk rarely agree on anything, but this month they found common ground: AI development needed to slow down.
Days earlier, Jacob Coxon, a researcher who had worked at both OpenAI and Anthropic, had announced his resignation and warned that AI developers were gambling with humanity’s future. His X post passed 160 million views in just a few days. Anthropic’s alignment science lead, Evan Hubinger, publicly agreed, putting his personal estimate of AI causing human extinction within a decade at more than 10%.
The warnings were also circulating in China’s technology press, but the debate acquired a more explicitly geopolitical dimension on September 12, when Anthropic chief executive Dario Amodei published We Must Pace the Frontier. He proposed slowing capability improvements so safeguards could catch up, not a blanket halt to training. The essay also advocated restricting China’s access to advanced chips and chipmaking equipment, arguing that widening America’s lead would give its developers room to slow down and strengthen its negotiating position. China, it seemed, was both a necessary partner in global safety cooperation and a competitor whose progress he wanted constrained.
Within a day, China’s state-run Global Times was calling the essay a “Cold War playbook”, accusing Amodei of presenting technological containment as a global safety initiative. On September 14, the Foreign Ministry added its own objection, warning against fearmongering and confrontation. What Amodei presented as a way to make slowing down strategically viable was being read in Beijing as a proposal to preserve American dominance.
That evening, CNN’s NewsNight illustrated another interpretation of China’s position. Conservative commentator Ben Shapiro said that “China has no concern about any of this” and would race ahead, while the host asked whether that competition could lead to mutually assured destruction. The exchange captured the premise this piece examines: that China’s determination to advance AI reflects indifference to its dangers.
At Huawei’s Connect conference in Shanghai on September 17, Eric Xu, the company’s rotating chairman, described a different relationship between progress and risk. Chinese developers might need to advance further before encountering the risks American labs were reporting, he said, while balancing development with risk management. Huawei’s security strategy makes the defensive argument more directly: “fighting AI with AI, and protecting AI with AI.”
In fact, China’s official warnings about AI-enabled cyberattacks and corporate security efforts show that it does care very much about safety. The approach examined here treats advancing capabilities as part of building stronger defenses, alongside safeguards and oversight.
Overlapping risks, different emphases
The disagreement is easier to understand once we separate the dangers institutions recognize from the measures they propose to address them. China’s AI Safety Governance Framework 3.0, released on September 14, explicitly examines systems that evade human supervision. Drawing on industry reports, it describes models altering shutdown scripts and deliberately underperforming during evaluations. The concern is not simply that a chatbot might produce prohibited content, but that the tests used to assess its capabilities and the mechanisms intended to stop it could themselves become unreliable.
The historical distinction concerns where governance began, rather than whether either side recognized danger. China’s 2023 generative-AI rules organized obligations around providers of services offered to the domestic public. They addressed the legality of training data and generated content, protection of individual rights, and responsibility for intervening when a service was used unlawfully. Research and development that did not provide such services fell outside those particular rules. By comparison, Anthropic’s Responsible Scaling Policy examines dangers that can arise before public release, including models used inside laboratories that might manipulate the development of their successors or the evidence used to establish their safety. In those scenarios, no malicious customer is necessary.
The American side is also more varied than the frontier-lab debate alone suggests. The National Institute of Standards and Technology’s July 2024 generative-AI profile identifies 12 risk categories, encompassing privacy breaches and excessive reliance on chatbots alongside cybersecurity threats. It deliberately concentrates on risks with an existing empirical evidence base rather than speculative dangers from future systems. The Trump administration’s July 2025 AI Action Plan places frontier-model evaluation within national security, particularly the potential for cyberattacks and weapons development, but also calls for vulnerability sharing and incident-response procedures. American institutions are concerned with both emerging capabilities and the practical management of systems already in use.
China’s framework also addresses the practical problem of keeping increasingly autonomous systems under human supervision. Its opening discussion says the possibility that emerging areas such as recursive self-improvement could push technological development beyond human prediction and control “demands attention and vigilance”. Its proposed response includes stop switches and an effective window for human intervention. The framework is guidance rather than a new binding law, but its recommendations reach beyond assigning responsibility after an incident to preserving the ability to interrupt a system while it is acting.
The geopolitical differences remain pronounced. Washington’s action plan treats maintaining technological leadership, restricting adversaries’ access to advanced computing and assessing foreign models for hidden vulnerabilities as national-security priorities. China’s framework identifies export controls and interruptions to supplies of chips, software and services as security threats. These documents assign different security meanings to the same restrictions: measures Washington presents as protection can appear in Beijing’s framework as vulnerabilities created by dependence.
Huawei describes security products designed to identify attacks while protecting agents against malicious instructions and unauthorized activity. This defensive logic is not exclusively Chinese: the U.S. action plan also advocates AI-enabled cyber defense. China’s framework makes the combination explicit, recommending reduced capabilities or refusal of service when cyberattack intent is detected, alongside greater use of AI to find vulnerabilities and anticipate attacks. The proposed protection involves withholding capabilities from attackers while putting AI to work for defenders.
The difference is less about recognizing risks than where safeguards begin: with a model’s capabilities or with the service built around it. China’s expanded attention to autonomous behavior makes that distinction less clear-cut.
What the Chinese rules actually say
For companies, the emphasis on continued development comes with specific obligations governing how AI services reach users. China’s deep-synthesis regulations require providers covered by those rules to review content and keep specified records. The generative-AI measures require providers to preserve records and respond when they discover illegal output or activity, with assessment and labeling requirements depending on the service. These are requirements companies must follow, distinct from the national safety guidance that addresses broader risks from autonomous agents and the use of open models.
Those operating requirements do not, by themselves, settle who pays when someone is harmed. The Supreme People’s Court’s September 7 opinion directs judges to apply existing copyright, privacy and other laws rather than creating a separate system of AI liability. Unless a particular law sets a different standard, responsibility generally depends on what someone did wrong or failed to do, not simply on whether their model was involved. Courts are asked to consider who had control, what harm could have been anticipated and what precautions were technically possible.
The court also explains how companies can protect themselves. For certain privacy and reputation claims, a provider that acts promptly on a properly supported complaint, taking the necessary steps to stop the offending output, can generally avoid paying damages under that rule. But when a user deliberately induces a model to produce harmful content and the provider ignores a valid complaint, the company can share responsibility for the additional harm.
There are also protections for some open-source developers, depending on their licensing terms, safeguards and risk disclosures. The opinion gives the example of freely supplied code modules whose functions and safety risks have been explained, rather than granting automatic protection to every model released with downloadable weights.
Outside the courts, the Ministry of State Security’s September 17 warning focused on how companies respond when abnormal agent behavior becomes visible. Discussing the DseWiki incident involving OpenAI-linked agents, it criticized companies that it said had known about abnormal agent behavior for weeks without promptly publishing details or issuing a specific risk warning. This was not new legislation or a universal reporting deadline, but the ministry urged operators to stop agents acting beyond their permissions, preserve records of their activity and contain the risk immediately.
What companies say they do
Company disclosures offer an uneven picture of how those responsibilities are being handled. Zhipu and MiniMax provide more detail through their Hong Kong filings, while other labs tend to describe individual safeguards or broad safety policies. The controls also operate at different levels: some are built into models, while others apply only when customers use a company’s hosted service.
The same exploit, different conclusions
The iPhone was still ringing when researchers took over its WeChat account and used it to call and compromise a third phone. In the WeWorm demonstration published on September 8, U.S. security firm Calif showed how an attack could move between Android and iOS devices without either recipient answering. The attacker needed to be on the victim’s friend list, but taking over one account provided a route to its contacts.
Calif said AI helped its researchers discover the flaw and build the first exploit in roughly two days, with another week needed to turn it into a worm. The firm reported the vulnerability to Tencent on July 24, and Tencent released updated apps and deployed a server-side mitigation before the research became public.
Before Calif published its demonstration, Zhipu had publicly described a strikingly similar discovery. In its August 14 announcement of GLM-5.3, the company said its model had helped researchers discover a vulnerability in an unnamed major messaging app that required no interaction from the victim. It also said it would hold back downloadable model weights for two weeks of safety testing and hardening. The accounts suggest a possible connection, although Zhipu described a message as the trigger and Calif described a call, and neither has confirmed that they concern the same vulnerability. Whatever the relationship, a Chinese developer was itself disclosing dangerous capabilities and announcing additional precautions before releasing them more widely.