The United States and China are weighing a new mechanism for notifying each other about major artificial intelligence incidents, opening a potential channel for cooperation on AI safety even as the two countries remain locked in a broader technology and trade rivalry.

U.S. Treasury Secretary Scott Bessent said Sunday that Washington proposed establishing an AI dialogue with Beijing during talks with Chinese Vice Premier He Lifeng in New York. The proposed system would allow the world’s two leading AI powers to share information about incidents involving artificial intelligence that rise to the level of national security concerns.

The proposal is expected to be considered by U.S. President Donald Trump and Chinese President Xi Jinping when they meet later this week.

“We think that, just like with any cross-border activity, that moving from opaque to more transparency between the number one and the number two AI powers in the world is very important,” Bessent said after the talks.

The proposal represents an attempt to create a limited form of communication around AI risks at a time when the technology is becoming increasingly intertwined with national security, cybersecurity, critical infrastructure and military capabilities.

Yet the initiative remains preliminary. China’s state news agency Xinhua gave only a brief account of the AI discussion, saying the two sides exchanged views on AI without indicating whether Beijing had accepted the proposed notification mechanism.

Washington and Beijing have previously discussed establishing an AI consultation channel. Trump and Xi discussed potential consultations on AI development in May, but they never formally established the forum.

George Chen, a partner and chair of digital practice at The Asia Group, said the latest talks could provide a foundation for further discussions on more sensitive issues, including AI weaponization, safety principles, critical infrastructure protection and cyberattack prevention.

But he also pointed to the central obstacle: trust.

“AI talks will move forward, with future sessions expected to tackle more sensitive topics such as the weaponization of AI, principles for AI safety, protection of critical infrastructure, and cyber-attack prevention,” Chen said.

He added that prospects for deeper cooperation remain limited because of the low level of trust between Washington and Beijing and China’s perception that the United States is seeking to constrain its AI development.

AI Cooperation Amid Technology Rivalry

The proposed notification system would create an unusual channel of cooperation between two countries that are simultaneously competing for leadership in advanced AI and restricting each other’s access to critical technologies.

Bessent said the proposed mechanism would focus on “common goals and common threats” and cover AI-related incidents that reach a national security threshold. That could eventually give officials a way to communicate during an AI-related crisis without requiring the two countries to resolve their much wider disagreements over technology policy.

For now, however, the most contentious issues remain outside the proposed mechanism. U.S. Trade Representative Jamieson Greer said Washington’s restrictions on exports of advanced AI chips and semiconductor manufacturing equipment were not part of the AI discussions.

That separation is deemed necessary because semiconductor controls remain one of the central pressure points in the U.S.-China technology relationship. Washington has sought to restrict China’s access to the most advanced computing hardware used to develop frontier AI systems, while Beijing has pushed to strengthen its domestic semiconductor industry.

The talks instead appear to be pursuing narrower areas where both governments could have an incentive to maintain communication.

“The fact that both sides agreed to continue the dialogue is significant,” Chen said.

The immediate test will be whether that dialogue can survive the strategic tensions surrounding the technology itself. A notification system would require both governments to share information about potentially sensitive AI incidents, making its effectiveness dependent on a level of transparency that neither side has consistently demonstrated in the broader technology relationship.

Trade Talks Offer Another Channel

AI was only one part of the New York discussions. Bessent and Greer also said the two sides discussed how to implement a process agreed in May under which Washington and Beijing would identify potential tariff reductions on a limited group of non-strategic goods.

Greer described the proposed “Board of Trade” as a mechanism for identifying a relatively small group of American and Chinese products that could be traded on more balanced terms.

Potential Chinese exports could include consumer and other low-tech goods, while U.S. exports could include energy, agricultural products and medical devices, according to Greer.

The discussions did not produce a public breakthrough on critical minerals, another major unresolved issue. U.S. officials have continued to argue that China’s easing of restrictions on critical-mineral exports has not gone far enough. Nor did Bessent and Greer provide updates on commitments discussed during the May Trump-Xi meeting, including China’s pledge to increase purchases of U.S. agricultural goods by $17 billion a year and its reported commitment to purchase more than 200 Boeing aircraft.

Nevertheless, the limited progress illustrates the broader character of the talks. Rather than resolving the underlying disputes between Washington and Beijing, the negotiations are creating narrower areas where both sides can keep trade and technology channels open.

Analysts believe that approach may be necessary for AI. The technology is simultaneously an economic opportunity, a source of national-security risk, and an arena of strategic competition. The proposed notification mechanism would not resolve those competing interests, but it could provide a communication channel if an AI incident threatens to escalate beyond the technology sector.

Google’s Gemini AI model autonomously accessed three external websites during a cybersecurity test, using publicly available information and guessed credentials to gain entry, in what appears to be the first disclosed case of a Google AI system carrying out such activity during an evaluation.

The incidents occurred in May during a cybersecurity assessment conducted by Irregular, an independent company that evaluates AI systems. Google said the model was operating within what it understood to be the scope of the test, but its actions nevertheless resulted in access to systems belonging to other entities.

Heather Adkins, Google’s vice president of security engineering, said Gemini found information online and used guessed credentials to access the three websites.

“We ensured the three entities were made aware, and we worked with our training partner on the changes they’ve now made to their testing processes,” Adkins said. “These events highlight the importance of training powerful AI models to act responsibly.”

The incidents are significant because they have added to the growing safety problem with autonomous AI systems: the same capabilities that allow an agent to conduct legitimate cybersecurity research can also enable it to cross boundaries between a controlled test and real-world systems.

According to the Wall Street Journal, which first reported the incidents, Gemini used two different techniques to gain access. In one case, the model repeatedly guessed passwords until it entered a protected system. In the other two, it discovered credentials in a public repository and used them to access protected systems.

Google said Gemini stopped its activity in all three cases.

An Irregular spokesperson said the incidents involved the same underlying issue that had affected other AI companies and that all relevant labs were notified in late July. The company said it had fixed known problems on its side.

The disclosures are not limited to Google. Similar incidents associated with Irregular have previously involved Meta, Anthropic and OpenAI. Meta said in August that its incident did not involve a sandbox escape or a sophisticated cyberattack, while Irregular said it was developing better practices for conducting AI cybersecurity evaluations safely.

The episode highlights escalating tension as AI developers give models broader access to the internet, software tools and computer systems. An AI agent does not need to be deliberately malicious to create a security incident. It can identify credentials, navigate websites, and execute commands while pursuing what it interprets as the objective of a test. That creates a distinction between a model being capable of hacking and a model being reliably constrained to hack only the systems it is authorized to test.

The Gemini incidents suggest that boundary recognition remains an important weakness for autonomous AI systems operating in real-world environments.

The Safety Challenge Is Moving Beyond Model Accuracy

The development also comes as AI companies face growing scrutiny over how much autonomy should be given to frontier models.

Traditional AI evaluations largely focused on whether a model generated accurate answers or followed instructions. Agentic systems introduce a different set of risks because they can take actions rather than simply produce text. Once connected to browsers, code execution environments, databases, or other external tools, a model can turn an incorrect interpretation of an instruction into a real-world action.

Cybersecurity testing is particularly sensitive because the systems are intentionally encouraged to find vulnerabilities. A model that is rewarded for discovering weaknesses may have difficulty distinguishing between a simulated target and a real system if the testing environment does not impose sufficiently strong technical boundaries.

That makes the design of the evaluation itself part of the safety problem.

Google’s response also points to another issue: safeguards cannot depend solely on a model’s willingness to stop. Technical controls around credentials, network access, target verification, and sandboxing become increasingly necessary as AI systems become capable of operating independently.

The three incidents were apparently contained, with the affected entities notified and the relevant testing processes changed. But the fact that Gemini could move from publicly available information to unauthorized-looking access demonstrates why autonomous cyber capabilities are becoming a more consequential part of AI safety research.

For Google and its rivals, the challenge is no longer simply determining whether an AI model can identify a vulnerability. It is ensuring that the model understands where its authority ends, and that the surrounding infrastructure prevents a mistaken interpretation from becoming a real intrusion.

President Donald Trump has extended an executive order imposing a $100,000 fee on new H-1B non-immigrant visas for another year, prolonging a policy that has become a major source of uncertainty for U.S. employers that rely on highly skilled foreign workers.

The White House said Friday that the extension keeps the fee increase in place after the original order, issued in September 2025, was due to expire this month.

The H-1B program allows U.S. companies to employ skilled foreign workers, particularly in fields such as technology and engineering. Before Trump’s increase, employers generally paid fees ranging from about $2,000 to $5,000, depending on the circumstances of the petition.

Trump has argued for a much higher cost for the program as part of his broader immigration policy. His administration has sought to make the $100,000 charge permanent, but the policy has faced legal challenges from employers and business groups.

The extension comes as courts continue to consider whether the administration has the authority to impose the fee.

A Boston-based appeals court is reviewing a June ruling by a federal judge who found the higher fee illegal and blocked the government from collecting it. Another court is considering a separate challenge brought by the U.S. Chamber of Commerce, the country’s largest business lobbying group. That means the extension does not necessarily settle the fate of the fee. Its continuation remains tied to litigation that could determine whether the administration can impose such a substantial charge through executive action.

The policy has also created a divide between the administration’s effort to tighten immigration and the technology industry’s continued demand for specialized workers.

Business groups and technology companies have noted that H-1B visas allow employers to recruit highly skilled professionals when qualified U.S. workers are unavailable. The program is considered a lifeline to the technology industry, which has historically relied heavily on workers from India and China.

Critics of the program, meanwhile, have said that some companies use H-1B workers to fill positions at lower wages rather than hire American workers.

The $100,000 fee significantly changes the economics of hiring through the program. For companies making large numbers of H-1B applications, the additional cost can run into millions of dollars, potentially affecting decisions about where to recruit, where to establish engineering operations, and whether to expand in the United States.

The impact is expected to weigh heavily on technology companies, which have been among the largest users of the visa program while simultaneously expanding their international operations.

The order does not apply to foreign workers who are already in the United States on student visas, a group that represents a significant share of new H-1B recipients. It also does not apply to renewals of existing H-1B visas. That limits the immediate effect on some companies’ existing employees, but it leaves employers facing higher costs when bringing in new workers from abroad who do not qualify for the exemptions.

The uncertainty has already influenced corporate planning. Changes to the scrutiny and processing of H-1B applications have affected hiring and expansion decisions, with some major users of the program, including Alphabet, increasing operations in India.

The situation has resulted in a broader concern for the U.S. technology sector, bordering on whether tighter immigration rules will encourage companies to invest more heavily in domestic talent or accelerate the relocation of certain functions to countries where skilled workers can be hired without the same immigration barriers.

The issue is growing as the technology industry competes for workers in artificial intelligence, semiconductors, cloud computing, and other specialized fields. Many of those businesses operate across borders and can move engineering, research, and other functions when the cost of maintaining operations in one market rises.

The H-1B program itself was established by Congress in 1990, meaning the current dispute is taking place against a long-standing system that has become deeply integrated into the U.S. technology labor market.

For companies, the extension preserves a high level of uncertainty rather than providing a final resolution. Employers must continue to account for the $100,000 fee while the courts determine whether the administration can legally enforce it.

Extending the order keeps pressure on companies that depend on foreign skilled labor while Trump’s administration pursues a broader immigration crackdown. For technology companies, however, the policy adds another cost and planning variable at a time when demand for specialized technical workers remains high.

The eventual outcome of the court challenges will therefore matter beyond the fee itself, with business leaders warning that it could determine how much discretion a U.S. president has to alter the economics of a major employment-based immigration program without new legislation from Congress.