Will the US-China AI channel survive the Sept 24 summit?

A Line Through Moscow, a Line Through Beijing

On August 30, 1963, a teletype circuit opened between Washington and Moscow. The premise was not optimism. It was the memory of thirteen days the previous October, when two men with no reliable channel between them had come closer to nuclear exchange than either government would admit for decades. The "hotline" was not a gesture of friendship. It was an acknowledgment that the machinery of catastrophe had outpaced the machinery of communication.

On September 20, 2026, Scott Bessent and He Lifeng sat inside JPMorgan Chase headquarters in Manhattan for approximately eight hours and proposed something structurally similar for a different kind of machine. The 1963 comparison is obvious, and it is also incomplete - the Moscow line ran between two governments that had already codified the thing they feared; this one is being proposed between two governments that have not yet agreed on what the dangerous thing is, or when it has happened.

What they built on, however, is concrete. A November 2024 agreement had already committed both sides to keeping humans in the decision loop on nuclear weapon deployment and the AI systems adjacent to it. Saturday's notification mechanism is the next layer on that foundation - an attempt to extend the principle from nuclear command to the wider field of frontier AI incidents that could be mistaken for deliberate acts of war.

The talks were a precursor, formally, to the Trump-Xi summit scheduled for September 24 in Washington. Everything agreed on the 20th arrives there for ratification, or does not arrive at all.

Eight Hours at JPMorgan

Scott Bessent proposed, after roughly eight hours of talks at JPMorgan Chase headquarters on September 20, a dedicated notification mechanism for AI-related national security incidents — a channel to manage rogue AI behaviour or system failures that might otherwise be misread as deliberate acts of aggression. That is a meaningful functional definition, and it deserves to be read carefully rather than absorbed as a headline.

The mechanism addresses a structural danger that conventional diplomacy was never designed to handle. An autonomous system that behaves outside its intended parameters does not pause for the foreign ministry's working hours. Bessent framed the ambition in plain terms - moving the US-China AI relationship from "opaque to more transparency between the number one and the number two AI powers in the world."

White House adviser Michael Kratsios had already named the specific threat that makes opacity untenable: "Mythos-level" models capable of autonomous cyber operations. Moonshot AI, a Chinese firm, stood accused of distilling Anthropic's "Fable" model to accelerate domestic capabilities. These are not abstract concerns on a think-tank whiteboard.

Xinhua's response was confirmatory in the narrowest sense. Chinese state media acknowledged that AI discussions had occurred and described the talks as candid and constructive. It did not detail the notification mechanism — a silence that is itself a data point, and one that leaves the mechanism's bilateral standing formally unconfirmed ahead of the September 24 summit.

Ask the small question first: who defines the threshold at which a system failure becomes a national-security-level incident, and who decides when the channel opens.

The Models That Made It Urgent

Two specific threats gave the September 20 talks their edge. US officials accused Moonshot AI, a Chinese firm, of distilling Anthropic's Fable model - using its outputs to train a cheaper, faster system and compressing years of American investment into a shortcut. Model distillation is not espionage in any clean legal sense. It is a structural problem: the outputs of a frontier model are, by design, produced to be useful, and useful things get copied.

White House science adviser Michael Kratsios named the sharper concern. The threshold that concentrates minds in Washington is what officials call Mythos-level capability - models able to conduct autonomous cyber operations without a human hand on the trigger. A system that can identify, penetrate and degrade a military network on its own schedule, without waiting for an operator, converts a software failure into a potential act of war before anyone has time to pick up a phone.

Which is precisely why there is now a proposal to build a phone. The distillation accusation and the autonomous-model concern work together: one shows that capability gaps close faster than export controls can widen them, the other shows what closing the gap eventually produces. Both make the case that waiting for an incident to define the rules is the wrong sequence.

Trump's instinct has run the other way. He has resisted slowing AI development on the grounds that hesitation hands Beijing a competitive edge. What changed is the recognition that an autonomous system misread as an attack does not pause for competitive-edge calculations - and neither do the generals watching the screens on the other side.

Cooperation on One Floor, Embargo on the Next

The building that hosted eight hours of negotiations on September 20 was JPMorgan Chase headquarters in Manhattan - a fitting venue for a conversation about what can be traded and what cannot. Bessent and He Lifeng left the table with two distinct agreements, and the distinction between them is the whole story.

On the safety channel: transparency, shared protocols, a hotline for the thing that could go wrong in the night. On chip exports: nothing moved. Jamieson Greer was unambiguous - AI chip export controls were excluded from the safety dialogue entirely. The hardware embargo is not a negotiating position. It is the architecture.

Alongside the notification mechanism, both governments agreed to operationalize a Board of Trade, tasked with identifying non-sensitive goods eligible for possible tariff reductions. The categories named were agricultural products, medical devices, and energy. Soybeans and insulin, in other words. Not Nvidia.

The bifurcated logic is coherent, if uncomfortable: the safety channel is managed transparency, while the hardware embargo is structural containment — a bet that if China cannot get the highest-end chips, the frontier models that make the AI incident notification system necessary will develop more slowly on one side of the line.

That these two policies can coexist in the same week, announced by the same delegation, is not hypocrisy. The Board of Trade is real, and the agricultural concessions may matter to farmers in Iowa and Shandong alike. But none of it changes the geometry. The fence around the hardware remains high. The yard it protects keeps shrinking.

What a Hotline Actually Requires

The Cold War telephone line between Washington and Moscow is remembered as a voice call. It was not. After the 1963 Cuban crisis made the delay in written cable traffic look suicidal, both sides chose teletype - a text channel, not a voice one. Experts advising the current US-China crisis communication channel draw on exactly that lesson: recommend a text-based, tiered architecture, because voice introduces tone, and tone introduces misreading, and misreading is precisely the failure mode a crisis channel is supposed to prevent.

That structural preference is not in dispute. What is in dispute is the foundation the channel sits on. China may require a consensus definition of "AI safety" before any mechanism goes live - and that demand is not decorative. If Beijing and Washington cannot agree on what counts as an AI incident at the national security threshold, the channel has no shared trigger. The definitional gap is the load-bearing wall. Everything else is moulding.

The groundwork beneath even this partial agreement is substantial. Melanie Sisson at Brookings and counterparts at Tsinghua University have worked these problems through Track II channels for years - informal, non-governmental dialogue that produced, quietly, the conceptual vocabulary the official talks are now borrowing. The Manhattan meeting compressed years of that prior work into eight hours at JPMorgan and still did not close the definitional question. That question now travels to Washington, arriving September 24.

A single announced notification mechanism rarely announces itself; it arrives preceded by a long archive of preparatory conversation that never made the wire.

Watch September 24

The Trump-Xi summit in Washington on September 24 is the one date that matters now. Everything agreed in Manhattan on September 20 is provisional until it meets a communiqué. Read the notification mechanism text carefully, if it surfaces. If the final language says the parties shall notify each other of national-security AI incidents, someone made a binding commitment. If it says should, the eight hours at JPMorgan Chase produced an aspiration, and this mechanism will spend the next two years in working groups.

Formal Chinese commitment would not mean operational transparency. Xinhua confirmed AI discussions occurred but declined to detail the notification mechanism. China may require a settled definition of "AI safety" before the channel functions, and no such definition exists in shared treaty language. Jamieson Greer confirmed that AI chip export controls remain entirely outside this dialogue, which means the US is simultaneously asking China to trust a safety channel while maintaining the embargo that communicates distrust of Chinese intentions.

Ask the small question first: who is the borderland here, and who is the empire? The answer is neither Washington nor Beijing. It is every smaller state whose territorial or cyber space becomes the arena when autonomous systems misfire and the two principals are still deciding whether to pick up the US-China AI safety hotline. What the Manhattan talks settled is that both governments accept the category of accidental AI escalation as real. What they deferred is everything that would make the mechanism work.