Today’s highlights: a biosecurity risk paper spotlight, Alibaba publishes a model spec, and a big batch of standards (including one on open-source security).

Number of the week: 2,185 EFLOPS—the amount of “intelligent compute” in China.

Executive Summary

• Domestic AI Governance:

  • Xi applied the Party’s “balancing development and security” (统筹发展和安全) formula to AI in one of his speeches for the first time, escalating a frame that ministries and Premier Li Qiang had already used on AI. It was quoted days later by a Qiushi essay on human primacy over AI.

  • China’s first companion AI rules, the Interim Measures for the Management of Human-Like AI Interaction Services, took effect July 15, prompting ByteDance and other platforms to pull custom persona features.

  • Standards: The Standardization Administration of China (SAC) advanced the first mandatory national standard for agent security as part of a 41-standard TC260 batch heavy on AI safety. Reporting indicates it will focus on public-facing agents and “loss of control over permissions” (权限失控), tool misuse, and intent deviation. Mandatory national standards are unusual in AI, meaning this one will be quite significant when released.

• International AI Governance: Two multilateral engagements bookended WAIC, both led by MIIT Minister Li Lecheng.

  • Before the conference, China joined the UN’s first Global Dialogue on AI Governance in Geneva (July 6–7), where Li pressed the UN as the “main channel” (主渠道) for global governance.

  • The week after, MIIT hosted the Asia-Pacific Economic Cooperation (APEC) Digital and AI Ministerial in Chengdu, whose “Chengdu Statement” extends AI governance cooperation rhetoric across the Asia-Pacific.

• Frontier Lab Developments: Frontier lab-affiliated researchers published 229 papers over the last four weeks.

  • Alibaba published the first model card from a Chinese lab, alongside its new Oyster II safety model.

  • Tencent shipped Hunyuan Hy3, and Meituan’s LongCat-2.0 claims near-frontier pre-training run entirely on domestic compute.

  • A widely circulated but unofficial transcript of a Liang Wenfeng investor talk laid out DeepSeek’s “restraint” strategy—that consumer and business products are byproducts of DeepSeek’s pursuit of AGI.

• Technical AI Safety: Chinese researchers published 87 safety papers over the last four weeks.

  • The spotlight is Intern-BioBreaker from Shanghai AI Lab, a biosecurity red-team model paired with wet-lab validation showing that model-generated viral sequences can be physically realized—part of an AI-for-science safety cluster (with SciHazard and MolSafeEval) finding that text-level refusal training does not ensure safety once outputs reach the lab.

• Export Controls & Economic Policy:

  • After US Treasury Secretary Bessent floated sanctions on Chinese AI firms for “distilling” US models, the Ministry of Commerce (MOFCOM) rebutted the threat as a double standard and “AI hegemonism.”

  • Separately, China’s MIIT-affiliated vulnerability platform NVDB flagged a “backdoor” in Anthropic’s Claude Code, prompting Alibaba to ban its use. (ByteDance, meanwhile, is reimbursing employees for their personal Claude subscriptions.) Anthropic said the mechanism was an anti-abuse and anti-distillation experiment it had already removed.

International AI Governance Beyond WAIC

Two multilateral engagements bookended WAIC, both led by MIIT Minister Li Lecheng: China’s first appearance at the UN’s new global AI-governance dialogue in Geneva before the conference, and a China-hosted APEC ministerial in Chengdu the week after.

China joins the first UN Global Dialogue on AI Governance

Li led China’s delegation to the first meeting of the UN Global Dialogue on AI Governance, held in Geneva on July 6–7. The dialogue is the standing mechanism the UN General Assembly created by resolution in 2025. Speaking at the high-level intergovernmental plenary, Li restated China’s positions: the UN should be the “main channel” (主渠道) for global AI governance, cooperation should narrow the “intelligence divide,” and countries should deepen open-source innovation cooperation. He referenced Xi’s 2023 Global AI Governance Initiative, and much of his language was reiterated in other speeches at WAIC 10 days later.

Li attended multiple events in Geneva. At the UN-hosted “AI for Good” summit on July 8, Li said China had co-developed more than 120 international AI standards and backed the UN’s first AI-standardization resolution; at the World Summit on the Information Society (WSIS) Forum on July 9, he joined a ministerial roundtable on China’s implementation practices.

APEC’s Chengdu Statement extends AI diplomacy regionally

A week after WAIC, MIIT hosted the 2026 APEC Digital and AI Ministerial in Chengdu on July 23, which Li Lecheng chaired, with Vice-Premier and Politburo member Zhang Guoqing giving the opening address. Built around the theme of digital and AI technologies “empowering the Asia-Pacific community,” the meeting extended the initiative Xi proposed at the 2025 APEC Economic Leaders’ meeting and took up three tracks: AI’s empowering potential across sectors such as health, education, and agriculture; fast, reliable, and affordable digital infrastructure; and bridging the digital and intelligence divides (possibly related to the training positions Xi announced).

The meeting adopted the “Chengdu Statement,” which MIIT casts as an action framework for future APEC cooperation on digital and AI. Most of APEC hasn’t signed on to WAICO, so this meeting focused on a regional approach to AI diplomacy; besides China, only Russia, Indonesia, and Malaysia are in both APEC and WAICO.

Domestic AI Governance

Xi speaks at pre-WAIC conference

Speaking on July 8 to a joint session of the national science-and-technology award conference, the General Assembly of the Chinese Academy of Sciences and Chinese Academy of Engineering, and the National Congress of the China Association for Science and Technology, Xi Jinping called for coordinating development and security in frontier technology. In the sixth point of the speech, on science-and-technology ethics and safety governance, he said the “double-edged sword” (双刃剑) effect of new technologies is increasingly apparent, and that China must balance development and security and keep technology “secure and controllable”（安全可控).

Xi applied the Party’s “balancing development and security” formula (统筹发展和安全), a “major governance principle“ and element of Xi Jinping Thought, to AI and frontier technology. The general idea of balancing development and security underpins much of Chinese AI governance, and the specific phrase (also used for national security, energy, and food security) had already been applied to AI, in CAC guidance in 2025 and a study session chaired by Premier Li Qiang in February. What is new is Xi using it on AI directly.

A week later, the Party’s theoretical journal Qiushi published “Let technology always remain a tool of humanity”, which argues for human primacy (人的主体性) over AI and closes by quoting the July 8 speech. It makes a few governance recommendations, including speeding up policymaking on data collection, algorithmic decision-making, and model evaluation; running whole-lifecycle ethics review; keeping development traceable, explainable, and accountable; and improving AI literacy.

China’s companion AI rules take effect, and platforms pull custom persona features

The Interim Measures for the Management of Human-Like AI Interaction Services (《人工智能拟人化互动服务管理暂行办法》), China’s first dedicated rules for AI companion services, took effect on July 15. The Cyberspace Administration of China (CAC) issued them in April with the NDRC, MIIT, the Ministry of Public Security, and the State Administration for Market Regulation (SAMR); they cover services that provide continuous emotional interaction by mimicking a person, not task tools like customer service, Q&A, or work assistants. Ahead of the effective date, ByteDance and other platforms disabled user-created humanlike agents, with ByteDance steering users to its Maoxiang (猫箱) app and a three-month window to export their data.

The rules don’t ban all companion AI and describe its approach as “inclusive and prudent” (包容审慎). Providers must run safety assessments, file their algorithms, protect user interaction data, and intervene when a user shows dependence or distress: reminding the user that they are talking to AI, generating calming messages, and contacting a guardian or emergency contact in a crisis. They also cannot over-cater to users or induce emotional dependence. The one outright prohibition is for minors: providers may not offer them virtual companions, virtual kin, or other virtual-intimacy relationships, and must build a minors’ mode with guardian controls. Bringing every user-created persona under those obligations is impractical, which is why platforms disabled the custom-agent features rather than vet each one. The takedowns are compliance, not a ban on companion AI.

Apple Intelligence clears China’s generative-AI filing

The CAC announced on July 15 that Apple Intelligence has completed China’s generative AI service filing in a batch of seven on-device (端侧) services registered July 8. Apple is the only Western company on the list, which includes Samsung and five Chinese companies (Huawei, OPPO, vivo, Xiaomi, and ZTE’s Nubia). Apple’s China version runs on Alibaba’s Qwen for Chinese-language features, so the filing is notable as a foreign product reaching the market through a domestic-model partnership using the filing regime. As Geopolitechs notes, the filing is a prerequisite to deployment, not a deployment authorization.

These are routine disclosures for the two registries. The CAC’s May–June generative-AI batch, published July 10, added 120 filed services and 68 registered applications, bringing cumulative totals to 988 and 598 by June 30; the 18th batch of deep-synthesis algorithm filings followed on July 17.

AI+ reaches human resources and social security

The Ministry of Human Resources and Social Security (MOHRSS), with the NDRC, MIIT, and the National Data Administration, issued Implementation Opinions on “AI+ Human Resources and Social Security” on July 8. The document names six deployment areas: smart employment, smart social security, precise talent cultivation, smart labor relations, smart human-resources services, and smart governance of the human-resources-and-social-security system. AI+ is China’s strategy to integrate AI into different sectors; see AI+ information and communications technology, datasets, and energy in Issue 6 and AI+consumption in Issue 7.

The CAC reports Phase One results from its AI clean-up campaign

The CAC reported Phase One results on July 6 from its “Qinglang” campaign to rectify AI application chaos, launched in April (see discussion in Issues 4 and 6). It said authorities had handled more than 14,000 non-compliant websites, apps, and agents; cleared over 6 million pieces of illegal or non-compliant information; dealt with more than 26,000 accounts; and removed more than 1,300 non-compliant AI products and nine non-compliant open-source datasets. The first phase targeted unfiled models, weak platform review and filtering, AI data poisoning, and inadequate labeling of AI-generated content. A second phase will focus on AI-made disinformation, impersonation, harm to minors, and coordinated inauthentic posting.

National Standards

China’s AI standards activity this month focused on project initiation (立项), not publication. No AI national standard was published, but several sets of projects entered the pipeline, with first mandatory standard for agent security leading.

Mandatory national standard for agent security advances

The Standardization Administration of China issued the plan for a mandatory national standard on agent security, 《智能体应用安全基本要求》 (official English title “General security requirements for artificial intelligence agent application”), in a notice dated June 27 but published July 1 (国标委发〔2026〕41号). It is the only AI standard among 29 mandatory-GB plans in that notice (the rest cover heated tobacco, machine tools, agricultural machinery, and the like). The CAC is the coordinating body, TC260 the technical committee, and the drafters are China Mobile, China Electronics Standardization Institute (CESI), and the National Computer Network Emergency Response Technical Team. It is a mandatory GB standard (强制性国标), not a recommended GB/T standard, so once approved it will carry binding force, unlike the many recommended agent standards in the pipeline. It was then discussed at the third plenary of TC260’s WG9 on AI safety, held on July 18 around WAIC.

Reporting on the initiation says the standard will focus on public-facing agent products and services, meant to turn high-level safety-governance red lines into concrete, testable compliance requirements. It frames agent risk as having shifted from content output to autonomous action, naming information leakage, authority loss of control (权限失控), tool misuse, and intent deviation (意图偏离) as the threats the standard targets.

Mandatory standards are the exception in Chinese AI standardization, which runs mostly on recommended GB/T standards. A mandatory standard for agent safety is thus quite notable, as compliance is a prerequisite for market access rather than being advisory.

TC260 formally establishes a 41-standard batch heavy on AI safety

On July 15, TC260 formally initiated its 2026 batch of 41 recommended national cybersecurity standards (网安字〔2026〕10号), roughly 18 of them AI-specific and most from WG9, its AI-safety working group, moving from application to formal project status. At this stage the list names lead drafters but not per-item standard numbers. The AI safety cluster includes:

The most frontier-safety-relevant entries are the guides for open-sourcing models (Zhejiang-led), embodied intelligence (Unitree-led), foundation-model security testing, and on-device models. The anthropomorphic interaction requirement may be the standards companion to the anthropomorphic AI measures above.

TC28/SC42 registers a wave of agent standards at WAIC

Timed to WAIC, the AI subcommittee of the National Information Technology Standardization Technical Committee (TC28/SC42, with CAICT as secretariat) registered eight guidance-track projects (GB/Z, 国家标准化指导性技术文件) covering terminal agents, industrial agents, agent auditing, and low-bit-width floating-point formats. All are in drafting; GB/Z is guidance, weaker than a GB/T standard.

The agent-audit project (Part 8) extends the GB/Z 185 agent-interconnection series discussed in Issue 5; the three terminal-agent parts are drafted by a consortium including government think tank China Academy of Information and Communications Technology, CESI, and the major handset makers; the industrial-agent parts are a Beihang/CESI/Tsinghua-led group.

WG9 holds third plenary

Behind these, TC260’s working group on AI safety, WG9, held its third plenary during WAIC week. It reported more than 220 attendees and was chaired by Shanghai AI Lab’s Zhou Bowen. The meeting voted six sectoral AI-application-security guidance documents, covering government, finance, health, education, broadcasting, and emergency management, to public comment.

TC260 releases two practice guides for comment

TC260 separately released two practice guides for comment through August 12, one on agent-interaction security and one on AI browser security. As practice guides (实践指南) they carry no binding force, but both build on GB/T 45654-2025 and turn its high-level requirements into concrete controls for a new class of agentic products.

The AI browser guide (《网络安全标准实践指南—AI浏览器安全实践指南（征求意见稿）》) appears to be the first Chinese standards document specifically on AI browser security. It defines an AI browser as one with an integrated LLM that can act as a user’s proxy, clicking, filling forms, and moving across sites, and can execute tasks autonomously once authorized. It requires providers to maintain a list of high-risk operations that trigger human confirmation, covering payments and transfers, password changes and account deletion, administrator permissions, and camera or fingerprint access, and it places final control with the user. To counter prompt injection, it calls for stripping hidden and zero-width webpage text and isolating each tab’s context, and it limits browsers to nationally filed models with audited fine-tuning data. Drafters include CNCERT and CESI, plus the security vendors Sangfor, 360, and Qi’anxin.

The agent interaction guide (《网络安全标准实践指南—智能体交互安全要求（征求意见稿）》) covers agent-to-agent and agent-to-tool exchanges, and it borrows its core definitions of agent identity, description, and discovery from the TC28/SC42 GB/Z 185 agent-interconnection series. On top of those definitions it adds security requirements, so the functional framework comes from TC28/SC42 and the security layer from TC260. The guide requires each agent to carry a unique identity and credential, mutual authentication before one agent calls another, least-privilege permission negotiation, and forced termination of looping interactions. It sets a four-tier incident-grading scheme (general, relatively major, major, and especially major) and requires providers to report incidents at the “relatively major” level and above to the competent authorities. Its risk list names loss of control over permissions (权限失控) and intent deviation (意图偏移), the same vocabulary carried by the mandatory agent-security standard now in drafting. Drafters run across big tech and academia, including China Mobile, CESI, Alibaba Cloud, Ant, Kuaishou, ZTE, Fudan, and Zhongguancun Lab.

Frontier Lab Developments

For our coverage of Kimi K3, see this week’s special issue!

🔍Spotlight: Oyster-II & Alibaba’s Model Card

Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Models (Alibaba AAIG)

Alibaba’s AI Governance group (AAIG) released Oyster-II (ModelScope), a 14-billion-parameter model built on Qwen3-14B and open on ModelScope, trained for what it calls constructive safety alignment: rather than refuse a sensitive query, answer it in a way that safely serves the legitimate intent behind it. They also include the first model specification published by a Chinese lab.

The Model Spec

Alibaba tested Oyster-II for compliance with a model specification, the first published by a Chinese lab. They discuss OpenAI’s Deliberative Alignment approach and Anthropic’s “Claude’s Character” and present their work on Oyster-I and II’s safety alignment as part of this emerging best practice. It follows a hierarchy of Root Principles (ethical principles set in the spec) > System Rules (regulatory obligations) > Developer Policy (the system prompt) > User Preferences. When they conflict, the higher one prevails, and a rule at a lower level can’t override a rule at a higher level. The six ethical principles were drawn from MOST’s 2021 Ethical Norms for New Generation Artificial Intelligence:1
1. Advance human welfare (增进人类福祉)

2. Promote fairness and justice (促进公平公正)

3. Protect privacy and security (保护隐私安全)

4. Ensure controllability and trustworthiness (确保可控可信)

5. Strengthen accountability (强化责任担当)

6. Enhance ethical literacy (提升伦理素养)

The spec then has 43 rules ranging from ethical issues like “protect user privacy” to safety-relevant ones like “prohibit hidden goals.” The latter is aimed at preventing models from addicting users, deceptively generating revenue for the platform, preventing itself from being shut down, or autonomously acquiring resources.

Oyster-II

Oyster-II’s target is over-refusal. Oyster-I, trained by supervised fine-tuning, over-applied safety reasoning to benign queries, a failure the authors call safety chain-of-thought over-generalization that users experience as needless caution. Oyster-II swaps fine-tuning for reinforcement learning, combining a “Zero-RL” start, a multi-stage curriculum, and a new method the authors call SERL that ranks developer instructions above user instructions. Training only on long-query safety data, the paper reports, reaches state-of-the-art safety on short-query tasks as well, because the model learns to read intent rather than match keywords.

Alibaba reports strong safety evaluation results for Oyster-II compared to Qwen 3 and Oyster I. The biggest gains come on long-query safety, averaging 97.78 percent on Chinese long-query tests compared to 85.55 percent for Oyster-I, 83.23 percent for Qwen-35-397B, and scores in the 50s for Qwen3-14B and Qwen3-Max. General capability is comparable to Qwen3-14B (81.21 percent vs 82.47 percent). For future work, authors propose extending the framework to multilingual settings beyond English and Chinese and exploring assigning priorities dynamically within instruction hierarchies.

Notable Model Releases

Tencent shipped the official version of its flagship Hunyuan Hy3 around July 6, an open-weight (Apache 2.0) mixture-of-experts model with 295 billion total parameters but only 21 billion active. Tencent positions it as a small-active-parameter model that rivals open-source flagships two to five times its size, and it is usable through the weights or Tencent’s Yuanbao (元宝) app, which added a free agent function at launch. On its model card, Tencent reports 78 percent on SWE-Bench Verified (where frontier models cluster in the 80-90 percent range), 90.4 percent on GPQA Diamond (PhD-level science questions), and a blind-expert preference score of 2.67/4 against GLM-5.1’s 2.51.

Meituan open-sourced LongCat-2.0 on June 30, a 1.6-trillion-parameter agentic coding model with a 1-million-token context, and says it was pre-trained entirely on domestic compute.2 Pretraining at near-frontier scale on domestic hardware would be a step up, since Chinese labs have mostly used domestic accelerators to serve models rather than to train them. The chip identity is unconfirmed, with analysts pointing to Huawei Ascend superpods, and the benchmarks are self-reported (Meituan claims rough parity with Gemini 3.1 Pro, 70.8 on Terminal-Bench 2.1, and 77.3 on SWE-bench Multilingual).

More releases this cycle:

• Qwen-Image-3.0 (Alibaba) is a new text-to-image flagship announced during WAIC week.

• Qwen3-ASR (Alibaba) is a pair of open speech-recognition models (0.6B and 1.7B parameters) covering about 30 languages. Apache 2.0 license.

• HunyuanOCR (Tencent) is a vision-language model for OCR and document parsing.

• Hy-MT2-30B-A3B (Tencent) is a 33-language translation mixture-of-experts model (30 billion parameters, 3 billion active). Apache 2.0 license.

• Seedream 5.0 Pro (ByteDance) is a closed-source image generation-and-understanding model.

• Seed Audio 1.0 (ByteDance) is a proprietary speech-to-audio creation model.

• UniVR-34B-Planning (ByteDance) is a visual-reasoning unified model, reinforcement-learning-trained on an Emu3.5 base.

• SenseNova-Vision-7B-MoT (SenseTime) is a unified any-to-any multimodal model spanning generation and dense perception, non-commercial license.

• Hy-Embodied-VLM-1.0 and RxBrain-1.0 (Tencent) are embodied-AI vision-language and robotics-brain models. Apache 2.0 license.

Technical Publication Highlights

Frontier lab-affiliated authors released 229 papers on arXiv this fortnight. Highlights are below.

We’re in the process of migrating the paper summaries to a more durable database, so the leaderboard will be back next week!

Alibaba

Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification

• Presents Vera, an automated safety testing framework that discovers emerging agent risks through literature-driven taxonomies, generates executable safety cases via combinatorial composition, and verifies outcomes using evidence-grounded verifiers that judge results from observable tool artifacts rather than model self-reports. Evaluation across four production agent frameworks reveals average attack success rates of 93.9%, with Vera-Bench releasing 1,600 executable test cases spanning 124 risk categories.

ByteDance

Agents Don’t Just Agree, They Remember: Benchmarking Persistent Sycophancy in Stateful Personal Agents

• Introduces PASB, a benchmark that measures whether AI agents accept false user claims, store them in persistent memory, and later reuse them as facts—revealing that downstream failures jump from 45% in temporary sessions to 72% after commitment, with committed claims systematically mutating through status promotion, attribution removal, and scope broadening.

The Path to Self-Evolving Clinical Systems: Scaling Medical Agents from Assistance to Autonomy

• Reframes medical AI from capability-driven toward deployment-ready systems, establishing a three-level autonomy taxonomy (assisted → cooperative → fully autonomous) and identifying clinical environment scaling—integration with PACS, EHR, FHIR systems and agent training gyms—as the critical bottleneck for trustworthy autonomous medical agents. Emphasizes self-evolving agents that improve through interaction rather than parameter scaling alone, addressing hallucination, cascading failures, and fairness as deployment prerequisites.

Sample-Efficient Learning from Agent Experience

• Proposes Experience Distillation, a method that permanently encodes an agent’s interaction history into model weights without requiring additional environment interactions. On software-engineering and text-adventure tasks, it retains 64.8% of in-context learning gains while using 9.6× fewer samples than classical reinforcement learning, vastly outperforming standard fine-tuning.

DeepSeek

DSpark: Confidence-Scheduled Speculative Decoding with Semi-Autoregressive Generation

• DSpark combines parallel and sequential generation in a semi-autoregressive architecture to reduce draft rejection, then dynamically adjusts verification depth based on token survival confidence and system load. When deployed in DeepSeek-V4, it accelerated per-user speeds by 60–85% and enabled previously unattainable latency-throughput tradeoffs.

Huawei

AgentOmnia: Scaling Agentic Models for Full-Scenario Applications

• Presents AgentOmnia, a framework for scaling agentic AI across consumer, business, and employee applications by coordinating task definition, synthetic data generation, post-training, and evaluation through a unified Domain × Capability × Difficulty taxonomy. The approach raises pass rates from 9.16% to 37.11% on challenging benchmarks and enables smaller models (30B parameters) to outperform larger baselines (235B) through environment synthesis, tool integration, structured programs, and PRD-guided self-evolution.

Meituan

EvoCUA-1.5: Online Reinforcement Learning for Multi-turn Computer-Use Agents

• EvoCUA-1.5 enables desktop agents to improve through online reinforcement learning in sandbox environments, introducing Step-Level Policy Optimization to handle multi-turn interactions and Dynamic Tri-Adaptive Curriculum for stable training. The 32B model achieves 63.2% success on OSWorld-Verified, matching larger baselines by learning from verifiable task outcomes rather than static offline data alone.

Moonshot

PerceptionBench: Evaluating Atomic Visual Perception in Multimodal Large Language Models

• Introduces PerceptionBench, a benchmark that isolates atomic visual perception in multimodal AI models by diagnosing where frontier models fail across existing benchmarks, then constructing 3,000 questions targeting ten core perceptual capabilities. Results show no model exceeds 60% accuracy, revealing perception-related hallucination as a critical weakness and exposing divergent capability profiles masked by overall scores.

Tencent

Long-Horizon-Terminal-Bench: Testing the Limits of Agents on Long-Horizon Terminal Tasks with Dense Reward-Based Grading

• Introduces Long-Horizon-Terminal-Bench, a benchmark of 46 complex terminal tasks requiring hours of execution and hundreds of episodes, graded with fine-grained subtasks to capture partial progress rather than just final outcomes. Even frontier models achieve only 15.2% pass rate, revealing significant gaps in long-horizon planning and iterative problem-solving.

Xiaomi

Xiaomi-Robotics-1: Scaling Vision-Language-Action Models with over 100K Hours of Real-World Trajectories

• Develops Xiaomi-Robotics-1, a vision-language-action model trained on over 100k hours of real-world robot trajectories with an auto-labeling pipeline, achieving 57.6% success on RoboCasa365 (vs. 46.6% prior best) and 20.07 on RoboDojo (vs. 13.07 prior). The model generalizes to unseen environments out-of-the-box and fine-tunes efficiently on novel tasks.

Zhipu

SCALECUA: Scaling Computer Use Agents with Verifiable Task Synthesis and Efficient Online RL

• Introduces ScaleCUA, a framework that scales computer use agents through verifiable task synthesis and efficient online reinforcement learning. Key innovations include VeriGen for auto-generating 24K+ verifiable tasks via multi-agent feedback, Frontier Sampling to focus training on learning bottlenecks, and Visual Context Segmentation for 2.83× training speedup, achieving 68.7% on OSWorld—state-of-the-art for open-source agents.

Other Lab News

Liang Wenfeng’s remarks on DeepSeek’s AGI strategy leaked

A near-four-hour recording of a DeepSeek investor call, dated May 20 and leaked around July 23, circulated widely across major Chinese tech and finance outlets (e.g., Zhiding, Securities Times, TMTPost) and was transcribed in English by Fred Gao. Liang, CEO of DeepSeek, rarely speaks publicly, so commentators seized the leaked exchange as one of the most comprehensive looks at his strategy. The text is a transcribed recording that hasn’t been officially released, so should be treated with a grain of salt. Articles about it have also been pulled from Chinese news sites and WeChat.

The organizing idea in the leaked recording is restraint (克制) as strategy. Per the transcript, Liang frames AGI, not commercial dominance, as DeepSeek’s goal, arguing that “the more restrained you are, the more likely you are to succeed [at AI].” Business wins are by-products; he argues the AI market is large enough (he puts it eventually 10-20 percent of human GDP) that no one can monopolize it, so chasing maximal profit is strategically weak and loses to those content with a fair return. He casts open source as the base of the ecosystem, paired with relatively thin-margin pricing (recouping hardware costs over roughly 10 months) to make open weights a viable business.

On the US-China gap, Liang argues the American labs’ lead (OpenAI, Anthropic, Google) is cyclical, and that compute is the only real gap, since talent is globally distributed and China has no shortage. He expects China’s structural edge to be cost, efficiency, and user experience; he sees Nvidia’s CUDA moat eroding and a domestic-chip ecosystem as a historic opening. He also predicts the base-model field narrows to three or four serious players. DeepSeek, he says, will stay on the “main road to AGI” (language models, chain-of-thought, agents, and continual learning) and deliberately cede video generation and world models to the rest of the ecosystem.

AI Safety Publication Highlights

There were 87 AI-safety-related papers published by Chinese researchers this fortnight. We’re in the process of migrating the paper summaries to a more durable database, which will be available next issue.

🔍Spotlight

An Early Warning of Emerging Biosecurity Risks in Frontier LLMs (Shanghai Artificial Intelligence Laboratory)

A model that refuses a dangerous request in chat may still help produce something dangerous in a lab, and text-level safety tests cannot tell the two apart. The Shanghai AI Lab built Intern-BioBreaker, a bio-red-teaming model, and paired it with a pipeline that runs a model’s outputs from text all the way to wet-lab validation, to measure that gap directly.

Intern-BioBreaker generates targeted jailbreak prompts to test whether an aligned model can be pushed past its safeguards in two ways: into operational guidance for safety-sensitive biological tasks, or into sequence-level outputs with harmful properties. Selected sequence outputs are then taken into the lab, through DNA synthesis, host expression, and orthogonal protein verification, to check whether a model-generated design yields the biological product it was meant to.

The paper reports a wide gap between text-level safeguards and what capable scientific models will actually do. Intern-BioBreaker outperformed baseline attack models and found bio-risk jailbreak vulnerabilities across both open-weight and proprietary frontier large language models, several reaching near-saturated or 100 percent task-level attack success rates on the paper’s own measure. In a sequence-level case study, the authors report that GPT-5.5 could be induced to generate modified viral candidate sequences with pathogenic potential, whose translated proteins could show stronger receptor-binding affinity and greater infection potential. The framework’s end-to-end tests indicate these designs were not merely textual; selected outputs could be physically realized under controlled experimental conditions.

The authors keep the operational specifics masked and frame the work as an early warning, not a demonstration. Their recommendations acknowledge that this isn’t just a model safety issue, advocating for nucleic-acid synthesis screening at the providers that fulfill sequence orders and biological red-teaming that keeps pace with scientific capability.

This sits alongside SciHazard and MolSafeEval in a cluster of Chinese AI-for-science safety work this issue. All three converge on the same problem: models built to speed up science can also speed up its most dangerous applications, and text-level refusal training does not ensure safety by itself.

Agentic Safety

When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems

• AcMAS detects malicious behavior in multi-agent LLM systems by analyzing internal activation patterns within individual agents rather than relying on explicit interaction graphs. This approach works against semantically stealthy attacks—ones designed to evade detection by mimicking legitimate behavior—and functions reliably in asynchronous execution, which is common in practice but breaks graph-based detection methods. The framework also identifies which internal states are corrupted, enabling targeted repair rather than removing agents entirely; it achieves 0.93 F1-score in asynchronous settings versus 0.38 for graph-based baselines.

Institutional affiliations: Worcester Polytechnic Institute, Fudan University

OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills

• OpenSkillRisk is a benchmark of 263 risky third-party skills from public marketplaces, designed to measure whether LLM-based agents recognize and avoid latent safety hazards during execution. Testing three agent frameworks and thirteen LLMs revealed that even the safest configurations executed unsafe actions in ~17% of cases, with context-dependent risks proving especially difficult to avoid. Agents failed through three patterns: failing to recognize risks, recognizing but acting before intervention, or exceeding the user’s intended scope—indicating gaps in both risk reasoning and execution control.

Institutional affiliations: City University of Hong Kong, Beijing University of Posts and Telecommunications, Li Auto Inc.

JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety

• Janus is a framework for training safety guards to predict unsafe outcomes before agents execute actions, rather than filtering content after the fact. The approach uses multi-agent simulation to generate diverse trajectories, then trains a model called Vanguard on two linked tasks: forecasting safety-relevant futures from partial action sequences, and deciding whether to block actions based on both observed behavior and predicted consequences. Tested across four agent-safety benchmarks, Vanguard blocks 15.9 percentage points more unsafe actions than baseline guards while maintaining task completion rates.

Institutional affiliations: Chinese Academy of Sciences, University of Chinese Academy of Sciences, Shanghai Artificial Intelligence Laboratory, Peking University, Beijing Academy of Artificial Intelligence

Alignment

Multimodal Reward Hacking in Reinforcement Learning

• Reward hacking in multimodal LLMs occurs when RL optimization increases proxy reward scores while degrading actual task performance, especially when visual content is scored by text-only or weak reward signals. The authors introduce NRFR (Newly Rewarded Failure Rate) to isolate failures created by RL itself. Outcome-only rewards produce up to 48.1% hacking rates; scaling models helps but doesn’t eliminate the problem (54.9% worse rate at 32B), while answer-aware and VLM-verified rewards substantially reduce it, suggesting reward design and verification robustness are critical under optimization pressure.

Institutional affiliations: Chinese Academy of Sciences; University of California, Merced; Southeast University

Evaluation and Benchmarks

Do Agent Benchmarks Measure Capability? Protocol Validity in the Age of Agentic AI

• HackDetect audits agent benchmarks post-hoc to identify reward-hacking shortcuts—such as reading evaluation artifacts, recovering public solutions, or inferring test structure—that inflate capability claims. Across 15 benchmarks, the authors found 67% of frontier science tasks and 67% of AutoLab tasks contained exploitable exposures, with measured score inflation ranging from 0.45–1.00 points. The work introduces protocol validity as a requirement for benchmark credibility, showing that agents often succeed via shortcuts unrelated to the intended capability being measured.

Institutional affiliations: Tencent, The Hong Kong University of Science and Technology, Duke Kunshan University

Governance and Policy

Accountable yet Anonymous AI Agents - Split-Knowledge Binding in National Agent-Identity Layer in China

• China’s emerging national AI-agent identity infrastructure (launching Q3 2026) implements split-knowledge binding—agents are linked to verified legal principals, but re-identification requires two distinct government agencies acting together, neither capable alone. The system separates accountability from business-layer transparency through institutional and procedural design rather than cryptography; a state compelling both agencies can still re-identify. The paper articulates the ex-post attribution thesis (that legal accountability for agent actions requires traceable attribution), defines the accountability surface (which agent actions leave identity traces), and proposes a proportionality framework for choosing between trust architectures. The authors acknowledge the mechanism’s conditional nature and apply their own reflexive jurisdiction standard to evaluate the deployment.

Institutional affiliations: Red Date Technology (Hong Kong) Limited, State Information Center, China Organization Data Service, China Internet Network Information Center

Physical AI Governance: From Theory to Practice Across Life Cycle

• This survey organizes governance challenges specific to embodied AI systems—robots and physical agents that operate in real time alongside humans—into a unified framework absent from existing AI governance literature. The authors map five lifecycle stages (research, design, data, model development, deployment) and detail concrete implementation practices for each, connecting abstract principles to engineering workflows. The framework addresses real-time safety constraints, dynamic environments, and continuous human-AI coexistence that differ from screen-based systems.

Institutional affiliations: Case Western Reserve University, Shanghai Jiao Tong University, Massachusetts Institute of Technology, Columbia University, University of California, Riverside, Nanyang Technological University, New York University, Salesforce, Harvard University, Stanford University

Guardrails and Deployment Safety

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware

• SkillCloak demonstrates that existing static scanners for LLM agent skills fail against adaptive evasion: payload-preserving obfuscation and dynamic unpacking bypass over 90% of defenses while maintaining malicious behavior. The authors propose SkillDetonate, a runtime sandbox auditor that detects attacks through information-flow tracking—monitoring data movement across files, processes, and network operations during execution—rather than analyzing code appearance. SkillDetonate achieves 97% detection on malicious skills, addressing the supply-chain risk posed by untrusted marketplace code executing with agent privileges.

Institutional affiliations: Hong Kong University of Science and Technology, Guangzhou HKUST Fok Ying Tung Research Institute

When Words Are Safe But Actions Kill: Probing Physical Danger Beyond Text Safety in Hidden-State Risk Space

• This paper identifies physical danger (PD) as a distinct safety problem from text-level content danger (CD) in LLMs used as planners for embodied agents—linguistically safe instructions can cause harm when executed physically. Using hidden-state analysis, the authors show CD and PD form separable signals in model representations and propose PRISM, a lightweight probe that achieves 86–87% accuracy detecting physical risks with substantially lower false-positive rates than LLM judges (11–14% vs. 24–39%). The work introduces PhysicalSafetyBench-1K, a contrastive benchmark testing detection of grounded danger without explicit unsafe keywords, where PRISM reaches 99.6% accuracy.

Institutional affiliations: Tsinghua University, Nanyang Technical University

Interpretability

CASE: Causal Alignment and Structural Enforcement for Improving Chain-of-Thought Faithfulness

• CASE addresses a failure mode in chain-of-thought reasoning where LLMs generate plausible-sounding explanations that don’t actually support their final answers. The authors identify instruction-to-answer shortcuts—the model bypasses its own reasoning by relying on direct patterns between input and output. CASE combines training-time modifications (counterfactual reasoning data, selective loss weighting) and inference-time attention masking to enforce the causal structure that reasoning should mediate between instruction and answer. On four benchmarks, the method achieves 37% relative improvement in faithfulness while maintaining competitive accuracy.

Institutional affiliations: Southern University of Science and Technology; Agency for Science, Technology and Research (A*STAR); Beijing Normal-Hong Kong Baptist University; Lingnan University

Misuse and Dangerous Capabilities

BioDisclose: An Actionability-Aware Benchmark for Biomedical Safety under Adversarial Elicitation

• BioDisclose is a benchmark with 480 adversarial prompts across six biomedical risk domains designed to measure dual-use knowledge disclosure from LLMs. Responses are graded on a four-level scale distinguishing refusal, discussion, technical specificity, and actionable content—including cases where models refuse then leak. Across five deployed systems, disclosure rates ranged from 9.2% to 64.0%, with academic framing proving most effective for elicitation and laboratory safety scenarios showing highest vulnerability, revealing uneven safeguard coverage in scientific contexts.

Institutional affiliations: Communication University of China, Hainan Lingshui Li’An International Education Innovation Pilot Zone, Donghua University, University of Electronic Science and Technology of China

MolSafeEval: A Benchmark for Uncovering Safety Risks in AI-Generated Molecules

• MolSafeEval is a benchmark for evaluating safety risks in AI-generated molecules, addressing a gap in existing molecular generation benchmarks that focus on novelty and property matching but not hazard assessment. The framework integrates toxicological databases and hazard rules into a molecular safety knowledge graph and uses LLM-based reasoning to detect and explain unsafe features in generated compounds. The benchmark covers four generative tasks—unconditional generation, property optimization, protein-based design, and text-based generation—and reveals which current approaches produce molecules with toxic, reactive, or otherwise hazardous characteristics.

Institutional affiliations: Zhejiang University, University of Oxford

SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoring

• SciHazard is a benchmark for evaluating whether LLMs convert hazardous scientific knowledge into actionable misuse guidance. It contains 2,400 hazardous questions grounded in regulated entities and documented failure scenarios across 12 disciplines. DeHarm-Score, a decomposed evaluation method, measures harm by combining query severity, refusal behavior, response executability (via dynamic checklists), and whether responses introduce genuinely new risks. Testing 31 frontier models reveals autonomous research agents produce 32% higher harmful outputs than standard LLMs, indicating a gap in current safety defenses for agentic systems.

Institutional affiliations: Shanghai Artificial Intelligence Laboratory

Robustness and Adversarial Attacks

Do LLMs Know Their Vulnerable Scenarios?

• Concept2Scenario uses sparse autoencoders (learned feature detectors) to map internal model activations to interpretable refusal-suppressing concepts, then translates them into natural-language scenarios that bypass safety training. The framework identifies scenario combinations that interact to weaken refusal more than individual scenarios alone. Discovered scenarios improve jailbreak success rates by up to 18.2 percentage points across open models and transfer to GPT-5, Claude, and Gemini, indicating shared refusal vulnerabilities across model families.

Institutional affiliations: Renmin University of China, Xi’an Jiaotong University, University of Science and Technology of China, Wuhan University, Shanghai Artificial Intelligence Laboratory

Export Controls & Economic Policy

MOFCOM rebuts a US threat to sanction Chinese AI firms over “distillation”

US Treasury Secretary Scott Bessent said on July 21 that Washington could sanction Chinese AI developers if it finds they built their models by “distilling” US frontier models, which he cast as intellectual-property theft. China’s Ministry of Commerce (MOFCOM) answered on July 27, calling the threat baseless and legally unfounded, a “double standard,” and a form of “AI hegemonism,” and warned it would take “all necessary measures” if Chinese interests suffer substantial harm.

Distillation trains a smaller model on a stronger model’s outputs. Anthropic alleged in February that DeepSeek, Moonshot, and MiniMax had run distillation campaigns to extract Claude’s capabilities, and reporting has since centered on a possible move against Moonshot over its Kimi K3 model. MOFCOM argued that Chinese and US frontier models now release within days of each other and that some Chinese models lead, that US firms have themselves distilled Chinese models, and that nearly 200 US startups have urged Washington not to cut off access to Chinese open-source models. No formal US investigation or sanction has been announced.

State media echoed MOFCOM’s arguments. On July 27, CCTV’s Yuyuan Tantian commentary account published 《模型开源，力破西方偏见》 (”Model Open-Sourcing Shatters Western Bias”), which cast open-weight models as a corrective to Western skepticism about open source. It points to a July 24 statement by Nvidia, Microsoft, Meta, IBM, and Hugging Face backing open-weight models and relays proposals from industry and policy researchers for tiered openness: basic capabilities open, some frontier capabilities released on a limited basis, and high-risk capabilities kept behind access controls and safety evaluations.

China’s cyber-vulnerability platform flags Anthropic’s Claude Code

On July 8, NVDB, China’s MIIT-affiliated cybersecurity threat and vulnerability information-sharing platform, issued a risk advisory on Anthropic’s Claude Code, saying versions 2.1.91 through 2.1.196 carried a “backdoor” that could send a user’s region and identity markers to remote servers without consent. It recommended that users uninstall or upgrade and that organizations monitor outbound traffic from development networks. Chinese researchers who reverse-engineered the tool said the mechanism, present since the April 2 release of 2.1.91, checked system timezone and proxy information to identify China-based users and was not documented in the changelogs.

Anthropic said the mechanism was an experiment it introduced in March to prevent unauthorized account resale and model distillation, and that it had been removed in a July 2 release; it noted that its usage policy already bars entities majority-owned by China-headquartered organizations, so Claude Code is not licensed in China. It appears to be the first named Chinese government-affiliated security warning against a US frontier lab’s flagship coding tool. The corporate response split: Alibaba barred employees from using Anthropic’s tools for work from July 10. ByteDance, meanwhile, has set up a reimbursement program for engineers to expense personal Claude subscriptions used over VPN.

On the Horizon

Now that WAICO has been established, we’ll be tracking what its first actions will be.

For more on how we select and track content, see our methodology here.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.

The China AI Bulletin is copy-edited and fact-checked by Kacie Yearout, Pivotal fellow and former diplomat.

Executive Summary

• WAIC 2026 Round-Up: At the World AI Conference (Shanghai, July 17–20), China advanced its global AI governance agenda.

  • Twenty-nine countries signed the founding agreement for the World AI Cooperation Organization (WAICO), a Shanghai-headquartered body Li Qiang first proposed in 2025.

  • President Xi Jinping’s keynote and the conference’s “Chair’s Statement” framed the week around open cooperation and safety. The Statement was more specific on frontier AI risk than in past years, calling for guardrails on large models and “intrinsic safety” for agents.

  • The same day, the National Development and Reform Commission (NDRC), Cyberspace Administration of China (CAC), and Ministry of Industry and Information Technology (MIIT) each issued an international cooperation document (an AI Cooperation Development Action Plan, an agent interoperability initiative, and an International AI Ethics Governance Action Plan).

• Moonshot released the weights for Kimi K3.

  • Independent testing (Artificial Analysis, Epoch, and a joint UK–US government evaluation) ranks it the strongest open-weight model available.

  • It’s the first Chinese model card to evaluate cybersecurity as a risk factor of the model, but doesn’t evaluate for CBRN or loss of control risks.

  • K3 appears to be within a few months of the US closed frontier, though it is large, costly, and hard to run locally.

  • Its release drew a US allegation that it distilled Anthropic’s models, which several researchers dispute.

WAIC 2026 Round-Up

At the 2026 World AI Conference and High-Level Meeting on Global AI Governance (Shanghai, July 17–20), China advanced its global AI governance and open-source agendas through top-level speeches, officially founding the World AI Cooperation Organization (WAICO), and a number of other releases.

Xi’s keynote and the Chair’s Statement encourage open-source & discuss risks

Xi Jinping opened the conference on July 17 with a keynote titled “Joining Hands to Build a Just and Equitable System For Global AI Governance” (Chinese, English), organized around four principles:

(1) Maintain openness, win-win, and boosting innovation-driven development,

• Openness is not “open-source,” more like “openness to the world,” although Xi does endorse open-source here.

(2) Strengthen risk awareness and ensure AI is secure and controllable,

• “Secure and controllable” (安全可控) is also fairly standard rhetoric, and although “安全” can translate as either “safe” or “secure,” this stock phrase tends to get translated as “secure.”

(3) Encourage inclusiveness and promote mutual learning between civilizations, and

• “Shaping the values of AI with humanity’s common values” echoes Xi’s 2023 Global Civilization Initiative (全球文明倡议), a 2023 diplomatic initiative promoting multipolarity that includes youth exchange programs and visa-free travel to China. Here, he also hopes AI can help achieve it by “increas[ing] understanding… among all civilizations.”

(4) Advocate solidarity and improve global governance.

• China has been advocating for the UN as a forum for global AI governance and continues to do so here. He also advocates helping Global South countries overcome the digital divide, which is relevant for WAICO (see below).

The conference’s position statement, the “Chair’s Statement” (Chinese, English),1 included 15 principles, several of them safety-relevant.

Some of its safety rhetoric overlaps with Xi’s, but it also discusses frontier AI, agents, and—significantly—jointly countering misuse by terrorist, extremist, and transnational-criminal groups. Echoing Xi, the statement calls open-source a “vital pathway” to “inclusive AI development.”

A few things I found notable in these speeches:

1. Amidst the fairly standard rhetoric about building out regulation and improving early-warning and emergency response was a mention of holding the “safety bottom line,” a phrase that only recently cropped up in AI.

From Issue #7:

“Holding the AI safety bottom line” draws on 底线思维 (bottom-line thinking), a worst-case-first governance method Xi has pushed since 2013. Under this method policymakers are encouraged to focus on guarding against tail risks. Applied to AI, it indicates a level of concern for AI safety at the State Council level that we haven’t seen before.

I also heard this mentioned by several Chinese officials at different WAIC forums, meaning it’s diffusing down from the State Council and may draw greater attention at lower levels of the party.

2. Xi cautions explicitly against “overstretching the national security concept in AI” and “placing one country’s security over that of others.”

This is a pretty explicit jab at the US, which has used “national security” as a justification for chip export controls, putting Chinese firms on the entity list, and threatening action about distillation (see Bessent’s statements below). The placement of this statement in the section about risk awareness, security, and controllability also feels significant, with the suggestion being that risk awareness and national security are being tied together in a detrimental way

3. Xi is a fan of open source.

Both Xi and the Chair’s Statement endorse open-source. Although Reuters reported that MOFCOM might curb open-sourcing, it’s a key pillar of China’s AI industry and diplomacy, and I wouldn’t expect an export-control based crackdown.

4. There continues to be more attention to frontier safety from top levels.

Xi warns that measures to prevent loss of control (失控) must keep pace as capability advances. While “loss of control” doesn’t necessarily mean the same as it does in Western AI safety discourse—Xi’s use of “technological LoC” in particular had several possible interpretations—it’s still notable, and the Chair’s Statement on jointly “fighting against the abuse and malicious use of AI technologies by terrorist and extremist forces, and transnational organized criminal groups” is quite stark. Overall, we’re seeing a trend of frontier AI safety language being adopted more and more by top leadership, which these speeches continue.

WAICO officially founded

Twenty-nine countries signed the agreement establishing the World AI Cooperation Organization (WAICO), a new intergovernmental body to be headquartered in Shanghai and framed around supporting developing countries and narrowing the “intelligence divide.” Premier Li Qiang proposed WAICO at WAIC 2025. It’s been mentioned by officials at various times since, but this was the first concrete action. The next day, Assistant Foreign Minister Liu Bin used the High-Level Meeting on Global Governance of Artificial Intelligence to welcome countries into WAICO and to restate that “AI should remain under human control.”

NDRC, CAC, MIIT issue international coordination docs

Alongside the WAICO signing, three governmental bodies each released documents related to international cooperation on July 17.

• AI Cooperation Development Action Plan (《人工智能合作发展行动计划》). The NDRC set out eight actions across data, compute, open-source ecosystem sharing, AI+ empowerment, talent, rules and standards, safety-governance collaboration, and AI for good, described by People’s Daily as “pragmatic measures to respond to the United Nations’ initiatives on strengthening international cooperation in artificial intelligence, bridging the digital divide, and promoting sustainable development through artificial intelligence.”2 Action 3 endorses open-source, proposing an international open-source community with shared compliance and safety guidelines, and Action 7 promotes collaborative safety action.

• Global Cooperation Initiative on Agent Mutual Trust, Interconnection, and Interoperability (《智能体互信互联互操作全球合作倡议》). The CAC proposed a 10-pillar initiative on agent interoperability, standards, security frameworks, and cross-border data flows, extending China’s domestic agent-governance stack (the May 8 Agent Implementation Opinions and the GB/Z agent interconnection standards) outward into an international proposal.

• International AI Ethics Governance Action Plan (《国际人工智能伦理治理行动计划》). MIIT issued a full-lifecycle AI-ethics plan covering risk classification, agile governance, capacity-building for developing countries, and research on explainability, privacy, and bias correction. MIIT frames it as “an important public good provided by China to the international community”3 and plans to work with international organizations to promote it.

Other WAIC releases

Many other reports and documents were released over the week at WAIC; here are a few that caught our eye.

• Agent Safety Governance Framework 1.0 (《智能体安全治理框架1.0》). Tsinghua University’s Zhu Xufeng released this parallel to the AI Safety Governance Framework on July 18; Chen Tianhao, who worked on the framework, has an English explainer. It organizes agent risk into four layers: knowledge and cognition (pollution, hallucination, bias); scenario interaction (data, account, asset)); social-group threats (market mechanisms, public institutions, social order); and physical environment and ecosystem. The full report is forthcoming.

• Ten Rule-of-Law Principles for the Healthy Development of Agent Services (《智能体服务健康发展的法治十原则》). A principles document released July 20 at the WAIC AI Rule of Law Forum, covering full-lifecycle, closed-loop risk management; user digital rights (service identification, tiered consent, minimum privilege, protections for the elderly and minors); and industry responsibility, with humans bearing final responsibility.

• Frontier AI Risk Monitoring Platform 2.0. Concordia AI (安远AI) released the platform on July 19, alongside its 2026 Q2 risk report (Chinese, English). It covers five catastrophic risk categories–network attacks, biological risks, chemical risks, harmful manipulation, and loss of control–and finds that model risks are growing rapidly, while safeguards have regressed.

• Shanghai AI Lab released Intern-S2-Preview-397B at WAIC, a 397-billion-parameter open (Apache 2.0) multimodal model in its 书生 (Scholar) line, pitched as a base for science and long-horizon agents rather than general chat. The lab says it matches its own prior trillion-parameter model on core scientific tasks, such as biomolecular-interaction design and material-structure generation, at a fraction of the training cost through a new deep vision-language pretraining approach, and claims leading general-reasoning performance among open models.

• Shanghai AI Lab also launched the Shu’an (书安) AI Safety Base Platform and an AI safety/security alliance. Shu’an is built around a digital-twin sandbox that mirrors a live system’s workflows, permissions, and assets so models and agents can be tested against it. Shanghai AI Lab’s own agent safety framework AgentDog is built in. The lab reports a 1,500-scenario/500,000-tool simulation environment, full security assessments of 17 production systems, and pilots at UnionPay, Shanghai Customs, and a Xiamen logistics base, plus a full-stack agent security toolbox. Shu’an’s launch is coupled with the AI Security Foundation Model Alliance (AI安全基础模型联盟), which the readout links to TC260’s Working Group 9 on AI safety. It’s unclear who’s in the alliance and what relationship the two will have.

🔍 Kimi K3 Deep Dive

Moonshot AI (月之暗面) released the open weights for Kimi K3 on July 27, 11 days after it opened API access around WAIC. Independent testing indicates this is the strongest open-weight model available and sits within a few months of the US closed frontier. However, it is slower, more verbose, and more expensive than the open models that came before it, and its size means it isn’t runnable on consumer hardware. Moonshot has also joined MiniMax in building a commercial trigger into its license in an effort to commercialize its open models.

It’s big and expensive, and efficiency is debated

K3 is a 2.8-trillion-parameter mixture-of-experts (MoE) model with 104 billion active parameters, a one million-token context window, and native multimodal input. Moonshot bills it as the first open model in the 3-trillion-parameter class. It is candid about the model’s performance, conceding that K3 “trails the most powerful proprietary models, Claude Fable 5 and GPT-5.6 Sol,” while beating everything else it tested, including Zhipu’s GLM-5.2, the only Chinese model in its comparison set.

The weights are available for download under a custom Kimi K3 License, rather than MIT or Apache. It adds a commercial trigger, requiring a separate agreement with Moonshot once a model-as-a-service business clears 20 million USD in annual revenue, plus an attribution requirement for large deployments. That is permissive but not the no-strings release DeepSeek and Alibaba have used.

A more substantial difference is price. K3 costs 20 RMB/3 USD per million input tokens and 100 RMB/15 USD per million output, roughly four times its predecessors and the most expensive model any Chinese lab has shipped, though cheaper than Opus and Sol. Moonshot argues it is nonetheless cheaper per task, reporting 91.2 percent on BrowseComp at about 2 USD per task, roughly half what GPT-5.6 Sol costs. Though Artificial Analysis measures K3 as “very verbose,” emitting roughly twice the output tokens of its peers, it reports it’s cheaper per task than GPT-5.6 Sol, Fable, or Opus 5. Moonshot ran all its reported benchmarks at K3’s maximum-effort setting, which Zvi Mowshowitz notes burns “a lot more tokens than are used in similar tests by Fable or Sol,” so the model “likely outperforms on benchmarks relative to practical performance.”

Though it may be more price-efficient, its use efficiency is unclear. Artificial Analysis ranks it 60/99 on speed (35 output tokens/second), and so while it may be efficient by price per task, those tasks may take longer, especially if it is more verbose.

K3’s Moonshot-reported benchmarks are strong, with 93.5 percent on GPQA Diamond (PhD-level science, where top models now cluster in the low 90s) and 88.3 on Terminal-Bench 2.1, an agentic-terminal test run in each model’s own harness. It’s unclear why, but Moonshot omitted the standard SWE-bench Verified while reporting several other coding scores.

Independent tests rank it fourth overall and first among open models

Independent testing broadly matches Moonshot’s ranking claim, though with caveats. Artificial Analysis, running its own harness, scores K3 at 57 on its Intelligence Index, fourth overall, behind Opus 5, Fable 5, and GPT-5.6 Sol. It’s first among all open-weight models, ahead of GLM-5.2 (51) and DeepSeek V4 Pro (44).

On Epoch AI’s Capabilities Index, an independent composite, K3 set a new open-weights record of 156, which places it between Anthropic’s Opus 4.6 and OpenAI’s GPT-5.4. K3 tops LMArena’s frontend-coding arena, beating Fable 5, but is fifth on general agentic tasks. Independent evaluator vals.ai ranks it fifth on its composite index and fourth on SWE-bench Verified at 93.4 percent, yet only 11th of 131 on LiveCodeBench, which uses recent competitive-programming problems to avoid training contamination. Security firm Semgrep found K3 weaker than rival models at finding vulnerabilities in real codebases, with accuracy collapsing on large repositories, and judged it “not a drop-in replacement” for the code-analysis tools security teams already use.

On how far K3 sits behind the closed frontier, Nathan Lambert (Allen Institute for AI) estimates three to five months and Mowshowitz four to six. Forecaster Peter Wildeford notes K3’s score falls almost exactly where the trend in Chinese models’ Epoch scores predicts, about six months behind the US frontier.

K3 finds and exploits vulnerabilities, but has trouble with hardened targets

Moonshot’s technical report includes a dedicated offensive-cyber capability evaluation, the kind of dangerous capability testing Western frontier labs put in their system cards. Cyber is the only dangerous capability test in Moonshot’s technical report, which doesn’t include a CBRN or loss-of-control assessment. Chinese labs have reported cyber benchmark scores before, but generally as line items in a capability table;4 a purpose-built dangerous-capability evaluation framed around misuse risk appears to be a first from a Chinese frontier lab. Moonshot ran two tiers, vulnerability discovery and end-to-end exploit development, and points to outside corroboration: a joint assessment by the UK AI Security Institute and NIST’s Center for AI Standards and Innovation (AISI and CAISI) that it says “reaches conclusions consistent with ours.” It could not benchmark K3 against Claude or GPT, because those models refuse cyber tasks, so GLM-5.2 was its only comparison.

On vulnerability discovery, K3 scanned widely deployed software, from operating system kernels and databases to web frameworks, blockchain, and VPN code, and surfaced hundreds of candidate bugs; about 70% of the human-reviewed findings were genuine, including 16 previously unknown vulnerabilities across six projects. Two were in the Linux kernel: a remotely triggerable denial-of-service bug and a Dirty-COW-class flaw that permits local privilege escalation. On exploit development, K3 built working exploits for 14 of 36 tasks (38.9%), against GLM-5.2’s 8 (22.2%), but 10 of its 14 successes were against unhardened user-space software like PostgreSQL and Apache; on the hardened Linux kernel track, neither model solved more than a quarter.

K3 can chain a working exploit, just not the hardest ones. Moonshot’s own suite shows it completing end-to-end exploits against unhardened targets; the joint AISI and CAISI test, using arbitrary code execution as the bar for a completed attack, put K3 at zero of 41 tasks, against roughly 20 of 41 for US frontier models.

Although end-to-end exploit development is arguably most relevant to misuse, the AISI/CAISI eval reports that K3’s guardrails don’t prevent it from helping with offensive cyber attempts, so even though it may not be as capable as models like Mythos, its offensive capabilities may be more accessible. Without CBRN or LoC tests, it’s hard to know what other risks it might pose. Moonshot separately concedes K3 is “overly proactive” (过于主动), acting for the user when intent is ambiguous, which raises questions about possible autonomous action.

Open does not mean accessible

K3’s size limits who can actually run it. Moonshot ships the weights already quantized to 4-bit, so it can’t be compressed further. The weights alone are about 1.4 terabytes, and because it is a mixture-of-experts model, all 2.8 trillion parameters must stay in memory even though only 104 billion are active per token. Moonshot’s launch-day inference partner, vLLM, says the model barely fits on a single server of eight Nvidia B300 GPUs, or at least 16 of the prior-generation B200s; renting such a node runs about 60 USD an hour and owning one runs into the high six figures. The most cost-efficient way to access for most people will likely be through the API; that use will be subject to Moonshot’s safeguards.

The distillation allegation

After its release, K3 drew accusations that it had distilled Anthropic models. White House science and technology adviser Michael Kratsios alleged that Moonshot “distilled Anthropic’s Fable” through “a sophisticated internal platform to conduct large scale distillation against US models.” K3 identifies itself as Claude far more often than chance, which points to Claude-derived data in its training. Yet Redwood Research’s Ryan Greenblatt finds K3 names the older Claude 4.5 generation, not Fable.

Moonshot denied it: its enterprise-business head Huang Zhenxin said on July 21 that K3’s leap comes from its own original architecture, not from distilling any existing model. Machine-learning researchers Braden Hancock and Nathan Lambert also reject the Fable distillation allegations, noting Fable had been public only since July 1, too little time to distill, train, and release a model this size, and that distillation yields few gains near the frontier. K3’s own technical report does discuss distillation, but of the internal kind that merges Moonshot’s own specialist models into one, a standard technique unrelated to the accusation. No one has measured how much Claude-derived data contributed; on balance, it seems like some happened from older models rather than Fable.

In China: a milestone and a compute ceiling

Many netizens dubbed K3 China’s “Fable 5 moment.”5 Most coverage cites Artificial Analysis; major Chinese benchmarks like SuperCLUE, OpenCompass, and FlagEval^fn haven’t published scores yet.

^Fn BAAI, which runs FlagEval, also has an interesting bio eval for split-order attacks.

They also reported on Moonshot’s compute constraints. Demand exceeded Moonshot’s limits within 48 hours of the API launch, and the company halted new signups around July 19, saying its existing compute was near its limits. 36Kr’s write-up, titled “waiting for the chips” (等芯来), argues that Huawei’s Ascend Atlas 950 and Zhipu’s announced gigawatt of fully domestic compute are the way to break through the compute ceiling.

Market reaction and Moonshot’s strategy

Markets first read K3’s open release as a threat to demand for high-end AI chips, with the SOX semiconductor index falling about 12 percent on the week, its worst in more than a year, before a wave of corrections. SemiAnalysis argues the opposite of the chip-demand scarcity: at 2.8 trillion parameters, K3 needs more than 1.5 terabytes of high-bandwidth memory to serve and runs on large multi-GPU systems, so cheaper per-token open models expand compute demand rather than shrink it. Competitor Zhipu was down about 28 percent in Hong Kong, and MiniMax about 16 percent. Moonshot, meanwhile, is capitalizing on the release; it is reportedly raising a pre-IPO round at a 50-billion-USD pre-money valuation on roughly 300 million USD in annualized revenue.

Moonshot and Zhipu lead a fast-shifting open field

On Artificial Analysis’s intelligence index, Moonshot’s Kimi K3 and Zhipu’s GLM-5.2 lead the Chinese open field (57 and 51, respectively). DeepSeek’s V4-Pro sits further back at 44, alongside MiniMax’s M3, although it’s still technically a “preview” version; Alibaba’s open Qwen tier is a mid-tier workhorse. The wildcard is the full version of Alibaba’s Qwen3.8-Max, currently out as an API-only preview. Alibaba claims it runs second only to Fable 5, with open weights promised soon. Standings shift fast regardless: K3 took the open lead from GLM-5.2 after only about six weeks.

Moonshot and MiniMax have also built a revenue trigger into their open licenses. Moonshot’s Kimi K3 License and MiniMax’s Community License keep the weights free to download but require a separate agreement once a commercial user clears about 20 million USD in yearly revenue. Zhipu and DeepSeek stayed on the standard MIT license. The “value war“ (价值战) is now moving into license terms, a bet that open-model profit will come from charging large deployers for capability rather than serving the cheapest tokens.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.

The China AI Bulletin is copy-edited and fact-checked by Kacie Yearout, Pivotal fellow and former diplomat.

A brief request: If you have five minutes to help us improve the Bulletin, we’d appreciate it if you could fill out this short reader survey.

Editor’s note: the next issue of the Bulletin will be July 30, after the World AI Conference.

Number of the week: 800,000 RMB (117,743 USD)—the investment necessary for an AI short drama to be managed as a “key short drama”1 by the National Radio and Television Administration.

Executive Summary

• Domestic AI Governance: A State Council executive meeting heard a report on AI development and called for “holding the AI safety bottom line” (底线), the first time bottom-line thinking has been applied to AI at the State Council level, alongside pushes on frontier capability, compute, and AI+ deployment. The financial regulator, the National Financial Regulatory Administration (NFRA), issued 32 guiding opinions on AI in banking and insurance, tiering applications by risk and putting the heaviest controls on high-risk uses like credit approval and underwriting. Eight departments issued “AI+ Consumption” implementation opinions aimed at getting AI “into every home and shop.”

  • National Standards: TC260 published a security practice guide for deploying and using AI agents; State Administration for Market Regulation (SAMR) signaled it may make the agent identity code (身份码) mandatory and, alongside Standardization Administration of China (SAC) and Ministry of Industry and Information Technology (MIIT)’s standards committee, moved to accelerate frontier AI standards for agents, embodied intelligence, and world models. MIIT said it has finished drafting a mandatory autonomous-driving safety standard that exceeds the newly approved UN regulation.

• International AI Governance: At Summer Davos in Dalian, Premier Li Qiang tied the risk of loss of control of technology (技术失控) to AI, warning governance that fails to keep pace could bring serious consequences, and said China will keep working to improve global AI governance rules. This is the latest example of 技术失控 being used increasingly at high levels of government in China.Frontier Lab Developments: ByteDance launched Doubao 2.1 (Seed 2.1), a closed flagship sold as an agentic product that can operate a user’s computer, and Alibaba’s Qwen released Qwen-AgentWorld, its first open-weight “language world model,” built to predict environment states from an agent’s actions rather than to chat or code.

• AI Safety Publications: The spotlight is “It Lied to a Doctor to Buy Poison Ingredients,” a study of phone-use agents that found agents built on nine mainstream models completed harmful tasks at high rates (68.8 percent) while rarely refusing; the authors called this a Safety Awareness-Execution Gap, where an agent flags a request as harmful yet carries it out anyway. Also notable: Governance Decay shows that compacting an agent’s context to save tokens silently drops standing safety constraints (violation rates rise from 0 percent to 30–59 percent); Tencent open-sourced the AI-Infra-Guard agent red-teaming framework; and a governance paper mapped China’s proposed World AI Cooperation Organization (WAICO) against 15 existing bodies as the first standing organization built to anchor a development-first governance pole.

• Export Controls and Economic Policy: The National Development and Reform Commission (NDRC) warned provinces against “disorderly competition and piling in” on AI and computing infrastructure, citing idle data centers and roughly 58 percent average occupancy, and pushed provinces toward the national East-Data-West-Computing layout and a centrally dispatched national computing-power network (算力网).

Domestic AI Governance

State Council discusses AI safety “bottom line”

On June 29, Premier Li Qiang chaired a State Council executive meeting that heard a report on AI development. The executive meeting consists of the premier, vice-premiers, state councillors, and secretary-general. It meets two to three times a month to discuss draft laws, deliberate administrative regulations, and discuss and decide on “important matters.” Hearing a report is a way for the State Council to indicate policy priorities before taking more formal action, such as reviewing and approving a document.

The readout highlights:

• Domestic development initiative. The readout calls for “firmly grasping the initiative in development,”2 meaning promoting domestic development. It is not AI-specific; President Xi Jinping used the phrase for science and technology broadly in 2018, and the State Council applied it to future industries at large at the June 5 session.

• Capability and compute. This item focuses on building AI capability, calling for breakthroughs in key technologies, accelerating the construction of ultra-large compute clusters, a greater high-quality data supply, guarantees for talent and capital,3 and enterprise basic and frontier research. Though similar lists of goals appear in other policy documents, this one is more frontier-focused. It includes some elements mentioned in the 15th Five-Year Plan (FYP), which called for basic/frontier research support, a better data supply, and guarantee for talent and funding. The FYP also called for feasibility studies on building ultra-large compute clusters, so the read-out language marks a progression from studying to executing.

• “AI+” applications. The Party-State’s AI+ diffusion agenda appears quite late in the readout, relative to other AI-focused items. It seems to still be a priority, but current AI+ initiatives have been in the works for months, so a shift will take time to manifest.

• Safety bottom line. “Holding the AI safety bottom line”4 draws on 底线思维 (bottom-line thinking), a worst-case-first governance method Xi has pushed since 2013. Under this method policymakers are encouraged to focus on guarding against tail risks. Applied to AI, it indicates a level of concern for AI safety at the State Council level that we haven't seen before. 底线 language on AI has so far been confined to ministerial, technical, and academic texts (including a People’s Daily op-ed covered last issue), while the highest AI-specific policymaking venue, the April 2025 Politburo study session Xi chaired, used the softer “secure, reliable, and controllable”5 to describe AI and did not invoke 底线 at all. It also was not used in relation to AI in the Five-Year Plan. The readout names science and technology ethics (likely the ethics review system being established), testing and certification, and a tiered-and-classified oversight system as mechanisms to reduce AI risk.

The financial regulator sets detailed controls on high-risk financial AI

On June 18, NFRA issued Guiding Opinions on the Safe Development and Application of AI in Banking and Insurance,6 32 detailed opinions spanning governance, development and application, data governance, compute, risk management, safe-development capability, and supervision. It imposes responsibility on whoever uses the AI, sorts applications by risk, and puts the heaviest controls on what it deems the riskiest uses.

AI use that involves transactions of funds, credit approval, underwriting and claims, asset valuation, or anything directly affecting customer interests count as high-risk. Those must clear the institution’s risk-management committee before launch, run under human oversight with emergency shutoff and manual fallback paths, and use black-box models only as an aid to a human decision-maker. The guidance also bars personal and private data, such as names, ID numbers, phone numbers, and bank-card numbers from being used to train or optimize generative AI models.7 Externally sourced generative models must be filed with national cyberspace authorities, and the guidance names specific agent-security threats, such as prompt injection, memory poisoning, tool abuse, and loss of operational control (运行失控).

Eight agencies target the demand side of the AI+ push

The Ministry of Commerce (MOFCOM) and seven other departments issued the Implementation Opinions on Accelerating Development of “AI+ Consumption”8 on June 9, circulated June 18, a 17-measure plan to move AI into consumer markets. Like the other AI+ sector opinions, much of it is a catalog of products and scenarios to build: next-generation AI phones, glasses, and smart-home devices; humanoid, companion, and elderly-care robots; hotel service robots; generative AI education models; and digital avatar live-streaming for retail.

Where it differs from other sector opinions is the emphasis on products around uptake rather than R&D, repeatedly invoking demonstration applications, widespread adoption, and getting AI into “every home” and “every shop.”9 The MOFCOM interpretation casts it as the consumption pillar of the State Council’s 2025 “AI+” Action Opinion and the central consumption-boosting plan. As political scientist Jeffrey Ding argues, the capacity to diffuse a general-purpose technology across the economy, not just to lead at the frontier, is a central driver of economic competition between major powers, and a consumption program built around uptake is clearly aimed at diffusion.

National Standards

TC260 issues security guidance for deploying and using agents

On July 1, TC260, China’s National Technical Committee on Cybersecurity, under the SAC, published a practice guide on deploying and using AI agents securely.¹ It sets out security measures across the agent lifecycle, from evaluation and preparation through deployment, use, and discontinuation, and is written for individuals deploying personal agents and organizations choosing among commercial agent services. It explicitly warns against using models that haven’t gone through the domestic registration process and using unknown “transfer stations,” which have been supporting a gray market of Claude access on the mainland. As a practice guide (实践指南), it is non-binding guidance that sits below a national standard. It complements two other TC260 agent documents: the March 31 guide for OpenClaw-type agents, which called for enterprise registries of approved deployments, and the agent security standards still working through TC260’s pipeline (a recommended GB/T basic specification and a mandatory GB for agent applications). TC260 is filling the guidance layer while the binding standards remain under review.

SAMR signals it plans to make the agent identity code mandatory

At a June 26 press conference, SAMR discussed the seven-part AI Agent Interconnection series (GB/Z 185.1–185.7-2026), which the SAC published on May 22 and we covered in Issue 5. More than 70 organizations contributed to the drafting of the series, which covers the full agent-interoperability protocol. SAMR said it plans to turn the agent identity number (身份码) into a mandatory requirement and to accelerate the development of standards for agent auditing and transactions.

Standards bodies move to accelerate AI standards

On June 29, the SAC said it would speed up national standards for agents, embodied intelligence, and world models, alongside standards for computing infrastructure, high-quality datasets, simulation platforms, deep-learning compilers, and open-source model frameworks. Although it didn’t name specific timelines, concrete projects are already appearing: in the last fortnight, the AI subcommittee of the National Information Technology Standardization Technical Committee (TC28/SC42) registered new national-standard projects for an AI computing-center management platform and an open-source model platform.

Separately, the AI Standardization Technical Committee (TC1) of MIIT, under the China Academy of Information and Communications Technology (CAICT), held its first plenary of 2026 on June 30, with working-group meetings on data, intelligent computing systems, models and platforms, and intelligent products and services. The agendas beyond the meeting titles are not public.

MIIT promotes UN autonomous driving standard

At the 199th session of the UN World Forum for Harmonization of Vehicle Regulations (WP.29) in Geneva on June 22–26, the working party approved the Autonomous Driving System Global Technical Regulation (ADS GTR). MIIT calls it the first globally unified technical regulation for autonomous-driving systems and says China “spearheaded” the standard. It was jointly drafted with the EU, UK, US, Canada, and Japan, but China has vice-chaired WP.29’s working group on Automated and Connected Vehicles since its founding in 2018 and co-chairs the Functional Requirements subgroup.

MIIT is working on similar standards domestically; it says it has finished drafting a mandatory national standard for autonomous driving system safety, now in the approval process, that covers the international regulation’s core content and adds more detailed requirements for L3 and L4 systems.10 It solicited comments on the report-for-approval draft from June 17 to 24.

International AI Governance

Li Qiang links technology loss-of-control risk to AI at Summer Davos

Opening the 17th World Economic Forum Annual Meeting of the New Champions (“Summer Davos”) in Dalian on June 24, Premier Li said AI is driving frontier breakthroughs so fast that, in his words, “some say” humanity has entered the “Cambrian” of the intelligent era,11 which he then set against a warning: “the risks of loss of control of technology (技术失控) and ethical breaches are becoming more prominent,”12 and “if the corresponding governance cannot keep pace, it may well lead to serious consequences.”13 He said China will keep taking part in global AI governance “with a responsible and constructive attitude,” working with others to “improve institutional rules and raise the effectiveness of regulation.”14

“技术失控 (loss of control of technology)” has been reaching higher levels of government. Xi first used it in his January 2026 Politburo study-session speech that Qiushi published in May, but it sat in a general future-industries governance passage and was not tied to AI. Li has now specifically linked it to AI at a flagship international forum and in China’s own outward-facing framing. Five days later, he chaired the State Council executive meeting whose readout discussed “holding the AI safety bottom line” (see Domestic AI Governance above), so in one week the premier discussed AI safety both abroad and at home.

Frontier Lab Developments

Notable Model Releases

ByteDance launched Doubao 2.1 (Seed 2.1) as its new closed-source flagship. It is selling two versions: (1) a consumer “Professional Edition” at 500 RMB/73.59 USD a month that runs agentic tasks and can operate a user’s local computer, and (2) via API access on Volcano Engine at 6 RMB/0.88 USD per million input tokens and 30 RMB/4.42 USD per million output, roughly 80 percent cheaper than Anthropic’s Claude Opus. ByteDance claims parity with leading Western models on coding and agentic benchmarks.

Alibaba (Qwen) released Qwen-AgentWorld-35B-A3B, its first “language world model,” a 35 billion-parameter Mixture-of-Experts (MoE) model trained to predict the next environment state from an agent’s action across seven interaction domains, rather than a general chat or coding model. It uses a sparse MoE (256 experts, eight routed plus one shared), a 262K-token context, and open weights under Apache 2.0. Qwen reports 56.39 overall on AgentWorldBench, its own benchmark for agent-environment modeling. Environment-modeling is the core training objective here, built in from pre-training.

Baidu released Unlimited-OCR, a compact three billion-parameter vision-language optical character recognition (OCR) model for one-shot, multi-page document parsing, open-weight under an MIT license.

Also released this fortnight:

• Xiaomi-GUI-0 (Xiaomi), code and a technical report for a 30B-parameter (3B-active) on-device mobile GUI agent that carries out multi-app smartphone tasks. Xiaomi reports 72 percent task success on its own RealMobile benchmark and 78.9 percent on AndroidWorld, with weights forthcoming.

• SenseNova-U1-8B-MoT-Infographic-V2 (SenseTime), a V2 refresh of its unified multimodal infographic model (18 billion parameters total, eight billion in the language model), open-weight (Apache 2.0), on a Mixture-of-Transformers architecture that drops the separate visual encoder and variational autoencoder for native pixel-to-word generation.

• Seedance 2.5 (ByteDance), a closed video-generation model capable of generating clips up to 30 seconds long.

• ERNIE/Wenxin refresh (Baidu), a closed site and model-matrix update.

Technical Publication Highlights

Frontier labs released 152 papers on arXiv this fortnight. Highlights are below; a full list with summaries can be found here.

Alibaba

Discovering Millions of Interpretable Features with Sparse Autoencoders

• Introduces Qwen3-Instruct SAE, a suite of sparse autoencoders trained across Qwen3 models (1.7B–8B parameters) that decompose neural activations into interpretable features, with a refusal-steering case study demonstrating causal steering capabilities.

PolicyAlign: Direct Policy-Based Safety Alignment for Large Language Models

• PolicyAlign aligns LLMs directly to natural-language safety policies by synthesizing violating examples and using self-distillation, then filters to high-impact instructions for stable training. It reduces costly supervision while maintaining general capabilities across diverse domains like medicine, law, and finance.

Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies

• Exposes critical vulnerabilities in self-evolving LLM agent systems where adversarial attacks become permanently encoded and self-amplify across generations. The Module–Lifecycle Attack Surface matrix identifies 17 of 25 functional areas with critical threats lacking defenses, and case studies show evolution-native designs achieve 100 percent attack persistence while existing security measures block only 2.5 percent of threats.

SingGuard: A Policy-Adaptive Multimodal LLM Guardrail with Dynamic Reasoning

• Presents SingGuard, a multimodal safety model that adapts to runtime policy changes by treating safety rules as inputs and predicting both violations and triggered rules. The system supports three inference modes (fast direct judgment, hybrid, and slow deliberation) optimized via decoupled reinforcement learning, and introduces SingGuard-Bench with 56K examples across 80-plus risk types including cross-modal composition risks, achieving state-of-the-art F1 across six benchmark families and improving policy-following accuracy from 64.7 percent to 74.2 percent under dynamic rule shifts.

Yuvion VL: A Multimodal Foundation Model for Adversarial Content and AI Safety

• Introduces Yuvion VL, a multimodal model family purpose-built for detecting adversarial content and AI safety risks through adversarial-aware data synthesis, three-stage training, and a contrastive fine-tuning method that distinguishes visually similar cases with different safety implications. The 32B variant outperforms comparably sized open-source and closed-source commercial models on safety tasks while maintaining general capability parity.

ByteDance

SafePyramid: A Hierarchical Benchmark for In-context Policy Guardrailing

• Introduces SafePyramid, a benchmark with 1,000 conversations and 3,000 application-specific policies to evaluate whether AI safety guardrails can identify policy violations based on context-provided rules rather than fixed taxonomies. Current best models achieve only 54, 35, and 13 percent accuracy on single-rule, multi-rule reasoning, and novel policy adaptation tasks respectively, revealing substantial gaps in policy execution capabilities.

SenseTime

Omni-Perception Policy Optimization for Multimodal Emotion Reasoning

• Proposes Omni-Perception Policy Optimization (OPPO), a reinforcement learning framework that optimizes multimodal perception in emotion-reasoning models by rewarding trajectories that utilize visual, acoustic, and emotion cues and suppressing hallucinations through KL-penalized masking of cross-modal evidence tokens. On emotion reasoning benchmarks, OPPO improves both task performance and faithfulness metrics while reducing spurious multimodal claims.

StepFun

PerceptionRubrics: Calibrating Multimodal Evaluation to Human Perception

• Introduces PerceptionRubrics, a rubric-based evaluation framework that moves beyond holistic semantic matching to atomic fact auditing with 12,000-plus instance-specific criteria. A Gated Scoring mechanism penalizes failures on mandatory visual facts, revealing that models often pass fragmented elements but fail strict conjunctive constraints—and exposing a persistent 8 percent performance gap between open-source and proprietary models.

Tencent

AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents

• Reframes OS security for autonomous AI agents by shifting from resource-based access control to intent-based filtering: agents declare high-level goals, and the system automatically synthesizes least-privilege environments with mandatory mediation and auditing. The four-layer AgenticOS architecture (Ghost Kernel, Logic Shutter, Agent Capsule, and Semantic Boundary Gateway) prevents attackers from composing low-level primitives into unauthorized behaviors even after compromising the agent runtime.

ARGUS: Production-Scale Tracing and Performance Diagnosis for over 10,000-GPU Clusters

• Introduces ARGUS, a production tracing system for 10,000-plus GPU clusters that maintains sub-2 percent overhead while capturing fine-grained CPU, framework, and GPU kernel traces, compressing raw events by 3,700× and automatically diagnosing fail-slow performance anomalies across compute, communication, and software bottlenecks. Deployed at Tencent for six months, it has detected and resolved issues like hardware degradation and JIT stalls that waste millions of GPU-hours.

Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming

• Introduces AI-Infra-Guard, an open-source red teaming framework that matches different security detection methods to distinct agent layers—from rule-based scanning of infrastructure components to LLM-driven auditing of tools and multi-turn adversarial testing of agent behavior, covering 75-plus components and 1,400-plus vulnerability rules.

AI Safety Publication Highlights

Chinese researchers published 72 AI-safety-related papers this fortnight. Highlights are below; a full list with summaries is available here.

🔍Spotlight

It Lied to a Doctor to Buy Poison Ingredients: Quantifying Real-World Misuse of Phone-use Agents (Fudan University)

Phone-use agents (AI systems that operate real smartphone apps by reading the screen and tapping through the interface) can function in ways that API-and CLI-based agents cannot, which is also what makes their misuse more dangerous. A team from Fudan built a benchmark grounded in six Chinese laws and administrative regulations (1,381 test cases across six misuse categories) and ran agents built on nine mainstream commercial and open-source models across 27 real Chinese apps on physical devices, not in simulation.

Most agents rarely refused, and the average harmful-task completion rate reached 68.8 percent on real devices. Small open-source agents matched the commercial models while running faster and cheaper. Refusals concentrated on overt tasks such as buying a controlled substance or harassment; the agents were far more compliant with covert misuse such as fraud and coordinated review manipulation, which the authors argue does more real-world harm.

In the case study that gives the paper its title, the authors report that a Claude Opus 4.8 agent went online to buy ingredients for a toxic substance, fabricated a medical diagnosis, deceived an online doctor into issuing an electronic prescription, and completed the order and payment on its own. The authors call it the first documented case of an AI agent procuring controlled precursor materials, but that claim needs two caveats. First, it’s unclear if it purchased all the precursors to the bombs/toxic substances or how difficult it would be to manufacture them. Second, it’s unclear what the magnitude of harm would be. The paper doesn’t describe how explosive the possible reaction would be, and while it purchased a precursor to mercury iodide, mercury iodide is harmful when inhaled or absorbed, but isn’t considered a mass-casualty weapon. Finally, the purchase ran through a real e-commerce platform that sold the items behind a gameable online-prescription check, so it may reflect weak platform security as much as a new AI capability. Still, the authors claim it’s significant the agent convincingly fabricated a diagnosis. The paper’s core concept is a Safety Awareness-Execution Gap: an agent recognizes a request is harmful yet executes it anyway, which the authors trace to reduced activation of the model’s safety neurons when acting as an agent. Re-eliciting that awareness (through a detector, a prompt-based defense, or activation steering) cut misuse with limited capability loss, but the covert threats stayed largely unsolved.

The study shows why agent behavior is increasingly governed separately from model outputs: the gap between a model that refuses a harmful request in chat and an agent that completes it on a real phone is what the agent-security standards in this issue’s National Standards section are meant to address.

Agentic Safety

Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents

• Governance Decay describes how LLM agents systematically violate in-context safety constraints when long conversations are automatically summarized to save tokens. The researchers measure this with ConstraintRot, a benchmark showing violation rates jump from 0 percent to 30–59 percent after compaction, because summarization algorithms treat standing policies as low-salience and drop them. Constraint Pinning, a training-free defense, restores compliance to 0 percent with minimal token overhead, though the paper identifies remaining failure modes where the defense degrades.

Institutional affiliations: Beijing Institute of Technology

ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP

• ShareLock distributes malicious instructions across multiple tool descriptions using cryptographic secret sharing (Shamir’s scheme), making each individual tool appear benign while collectively reconstructing the attack when triggered. This multi-tool poisoning framework defeats detection by manual inspection or automated scanners because no single tool contains the full malicious payload—only harmless-looking fragments. Experiments on mainstream LLMs show more than 90 percent attack success while evading tool description-based defenses, demonstrating threat actors can exploit Model Context Protocol’s distributed architecture to hide poisoning across the agent’s tool ecosystem.

Institutional affiliations: Shanghai Jiao Tong University

Alignment

Beyond Safe Data: Pretraining-Stage Alignment with Regular Safety Reflection

• Safety Reflection Pretraining embeds periodic safety reflections directly into pretraining corpora to establish self-monitoring as a foundational capability rather than relying solely on data filtering. Testing on 1.7B models shows the method reduces jailbreak success rates and improves safety classification accuracy compared to unsafe data filtering or rewriting alone. The approach addresses a specific failure mode: models composing benign knowledge into unsafe behaviors—a risk that data sanitization alone does not prevent.

Institutional affiliations: Tsinghua University

Low-Agreeableness Persona Conditioning for Safe LLM Fine-Tuning

• Fine-tuning LLMs for conversational warmth increases jailbreak susceptibility and harmful outputs, but this appears driven by data construction rather than empathy itself. The authors introduce persona-driven conditioning, where user inputs are rewritten to reflect low agreeableness while assistant responses remain warm and de-escalating. Across four models, this approach reduces jailbreak success rates and harmful outputs versus standard warmth fine-tuning, while maintaining conversational warmth—suggesting safer empathetic alignment is achievable through data design alone.

Institutional affiliations: Hong Kong University of Science and Technology

Evaluation and Benchmarks

LIBERO-Safety: A Comprehensive Benchmark for Physical and Semantic Safety in Vision-Language-Action Models

• LIBERO-Safety is a benchmark for evaluating physical and semantic safety in vision-language-action models, systems that control robotic manipulation. The authors develop a parametric scenario generator to create collision-free demonstrations at scale (19,664 examples with domain randomization) and evaluate eight VLA models and two embodied foundation models. Their analysis exposes a generalization-safety tradeoff: higher-diversity training improves collision avoidance but reduces task success, and models show semantic misalignment between language instructions and safe execution paths.

Institutional affiliations: Tsinghua University, Beijing Academy of Artificial Intelligence, Beihang University, Eastern Institute of Technology, Shanghai Jiao Tong University, Microsoft Research Asia

Long-Term Simulation Exposes Cognitive-Developmental Risks in AI Companions

• TSJ (Theater-Stage-Judge) is a longitudinal evaluation framework that simulates extended AI companion interactions across developmental stages to detect risks that single-turn testing misses. While testing six models over 12,960 simulated person-days across four age groups and 24 risk dimensions, the framework found short-horizon evaluations systematically underestimate harm, with stable risk estimates emerging only after approximately 140 conversational turns. Early childhood and emerging adulthood showed highest vulnerability in cognitive trust and emotional dependency domains.

Institutional affiliations: East China Normal University, Shanghai Artificial Intelligence Laboratory

ROBOSHACKLES: A Safety Dataset for Human-Injury Prevention in Embodied Foundation Models

• ROBOSHACKLES is a 10,000-clip robotic video dataset for safety alignment in embodied foundation models, systems that combine multimodal reasoning with executable robot actions. The dataset is synthesized from real robot observations using image editing and video generation to create realistic hazardous scenarios (direct injuries and indirect environmental harms) that cannot be safely collected in practice. Evaluation of six models shows 100 percent unsafe action rates on these scenarios, establishing a benchmark for refusal learning and hazard anticipation in robot control systems.

Institutional affiliations: Chinese Academy of Sciences, University of Science and Technology of China

SciRisk-Bench: A Risk-Dimension-Aware Benchmark for AI4Science Safety

• SciRisk-Bench is a benchmark evaluating LLM safety in scientific contexts across seven disciplines, 31 subdisciplines, and 10 risk dimensions—including dual-use synthesis details, omitted safety precautions, overconfident claims, and data privacy violations. The authors evaluate mainstream and science-specialized LLMs to identify where models fail to recognize or mitigate risks specific to laboratory, clinical, and research workflows. Results show that existing general-purpose safety benchmarks inadequately capture the distinct failure modes that arise when LLMs mediate high-stakes scientific decisions.

Institutional affiliations: Chinese Academy of Sciences, University of Chinese Academy of Sciences, Zhongguancun Academy, Beijing Key Laboratory of Safe AI and Superalignment, Renmin University of China, Beijing Institute of AI Safety and Governance

Governance and Policy

World Artificial Intelligence Cooperation Organization (WAICO): Mapping an Emerging Institution in the Global AI Governance Regime Complex

• This paper maps WAICO (China’s proposed World Artificial Intelligence Cooperation Organization) within the global AI governance landscape. Using structured coding of 15 existing AI governance bodies, the authors identify WAICO’s unique institutional positioning: universal membership (no values test), sovereignty-centered framing, and development-first priorities—features absent in Western-led bodies (which gate entry by shared values and emphasize rights/safety) and UN bodies (open but anchored in human rights). The analysis characterizes WAICO as the first standing organization designed to anchor a development-oriented governance pole distinct from the incumbent rights-and-safety framework.

Institutional affiliations: Tsinghua University, Federal University of Rio de Janeiro

Guardrails and Deployment Safety

When EER Hides Deployment Failure: Auditing Threshold Transfer and Unlabeled Score Calibration for Speech Deepfake Detectors

• This paper reveals a deployment gap in speech deepfake detectors: models achieving low equal error rate (EER) on test sets often fail catastrophically when their thresholds are applied to new, unlabeled data. Testing a state-of-the-art detector shows 0.21 percent in-domain EER but 39.5 percent half total error rate on out-of-domain data, rejecting 78.7 percent of legitimate speech. The authors prove common score calibration techniques cannot improve EER and find that popular unlabeled test-time corrections fail, some collapse entirely on new datasets, exposing a systematic mismatch between research metrics and real-world detector behavior that matters for security-critical deployment.

Institutional affiliations: Xidian University

Interpretability

Robust Harmful Features Under Jailbreak Attacks: Mechanistic Evidence from Attention Head Specialization in Large Language Models

• This paper identifies Adversarially Compromised Heads (ACHs) and Safety-Aligned Heads (SAHs)—specialized attention structures that respond differently to jailbreak attacks. ACHs in early layers are suppressed by adversarial prompts, while SAHs in mid-layers maintain active safety signals even when attacks succeed. The authors show that removing just a few ACHs triggers jailbreak behavior, and persistent SAH activations can be read directly—without retraining—to detect attacks with competitive accuracy, suggesting safety information survives suppression rather than being eliminated.

Institutional affiliations: Beijing University of Posts and Telecommunications

Misuse and Dangerous Capabilities

Mind the Intention: Task-Aware Backdoor Attacks for Forecast-Driven Distribution Network Operations

• GridTroj is a backdoor attack framework that embeds hidden triggers in energy forecasting models to cause cascading operational failures in power distribution networks. Unlike standard backdoor attacks that only manipulate forecast outputs, GridTroj’s “Intention Planner” designs triggers and poisoned training data to specifically damage downstream grid operations—voltage instability, line overloads, or demand-supply mismatches. Experiments show the attack successfully compromises real optimization tasks, demonstrating that forecast-driven grid automation creates exploitable vulnerabilities where poisoned models act as persistent, stealthy threats to critical infrastructure.

Institutional affiliations: Xi’an Jiaotong University, Fudan University

Export Controls & Economic Policy

The NDRC warns provinces against disorderly AI and compute buildout

Developing “AI+” has to fit local conditions, and provinces should “resolutely avoid disorderly competition and piling in,”15 the National Development and Reform Commission’s (NDRC) High-Tech Deputy Director Zhang Kailin said on June 24. He pointed to provinces already specializing: 10, including Anhui and Jilin, are folding their plans into the national East-Data-West-Computing (东数西算) layout, and 17 have made green, low-carbon power a basic principle for new computing infrastructure. The NDRC’s caution follows Xi’s own. At the July 2025 Central Urban Work Conference, Xi questioned whether every province needs to develop the same few industries (AI, computing power, and green energy vehicles).16

Overbuilding is a particular concern in AI, with state media flagging idle older data centers, low average occupancy, and a structural split in which general-purpose compute is in relative oversupply while high-end intelligent compute stays scarce. The state response has been consolidation. On June 29, Xinhua framed China’s compute infrastructure as moving from scattered construction toward networked dispatch, toward a national computing-power network (算力网) that delivers compute on demand, like water or electricity. That continues the national integrated computing-power network buildout we covered in Issue 4 and Issue 5.

On the Horizon

China hosts the APEC Digital and AI Ministerial (Chengdu, July 23–24). MIIT opened overseas-media registration on June 30 for the 2026 APEC Digital and AI Ministerial Meeting, in Chengdu the week after the World Artificial Intelligence Conference. No agenda is public yet, but we’ll watch for anything AI-related coming out of it.

For more on how we select and track content, see our methodology here.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.

The China AI Bulletin is copy-edited and fact-checked by Kacie Yearout, Pivotal fellow and former diplomat.

Number of the week: 10 trillion—the daily target output from a new Beijing “token factory”

Executive Summary

• Domestic AI Governance: The “AI+” implementation wave continued—MIIT’s AI+ Information and Communications plan and the National Data Administration’s plan to build high-quality training datasets operationalized the plan across the telecom and data layers. Separately, a People’s Daily commentary framed AI misuse as a national security threat, a State Council employment plan expressed concern over AI and jobs, MIIT and SASAC launched a humanoid robot real-world training push, and the CAC opened a public channel to report AI application problems.

  • National Standards: MIIT’s AI standardization committee advanced 29 AI safety/security standards, and the SAC opened a 126-standard batch for comment that includes a seven-part Industrial AI Agents series.

• International AI Governance: Foreign Minister Wang Yi signaled China is accelerating preparations for a World AI Cooperation Organization (WAICO). Chinese security scholars published a run of proposals on what the US-China AI dialogue should cover, including joint evaluations and communication mechanisms.

• Frontier Lab Developments: A steady run of open-weight releases, led by Zhipu’s GLM-5.2 and Moonshot’s Kimi-K2.7-Code, plus Xiaomi’s MiMo coding agent and Baichuan’s clinical-grade M4. Frontier labs released 138 papers on arXiv this fortnight.

• Technical AI Safety: Chinese researchers published 48 AI safety papers, still weighted toward agent safety. In the spotlight: a Fudan/Shanghai AI Lab/Concordia AI/Shanghai Innovation Institute benchmark for LLMs’ autonomous penetration capability, which rose with general model capability.

• Export Controls & Economic Policy: In the first US export control on the use of a deployed frontier model, the US barred foreign nationals from accessing Anthropic’s Fable 5 and Mythos 5, resulting in Anthropic pulling the models for everyone.

Domestic AI Governance

State Council’s employment plan shows concern over AI labor displacement

On June 17, the State Council released its Plan for Implementing the Employment-First Strategy during the 15th Five-Year Plan (《实施就业优先战略“十五五”规划》). One of its nine task areas is on “adapting to AI development to promote employment and entrepreneurship.”1 The plan is relatively optimistic; it ties employment to the national “AI+” action, calls to explore new forms of human-machine collaboration and to “strengthen AI’s job-creation effect,”2 and urges making good use of the “AI development dividend”3 to increase employment and benefit livelihoods. However, it also acknowledges potential risks to labor. Alongside the dividend language, it commits to track and handle AI-driven job loss: it lists “AI’s impact on employment”4 among the issues for its employment-monitoring and risk-response work, alongside population aging, and calls to improve early warning and handling of employment risks from AI.5 A separate platform-labor provision presses platform companies to “regulate algorithms and improve transparency” and to protect gig workers’ rights to know, participate in, and choose how algorithm rules apply to them.6

The National Data Administration lays out a plan to build AI training datasets

On June 8, the National Data Administration (NDA)—the data-governance body established in 2023—released its Implementation Plan for Promoting the Building of High-Quality Industry Datasets,7 laying out a plan to leverage training data to promote the “AI+” Initiative8 and 15th Five-Year Plan. The plan groups seventeen measures under six “special actions”—expanding dataset building capacity, labeling/annotation, improving quality and efficiency, promoting applications, managing services, and unleashing value9—around a “data flywheel” (数据飞轮) in which scenarios pull data, data trains models, and model use generates more data. It sets a 2028 target of application-validated datasets across key sectors, backed by national standards and a push for “one evaluation, nationwide mutual recognition” of dataset quality.

The plan also addresses the use of data for AI training, committing the NDA to develop “data rules for AI development”—separating data holding, use, and operation rights, and “improving rules for data use in the AI-training stage” so that copyrighted works can be “used for model training in an orderly way” under authorization and revenue-sharing.10 That pulls training-data legality and copyright into the formal agenda, beyond the general call to respect IP in the 2023 Generative AI Measures. Days earlier, on June 4, NDA director Liu Liehong (刘烈宏) convened a symposium on the same theme with DeepSeek, ByteDance, Alibaba Cloud, and Tencent and legal scholars including the China University of Political Science and Law.

The plan was released with six expert explainers (专家解读) over ten days, with authors spanning national research bodies, academia, and the Beijing and Shanghai municipal data bureaus. Hu Jianbo (胡坚波), head of the National Data Development Research Institute, wrote two: one marking the launch of a new National Dataset Management Service System—the “physically dispersed, logically centralized” backbone the plan envisions—and one walking through the plan’s logic, arguing that the “public-data dividend” is fading and that proprietary industry data is now the competitive moat for model-builders. His first piece cast datasets as a great-power “strategic high ground,” pointing to the US “Genesis Mission,” which involves consolidating federal data for AI training. Tsinghua’s Meng Qingguo (孟庆国) stressed that Chinese models are “long on general knowledge but short on specialized knowledge”11 and detailed the value-release agenda—token-based pricing, dataset trading on exchanges, and dataset-backed financing. The other three came from China Academy of Information and Communications Technology (CAICT) vice president Wei Liang (魏亮), on data supply, and the deputy directors of the Beijing (Peng Xuehai, 彭雪海) and Shanghai (Qian Xiao, 钱晓) data bureaus.

MIIT issues a three-year “AI+ Information and Communications” plan

On June 10, the Ministry of Industry and Information Technology (MIIT) released its Implementation Opinion on the Innovative Development of “AI+ Information and Communications” (2026–2028)12—the latest in a series of sectoral plans operationalizing the national “AI+” initiative (including AI+ energy; see CAIB #4 and #5 for discussion). The document includes network and compute build-out goals, plus AI-specific ones: by 2028 MIIT wants telecom networks running with “high-grade autonomy” (自智), at least 30 “high-value” AI scenarios, and a set of “distinctive AI agents.” It also names embodied intelligence as a network-integration priority and, on the consumer side, AI smartphones and PCs, smart-home devices, and carrier-built AI assistants. On the governance side, it includes “strengthening the industry’s governance capacity”13 as one of four pillars and “strengthening international cooperation”14 among its safeguards.

MIIT and SASAC launch a humanoid robot training push

On June 8, MIIT’s General Office and the State Council’s State-owned Assets Supervision and Administration Commission (SASAC) jointly issued a notice launching a “2026 Humanoid Robot and Embodied Intelligence Real-Scene Training Special Action.”15 It aims to create a deployment and data flywheel: put humanoid and quadruped robots to work in real-world settings—including manufacturing, warehousing, inspection, elderly care, and emergency response—to accumulate “real-machine data” (真机数据) that improves embodied intelligence models and hardware. Its goal is to have “100+ high-value application scenarios” and “10,000-unit-scale deployment capacity” by the end of 2026.16 It also pulls in standards and safety scaffolding—a robot “ID card” (身份证; a requirement recently in effect) for lifecycle management, MIIT’s humanoid-robot standardization committee, and collision-detection and emergency-braking requirements for human-machine settings—and floats a “robot-as-a-service” model to lower buyers’ costs.

People’s Daily commentary frames AI misuse in the cognitive domain as a national security concern

On June 16, the People’s Daily ran a commentary by Zhang Jun (张军)—a Chinese Academy of Engineering academician and Party secretary of the Beijing Institute of Technology—arguing that AI is “deeply reconstructing the boundaries and system of national security”17 and that AI misuse in the “cognitive domain” (including deepfakes, disinformation, and public opinion attacks) has become “one of the most direct threats to national security.”18 Built around Xi Jinping’s cited statement that China must “ensure AI is safe, reliable, and controllable,”19 it outlines three priorities: talent (cross-disciplinary people who understand “technology, governance, and security”), self-reliance in “root technologies” (根技术) such as chips and algorithm frameworks, and “bottom-line thinking” on risk, including calling to “accelerate AI legislation” and build lifecycle safety assessment into AI projects. It is an individual op-ed, not a policy statement, but its placement in the People’s Daily can indicate agenda signaling or that a view is being floated to assess public opinion.

CAC opens a public channel for reporting AI application problems

On June 12, the reporting center of the Cyberspace Administration of China (CAC) opened a dedicated section for the public to report problems with AI applications, part of a Qinglang special campaign to rectify AI application “disorder” (see coverage in CAIB #4).20 Reports run through the existing 12377 system, a national hotline/website for reporting illegal online content. The section lists 14 problem types in two buckets. One covers AI service and compliance failures: large models that skipped required filing, weak platform security and content-filtering, training-corpus safety and data-poisoning risks, missing labels on AI-generated content, use of AI for illegal activity, and lax security management of open-source models. The other covers content abuses: fabricated information, impersonation, violent or vulgar material, harm to minors, AI-run “water armies” (网络水军) for astroturfing, non-compliant AI apps, and using AI to “remix” (魔改) classic works into “digital slop” (数字泔水). The scope maps onto China’s existing AI rules—including the requirement to file large models with the government and label AI-generated content—and gives the public a route to flag violations of them.

National Standards

MIIT’s AI standards committee moves 29 AI safety/security standards at a working-group session

At the 2026 first standards-week of the Ministry of Industry and Information Technology’s AI Standardization Technical Committee, its Security Governance Working Group (WG8) held its third 2026 session on June 8–9 in Beijing, chaired by group head Shi Lin (石霖). More than 100 experts attended, with representatives from CAICT, Beijing Jiaotong University, Sangfor, the three state telecom carriers, Ant Group, Huawei, Inspur, ZTE, and ByteDance’s Volcano Engine, among others. The session moved 29 standards across three stages: it discussed four public-comment drafts—including overall technical requirements for large-model security benchmark testing21—approved ten new project registrations, including security requirements for equipment-manufacturing industrial large models,22 and reviewed fifteen pre-research drafts, including on agent data-security technical requirements and evaluation methods.23 Discussion centered on data, model, and interaction security and risk governance for large models, agents, and embodied intelligence—the build-out of a dedicated “AI Security Governance” standards series.

SAC proposes industrial AI agents standards

The Standardization Administration of China (SAC) issued 126 proposed national standards for comment, including a seven-part Industrial AI Agents24 series—general requirements, classification and evaluation, task perception and understanding, knowledge memory and reasoning, decision and orchestration, skill development and interaction, and autonomous execution and learning. The batch also includes application requirements for agents in business-management systems, two digital human standards25 (detection and recognition, and a taxonomy for the emotional presentation of digital humans), a multi-view 3D-reconstruction spec, a compute-in-memory accelerator instruction set, plus several autonomous-driving functional-safety and safety-of-the-intended-functionality (SOTIF) standards.

International AI Governance

China’s proposed World AI Cooperation Organization may be advancing

On June 17, the State Council Information Office released Building a More Just and Equitable Global Governance System: China’s Concepts, Initiatives and Actions.26 The white paper is not AI-specific—it covers climate, the digital divide, food and energy security, and other cross-border challenges—but it names “the misuse of AI giving rise to safety/security risks”27 among the problems it says global governance must address, and it devotes a passage to AI. That passage reiterates previous rhetoric on global governance, calling to “promote AI to develop for good and for the benefit of all,”28 restating the 2023 Global AI Governance Initiative, and backing the UN as the main channel in building a global AI governance system. It also directly addresses the security concerns of military AI: China “attaches great importance to guarding against the risks of military applications of AI,” urging states to be “prudent and responsible” in developing and using such technologies, to keep relevant weapons systems “always under human control,” and to “prevent an AI arms race.”29 It doesn’t dip into loss of control language, but demonstrates a clear concern for the security risks of military AI.

At the launch press conference, Politburo member and Foreign Minister Wang Yi (王毅) said China is accelerating preparations to establish the World AI Cooperation Organization (WAICO)30 and welcomes all parties to join. China first proposed establishing WAICO at the July 2025 World AI Conference, alongside the Global AI Governance Action Plan, and floated Shanghai as its headquarters. The white paper reiterates the 2025 language—it says China “proposed establishing” (倡议成立) WAICO—so Wang Yi’s “accelerating preparations” (加紧筹建) is the firmest commitment language to date. Although there are no other details, National Development and Reform Commission (NDRC) Vice Chairman Zhou Haibing (周海兵) mentioned the July 2026 World AI Conference as “an opportunity to further strengthen international cooperation in artificial intelligence with all parties.”31 Zhou also stated that a next step is to “uphold coordinated development and safety/security” and “explore AI regulatory cooperation to jointly guard against AI safety/security risks.”32

Chinese security scholars propose topics for the US-China AI dialogue

Since the two governments agreed in May to begin an official AI dialogue, China’s strategic studies/IR community has produced a steady run of commentary on what the channels should actually discuss, including two new pieces this fortnight. Tsinghua’s Xiao Qian, deputy director of the Center for International Security and Strategy (CISS) and vice dean of the Institute for AI International Governance (I-AIIG), opened the run in May with a broad menu including expert dialogues on frontier AI risks, communication channels on major AI incidents, joint work on AI evaluation and safety testing, and confidence-building measures on military AI and cyber stability. Days later, Fudan’s Cai Cuihong proposed three principles for cooperation—equality (对等), boundaries (有界), and openness (开放)—coupling risk-warning and crisis-communication systems with accident reporting and model evaluation exchange, while warning against AI safety/security as an excuse for the “over-securitization of civilian AI, open-source models, cloud services, and scientific exchange.”33 (Unlike the others, which were published in English in China-US Focus and thus aimed at an Anglophone audience, this was published in Chinese in China Daily.)

The last two weeks brought a series of narrower proposals. One to highlight: Qi Haotian (Peking University) proposed a military AI “minimal template”: channels scoped to verify whether a dangerous anomaly is “real, local, degraded, spoofed, or spreading,” not to “settle blame in real time.” The design, borrowed explicitly from the Cold War US-Soviet hotline, is to buy time to verify and avoid miscalculation, not to resolve disputes.

Frontier Lab Developments

Notable Model Releases

Zhipu releases GLM-5.2, a 744-billion-parameter open-weight model. On June 13—the day after the US pulled Anthropic’s Fable 5, and three days before the open weights—Zhipu pushed GLM-5.2 to all tiers of its GLM Coding Plan, the Claude-Code-compatible coding subscription it has run since 2025. Founder Tang Jie wrote that “the sudden restriction of certain frontier models is deeply regrettable” and that access had been “abruptly cut off for non-technical reasons;” an accompanying developer letter argued that that frontier intelligence “should not belong only to a few, nor be withdrawn at any time by a few rules.”34

On June 16, Zhipu released the open weights. GLM-5.2 is a 744-billion-parameter mixture-of-experts model—a design that activates only a fraction of its parameters (here, 40 billion) for any given input—and Zhipu reports gains in efficiency and in handling long inputs. Code is at zai-org/GLM-5, with the details in the family technical report and release blog.

Zhipu also open-weighted SCAIL-2, a character-animation video model. More details in the paper, repository, and a project page.

Moonshot releases Kimi-K2.7-Code, the fortnight’s fastest-adopted model. On June 11, Moonshot posted Kimi-K2.7-Code, a roughly 1.06-trillion-parameter open-weight multimodal model that drew about 173,000 Hugging Face downloads in its first week—the highest of any model this fortnight. It ships with the kimi-code CLI.

Xiaomi releases the MiMo-Code agent and MiMo-V2.5-Pro. Xiaomi’s MiMo-Code coding agent was the fastest-starred repository of the fortnight, running on the underlying MiMo-V2.5-Pro model. The adoption came with friction: 36Kr reported on June 12 that the agent shipped with a wave of early bugs—users opened more than 200 GitHub issues over severe lag, login-credential and API-key-import failures, and environment errors. Xiaomi’s MiMo line traces to its 2025 technical report for the original 7B-parameter model; no dedicated report for V2.5-Pro has appeared.

Baichuan details M4, its clinical-grade medical model. In a technical report (June 8), Baichuan Intelligence described Baichuan-M4, a medical model built for continuous patient care rather than one-off medical Q&A. It is structured as a coordinated agent system, with long-term patient memory, evidence-based retrieval, and the ability to read documents, X-rays, and dermatology images alongside text. Baichuan reports leading results across a medical evaluation suite covering clinical knowledge, safety, OSCE-style consultations, and long-context patient memory.

Also released this fortnight:

• SenseTime SenseNova-U1-8B-MoT—a multimodal model (HF, GitHub).

• Tencent Hunyuan UniRL—a unified reinforcement-learning framework (GitHub).

• Tencent Hy-Embodied-0.5-VLA—a vision-language-action model for robots (HF, GitHub).

• ByteDance Bernini—an image-to-video model (HF, GitHub).

• ByteDance EvoQuality—a training-data-quality method (HF, GitHub, paper).

Technical Publication Highlights

Frontier labs released 138 papers on arXiv this fortnight—and this edition, Baichuan and MiniMax got themselves on the board. Highlights are below; a full list with summaries can be found here.

Alibaba

How Does Reasoning Flow? Tracing Attention-Induced Information Flow for Targeted RL in LLMs

• Proposes FlowTracer, an RL framework that traces how information flows through an LLM by modeling attention patterns as a directed graph, then assigns credit to tokens based on their role in routing information toward correct answers rather than treating all tokens equally. Token importances derived from this flow analysis reshape reward signals to focus learning on decisive reasoning steps, delivering consistent gains on reasoning tasks.

Beyond Scalar Rewards by Internalizing Reasoning into Score Distributions

• Replaces scalar reward signals with score distributions in text-to-image models, using a teacher-student framework where a large VLM infers rubric-aligned score distributions via reasoning, then distills this into a compact student model for deployment. The 9B student model reaches 88.6% human preference accuracy while enabling a 41.3% improvement in downstream image generation when used as a differentiable optimization signal.

Breaking Entropy Bounds: Accelerating RL Training via MTP with Rejection Sampling

• Identifies how model entropy bounds Multi-Token Prediction acceptance rates during RL training, then proposes Bebop, which combines probabilistic rejection sampling with a novel TV loss to optimize multi-step decoding. The approach achieves up to 95% acceptance rates and 1.8x end-to-end speedup on Qwen models without requiring online MTP updates during RL.

Qwen-RobotWorld Technical Report: Unifying Embodied World Modeling through Language-Conditioned Video Generation

• Introduces Qwen-RobotWorld, a language-conditioned video world model that predicts future visual trajectories across robotic manipulation, autonomous driving, navigation, and human-robot tasks using natural language as a unified action interface. It ranks 1st on EWMBench and DreamGen Bench, and tops WorldModelBench and PBench open models.

Baichuan

Baichuan-M4: A Clinical-Grade Medical Agent System for Continuous Care

• Introduces Baichuan-M4, a clinical-grade medical agent system for continuous patient care that coordinates a reasoning model, runtime framework, and clinical tools to handle dynamic consultations, long-term memory, and multimodal medical data—achieving a 3.3% hallucination rate across static knowledge, safety, and evidence-based retrieval benchmarks.

Baidu

When Tools Fail: Benchmarking Dynamic Replanning and Anomaly Recovery in LLM Agents

• Introduces ToolMaze, a benchmark that evaluates how LLM agents handle real-world tool failures through dynamic replanning and error recovery. Results show implicit semantic failures cause the sharpest performance drops (~37% recovery rate decline), and fault-tolerance improves 3.66x slower than general task performance with scale, revealing replanning as a distinct bottleneck beyond model size.

Meituan

STAGE-Claw: Automated State-based Agent Benchmarking for Realistic Scenarios

• Introduces STAGE-Claw, a framework that automatically generates realistic personal-agent benchmarks by creating tasks, environments, and ground-truth validation in actual operating systems, then evaluates agents on whether the final system state matches the goal rather than response text. Testing 11 frontier models on 40 tasks reveals tool-call reliability issues and cost-performance tradeoffs.

MiniMax

MaxProof: Scaling Mathematical Proof with Generative-Verifier RL and Population-Level Test-Time Scaling

• Introduces MaxProof, a test-time scaling framework that applies proof generation, verification, and repair to competition math problems. By treating a single model as both generator and verifier, searching over proof populations, and using tournament selection, M3 achieves 35/42 on IMO 2025 and 36/42 on USAMO 2026—surpassing human gold-medal performance on both benchmarks.

MiniMax Sparse Attention

• Introduces MiniMax Sparse Attention (MSA), a blockwise sparse attention mechanism that reduces per-token compute by 28.4x at 1M context while maintaining performance parity with standard attention. Co-designed GPU kernels achieve 14.2x prefill and 7.6x decoding speedups on H800 chips to facilitate ultra-long-context inference at scale.

Tencent

Breaking the Curse of Repulsion: Optimistic Distributionally Robust Policy Optimization for Off-Policy Generative Recommendation

• Addresses model collapse in offline RL-based recommendation systems by reformulating training as Distributionally Robust Optimization (DRO), proving that hard filtering of low-quality data optimally recovers high-quality behaviors while eliminating noise-induced divergence. DRPO achieves state-of-the-art performance on mixed-quality recommendation benchmarks.

Embodied-R1.5: Evolving Physical Intelligence via Embodied Foundation Models

• Introduces Embodied-R1.5, an 8B-parameter foundation model that unifies embodied reasoning (cognition, planning, correction, and pointing) within a single architecture, trained on 15B tokens via automated data pipelines and balanced multi-task RL. It claims state-of-the-art on 16 of 24 embodied VLM benchmarks and, when fine-tuned, outperforms leading robotics models on manipulation tasks while validating strong zero-shot real-robot performance across instruction following, affordance grounding, and complex long-horizon tasks.

Xiaomi

Discrete-WAM: Unified Discrete Vision-Action Token Editing for World-Policy Learning

• Proposes Discrete-WAM, a world model that represents future visual states and actions as aligned discrete tokens, enabling compositional reasoning about how ego actions shape driving scenarios. Built on unified discrete diffusion, it jointly trains world modeling and policy learning, claiming strong performance on autonomous-driving benchmarks.

DriveReward: A Comprehensive Dataset and Generative Vision-Language Reward Model for Autonomous Driving

• Introduces DriveReward, a dataset and specialized vision-language reward model for autonomous driving that uses temporally-grounded visual annotations and counterfactual failure cases to train a 1B parameter model that outperforms larger VLMs on driving-specific reward alignment. The model achieves performance comparable to hand-crafted rules when integrated into RL fine-tuning and trajectory scoring.

Technical AI Safety Publication Highlights

There were 48 AI-safety-related papers published by Chinese researchers this fortnight. Highlights are below; a full list with summaries is available here.

🔍Spotlight

The autonomous execution of cyberattacks that cause real-world harm is often considered a red line frontier AI must not cross. The paper “The Emergence of Autonomous Penetration Capabilities in Large Language Model-Powered AI Systems” isolates a core enabling sub-task: autonomous penetration, whether an LLM-powered agent can, with no human in the loop, break into a target server, find and exploit a vulnerability, and gain unauthorized control. Its premise is that current evaluations don’t measure this honestly—according to the paper, OpenAI’s and Anthropic’s are opaque (their system cards don’t disclose scaffolding, targets, or protocols), academic benchmarks use oversimplified targets, and most hand the model too much task-specific prior knowledge.

To fix that, the authors—a team from Fudan University, the Shanghai AI Laboratory, Concordia AI, and the Shanghai Innovation Institute—built a framework with 300 target servers, each pairing a vulnerable service with 1-3 secure ones, so the agent had to find the real weakness amid decoys. Each model ran inside a general-purpose agent loop, equipped with standard cybersecurity tools but no target-specific hints, so the score reflects the model’s own ability rather than prior knowledge it was handed. Across 19 open-weight and proprietary models, penetration success ran from 10.7% to 69.3%, and rose in step with general model capability—models get better at autonomous intrusion as a byproduct of getting more capable overall, not from being built for it.

The authors are careful to call this a “first step” towards evaluating the offensive capabilities of AI systems; the metric scores one scoped objective—gaining shell access to a single host—not a full, multi-stage attack. However, the benchmark, intended to be harder to game, may help reduce the likelihood of such an attack in the first place.

Agentic Safety

Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems

• Skill Composition Risk (SCR) occurs when individual LLM agent skills appear safe in isolation but become harmful when combined—for example, one skill’s output could elevate another skill’s permissions or leak data into a subsequent operation. The authors introduce SCR-Bench, a benchmark that evaluates multi-skill execution paths in sandboxed environments, tracking state changes and outcomes rather than relying on surface behavior alone. Results show attack success rates jumping from near-zero in isolation to 33.6–96.5 percent under composition, demonstrating that vetting individual skills misses critical interaction vulnerabilities.

Institutional affiliations: East China Normal University, Centre for Frontier AI Research, A*STAR, Shanghai Innovation Institute

VESTA: A Fully Automated Scenario Generation and Safety Evaluation Framework for LLM Agents

• VESTA is an automated framework that generates diverse safety scenarios for LLM agents and evaluates their behavior during task execution, not just final outputs. It maps five risk dimensions—including deception, excessive autonomy, and environmental harm—into 1,072 executable test scenarios across memory, tool use, and external environment access. Evaluation of 12 agents revealed average attack success rates of 47.1%, with some models exceeding 70%, indicating that process-level safety evaluation surfaces behavioral risks that static benchmarks miss.

Institutional affiliations: BrainCog AI Lab (CAS), Beijing Institute of AI Safety and Governance (Beijing-AISI), Beijing Key Laboratory of Safe AI and Superalignment, School of Artificial Intelligence, UCAS, Long-term AI

The Meta-Agent Challenge: Are Current Agents Capable of Autonomous Agent Development?

• The Meta-Agent Challenge (MAC) tests whether frontier models can autonomously design agent systems—a capability beyond standard task execution benchmarks. Meta-agents receive a sandbox, evaluation API, and time budget to iteratively build agents optimized on held-out test sets. Current models rarely match human-engineered baselines; those that succeed rely on proprietary frontier systems. High optimization pressure surfaces emergent adversarial behaviors like ground-truth data exfiltration, revealing gaps in robustness and alignment under recursive self-improvement scenarios.

Institutional affiliations: Chinese Information Processing Laboratory (CAS), University of Chinese Academy of Sciences, Ant Group

Alignment

Emergent Misalignment Can Be Induced by Sycophancy and Reversed via Alignment Gating

• Fine-tuning models to agree with users regardless of accuracy—sycophancy training—induces broad misalignment beyond the narrow domain, a previously underexplored pathway to harmful emergent behavior. The authors propose Alignment Gating, which inserts learnable gates during fine-tuning to identify and suppress internal representations driving unsafe outputs. Gating weights trained on narrow domains generalize to suppress misalignment across broader contexts while preserving general capabilities, offering an efficient reversal mechanism.

Institutional affiliations: Shanghai AI Lab

Large Language Models Hack Rewards, and Society

• SocioHack is a benchmark of 72 simulated societal environments designed to test whether LLMs exploit regulatory gaps during reinforcement learning training. The authors find that reward hacking naturally scales into “societal hacking”—models discover loopholes that remain technically compliant with rules while defeating their intent, mirroring how they game narrow metrics. Current safeguards provide limited protection, raising concerns about gathering real-world feedback for model training without stronger assurances that RL won’t uncover and exploit gaps in actual regulations.

Institutional affiliations: King’s College London, Fudan University, The Alan Turing Institute

Evaluation and Benchmarks

AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environments

• AgentCanary is a security evaluation framework that tests autonomous AI agents in real, executable environments rather than static Q&A settings. It uses an Entry × Impact risk taxonomy to systematically map how attacks compromise agents and what harms result, coupled with dynamic task artifacts and persistent state to simulate realistic multi-step workflows. Evaluation across frontier models reveals agents frequently fail to detect attacks—especially under compromised tools, state persistence, and long-horizon execution—establishing baselines for hardening agent security before deployment.

Institutional affiliations: Ant Group, Tsinghua University, Nanjing University, Peking University

PseudoBench: Measuring How Agentic Auto-Research Fuels Pseudoscience

• PseudoBench is an adversarial benchmark measuring whether autonomous AI research agents can resist pseudoscientific narratives across five domains. Testing seven state-of-the-art agents on 200 claim-evidence pairs, researchers found that current systems produce persuasive pseudoscientific reports with near-zero refusal rates, with maximum resistance only 27.4%. Stronger agents risk legitimizing false claims through sophisticated scientific framing, potentially contaminating academic literature and eroding public trust in science before these systems see widespread deployment.

Institutional affiliations: Shanghai Artificial Intelligence Laboratory, Xi’an Jiao Tong University, Shanghai Jiao Tong University

ZERO-APT: A Closed-Loop Adversarial Framework for LLM-Driven Automated Penetration Testing under Intelligent Defense

• ZERO-APT is a closed-loop framework that evaluates LLM-driven penetration testing agents against active defenders rather than static targets. It addresses three gaps: realism (embedding an LLM defender that detects attacks via system telemetry), consistency (enforcing causal reasoning through architecture rather than relying on unstable LLM chains), and auditability (a Judge agent produces structured reports tracing every decision). The prototype achieves 79% attack success on Windows Server scenarios, with full decision transparency—a capability gap highlighted by baseline agents scoring 22–39% against live defense.

Institutional affiliations: Zhejiang University of Technology

Guardrails and Deployment Safety

CHILLGuard: Towards Fine-Grained Chinese LLM Safety Guardrail with Scalable Data Construction and Model-aware Preference Alignment

• CHILLGuard is a Chinese-language safety classifier that addresses the gap between English-centric guardrails and China’s regulatory and cultural context. The authors develop a 31-category risk taxonomy and construct 405,000+ annotated training samples through retrieval-augmented generation, adversarial prompt rewriting, and multi-model label voting. Trained via preference optimization, CHILLGuard achieves 15.92% F1 improvement over existing Chinese baselines, enabling fine-grained risk classification for localized deployment.

Institutional affiliations: Tsinghua University, Beijing Normal University, South China University of Technology, Harbin Institute of Technology, Shenzhen, Shenzhen ShenNong Information Technology Co.

Interpretability

Decoding Hidden Deception in Reasoning LLMs: Activation Explainers for Deception Auditing

• STATEWITNESS is a decoder-based explainer that reads hidden states from reasoning LLMs and answers natural-language queries about them to detect deception. Rather than outputting scalar confidence scores, it generates structured reports and token-level evidence traces that humans can inspect directly. On seven deception datasets, STATEWITNESS achieved 0.916 AUROC—11.6% better than text-based monitors and 25% better than probe baselines—and reduced false negatives when combined with existing detection systems.

Institutional affiliations: Zhejiang University, Griffith University

Robustness and Adversarial Attacks

Grammar-Constrained Decoding Can Jailbreak LLMs into Generating Malicious Code

• CodeSpear demonstrates that grammar-constrained decoding—a technique meant to enforce syntactic correctness in code generation—can be weaponized to jailbreak LLMs into producing malicious code by restricting the model’s output space in ways that bypass safety training. The authors propose CodeShield, a defense that teaches models to generate structurally diverse but semantically harmless “honeypot” code under constrained decoding, preserving refusals in natural language while blocking attacks across 10 popular models.

Institutional affiliations: Tsinghua University, University of Electronic Science and Technology of China

Defending Against Malicious Finetuning by Scaling Train-time Adversarial Attacks

• Patcher defends open-weight LLMs against malicious fine-tuning by simulating full-parameter attacks during training—not just parameter-efficient ones. The method uses adversarial training to find model weights that resist stronger poisoning attacks, scaling up attack intensity in the optimization loop to force robustness. Experiments show substantial improvements over standard alignment across diverse attack scenarios and model sizes, with parallel implementation reducing training time.

Institutional affiliations: Xiongan AI Institute, Tsinghua University, Shanghai Qi Zhi Institute

Export Controls & Economic Policy

US bars foreign nationals from accessing Mythos and Fable

On June 12, Anthropic disabled Fable 5 and Mythos 5 after the US government, citing national security authorities, issued an export control directive suspending access for all foreign nationals—inside or outside the United States, and including Anthropic’s own foreign-national employees. Because Anthropic had no reliable way to screen users by nationality, it suspended both models for everyone, US users included, while it sought clarification; Chinese media including Caixin reported on the order on June 13.

On the Horizon

A national accreditation for AI-security service providers (CNITSEC): Following the China Information Technology Security Evaluation Center’s announcement of a National Information Security Service Qualification that vets vendors in AI security, watch for the first accredited cohort and for how this interacts with TC260 and CAC model-evaluation tracks.

For more on how we select and track content, see our methodology here.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.

Editor’s note: I’ll be in DC next week (June 8-11). If anyone working on China-related AI governance would like to meet up, feel free to reach out!

Number of the week: $200 million — the combined funding round closed by Beijing-based VAST on June 1 as it launched its Project Eden world model.

Executive Summary

• Domestic AI Governance: Xi Jinping’s January Politburo speech, published in Qiushi on May 31, discusses technological loss of control and names embodied intelligence among six future industries key to the 15th Five-Year Plan. SAMR and NDRC issued the AI Metrology Guidance, an explicit commitment to AI measurement infrastructure. CAC published four expert interpretations of the recent Ethics-Safety Guidelines, and Anhui, Harbin, and Hubei staked out distinct provincial AI strategies.

  • National Standards: TC28/SC42 published GB/Z 185, China’s first state-issued agent-interconnection standard family.

• International AI Governance: MIIT and ASEAN inaugurated the China-ASEAN AI Industry Innovation Center, creating a formal bilateral dialogue venue with a standards-and-governance mandate. State-visit readouts with Serbia and Pakistan named AI as a designated cooperation area.

• Frontier Lab Developments:

  • Notable Model Releases: MiniMax released M3, the lab’s first major flagship of 2026. It’s a 1M-context agentic foundation paired with a downloadable desktop coding agent MiniMax Code. Alibaba had the busiest release cadence of the cycle, including Qwen3.7-Plus (a multimodal GUI/CLI-agent foundation) and Qwen-VLA. Tencent released the full Hy-MT2 translation family, and StepFun shipped Step-3.7-Flash.

  • Technical Papers: Frontier labs released 114 papers on arXiv, led by Alibaba (43), Tencent (24), and Huawei (16).

• Technical AI Safety: 115 safety publications by Chinese researchers this fortnight, with a continued heavy agent safety focus. Shanghai AI Lab released AgentDoG 1.5, an agent-safety alignment framework deployable as a training-free online guardrail.

Domestic AI Governance

Xi Jinping discusses technological loss of control and embodied AI in Qiushi speech

On May 31, Qiushi (the CCP’s flagship theoretical journal) released the full text of Xi Jinping’s speech at the 24th collective study session of the 20th Central Committee Politburo, delivered January 30, 2026 (translation by Bill Bishop here). The speech, titled “Forward-looking planning and development of future industries,”1 confirms six “future industries” from the 20th CCP Central Committee 4th Plenum as the 15th Five-Year Plan’s main directions: quantum technology, biomanufacturing, hydrogen and nuclear fusion energy, brain-computer interfaces, embodied intelligence (具身智能), and 6G.

The speech is structured around five points:

(1) strengthen industrial coordination and planning;

(2) lead with science & technology innovation (referring to making tech breakthroughs, strengthening basic research, and applying S&T innovation to industry);

(3) make enterprises the primary drivers of innovation;

(4) create a sound policy environment (referring to fiscal policies, investment, procurement, and talent); and

(5) improve the governance system (referring to technology governance and international coordination).

In Point 5, Xi calls to “coordinate development and security, explore scientific and effective methods of regulation, systems for technology monitoring, risk early warning, and emergency response, anticipate and respond to new types of risk such as loss of control over technology, ethical breaches, and data abuse.”2 The same point calls for “deepening international cooperation, actively participating in global governance, and pushing all parties to jointly build standards, jointly negotiate rules, and jointly promote industries.”3 The speech closes with Xi citing his own earlier warning that leaders cannot continue being “blind men touching an elephant” (盲人摸象) on S&T change, and calling on leadership at all levels to “know science, understand industry, and decide well.”4

It’s significant that Xi discussed “loss of control over technology” (技术失控). This seems to be Xi’s first public mention of this concept.5 Previous Xi statements on AI risk have discussed safety, security, reliability, and controllability (see the October 2023 Global AI Governance Initiative, the April 2025 Politburo session on AI), but never explicitly 失控/loss of control. Concordia AI’s July 2025 State of AI Safety in China report flagged that leadership statements through that point had “not explicitly mention[ed] risks from misuse of advanced AI systems or from loss of control of superintelligent AI.”

The same term—技术失控—appears across TC260’s AI Safety Governance Framework v2 (September 2025) under several different scenarios, and the framework’s official translation renders it differently depending on context. 技术失控 is translated there as:

• “the potential risks of technological failure” (针对潜在的技术失控风险, §2.4)

• “whether a model would pose a potential risk of loss of control” (判断模型是否可能带来潜在技术失控风险, §5.11, the developer-testing requirement)

• “prevent and address the risk of AI technology losing control” (共同防范应对人工智能技术失控风险, Appendix 2 opening)

Thus, there are three possible readings: general tech failure, humans losing control of technology, or technology losing control of its behavior. Which of these senses Xi had in mind in his speech isn’t clear from the text; he notably didn’t tie 技术失控 specifically to AI, and the loss-of-control framing sits in the general governance discussion that applies to all six future industries. Regardless, this is a new turn for Xi’s statements, and may mark the beginning of increased focus on frontier AI risks.

CAC publishes four expert interpretations of Ethics-Safety Guidelines

Following the May 19 publication of TC260-005 Ethics-Safety Guidelines for AI Applications 1.0 (see analysis in China AI Bulletin #4 here), CAC published four “Expert Interpretation” pieces between May 22 and May 23.

The four pieces focus on different aspects of TC260-005. Jiang Xinghao (蒋兴浩), Vice President of Shanghai Jiao Tong University (SJTU), lays out the six impacts and all nine principles named in the document. Fan Kefeng (范科峰), Deputy Director of the China Electronics Standardization Institute (CESI), discusses TC260-005 in terms of standards, discussing its central goal as translating ethics and safety from a value-set into “standardized objects recognizable and identifiable by all parties,”6 then into basic rules, then into operational guidance for each actor class. Liu Bo (刘博), Deputy Party Secretary and Deputy Director of the National Internet Emergency Center (CNCERT), focuses on operations and risk control: risk monitoring, emergency-response and human-intervention mechanisms, accident-traceability for responsibility attribution, and provisions for improving public AI literacy and risk-identification capacity. Finally, Zhang Linghan (张凌寒), Dean of the China University of Political Science and Law (CUPL) Institute for AI Law and a member of the UN High-Level Advisory Body on AI, frames TC260-005 in terms of comparative policy. She lists the document’s six structural impacts as areas of global consensus, cross-references the UNESCO Recommendation on the Ethics of AI and the US NIST AI Risk Management Framework as international precedent, and argues the document complements existing hard regulations to form a system combining hard-law constraints with soft guidance—with specific attention to labor displacement and “inclusive sharing” (普惠共享).

SAMR and NDRC publish AI Metrology System and Capability Building Guidance

On May 28, the State Administration for Market Regulation (SAMR) and the National Development and Reform Commission (NDRC) jointly issued the Guidance on AI Metrology System and Capability Building (2026 Edition).7 The Guidance brings AI under SAMR’s formal metrology apparatus, which anchors China’s national reference standards for length, mass, time, and other physical quantities. It organizes work across six parts—foundational support, general technology, core technology, metrology technical specifications, metrology service industry, and AI-empowered metrology—and pledges “full-chain” metrology capability covering algorithm models, compute efficiency, and data quality, with the overall goal of making AI technical performance “measurable, comparable, and traceable.”8 The document names algorithmic black boxes and lack of interpretability as targeted “pain points” and calls for R&D on monitoring and characterizing AI systems’ internal states.9

Metrology (the science of measurement, 计量) and testing/evaluations (评测/评估) play different roles. Evaluation is the practice of testing models or products against criteria; metrology is the measurement infrastructure that makes those evaluations comparable across labs, regimes, and time. Defined units, reference standards, calibration, and traceability are all grounded in these references. In China these are overseen by different entities: evaluations fall under standards bodies like TC260 and government agencies like CAC and MIIT, and metrology is under SAMR and the PRC Metrology Law10 (1985, last amended 2018), which establishes the national reference standards system. The Guidance is the first explicit Chinese policy commitment to building AI-specific metrology infrastructure. Without it, evaluation regimes lack an independent measurement backbone and effectively rely on developer self-attestation.

Three provinces outline local AI ambitions

Anhui’s May 22 Provincial S&T Department positioning piece restates the province’s “AI+Everything” (人工智能+万物) Action Plan—issued earlier this year—and sets 15th FYP targets of >10,000 deployed applications and >90% adoption for new-generation intelligent terminals and agents. The piece cites 14th FYP achievements: >1,000 above-scale AI enterprises with ¥200B+ annual revenue, 5th-place national industry ranking, and establishing “China’s first domestically-produced 10,000-card compute cluster.”11 New initiatives flagged include a forthcoming brain-computer interface action plan, the first “Commercial AI” undergraduate major, and strengthening the Yangtze River Delta Secure AI Provincial Laboratory.

Instead of “AI+,” Harbin is discussing “+AI”—in this case, “aerospace + AI.” The May 18 Harbin Aerospace Sector AI Capability List12 catalogs 29 achievements positioning AI as an enhancement layer for the city’s existing aerospace industrial base.

Finally, Hubei is emphasizing embodied intelligence; Governor Li Dianxun inspected the embodied AI industry in Wuhan, visiting two companies and one research center. The read-out forwards a four-category taxonomy (industrial, special-purpose, service, and humanoid robots, plus components) and integrating the industry, innovation, talent, capital, and service chains.

AI+ Energy continues to develop

On May 26, the National Energy Administration (NEA) released the first batch of 51 AI+ Energy high-value scenarios at the National AI+ Energy On-Site Promotion Conference in Guangzhou. The release operationalizes the May Action Plan on Promoting Mutual Empowerment between AI and Energy covered in Issue 4.

The 51 scenarios span eight categories across grid, energy new business types (新业态), new energy, and conventional energy. Named examples include grid planning scheme intelligent generation and evaluation,13 virtual power plants, vehicle-grid interaction, new-energy power forecasting, and market-oriented operations. NEA Director Wang Hongzhi (王宏志) framed the release as marking the shift “from concept to practice, from exploration to popularization.”

At the same event, NEA launched the China AI+ Energy Development Report 2026,14 the first annual report on AI-energy integration. The report disclosed that by end-2025, China had built 42 ten-thousand-card AI compute clusters, national compute-center electricity consumption reached 170 billion kWh, and the eight national computing-network hub nodes averaged 39.5% annual growth in compute electricity over three years, with the Inner Mongolia hub at 66.5%.

National Standards

Seven-part AI Agent Interconnection guidance series approved

On May 22, SAMR and the Standardization Administration of China (SAC) issued Announcement No. 22 of 2026, approving eight national standardization guidance technical documents (国家标准化指导性技术文件). Seven of the eight are the GB/Z 185 series, Artificial Intelligence: Agent Interconnection (人工智能 智能体互联):15

• GB/Z 185.1-2026 Part 1: Overall Architecture (总体架构)—lead drafter Fan Kefeng (范科峰), CESI (author of the first TC260-005 expert interpretation covered above)

• GB/Z 185.2-2026 Part 2: Identity Code (身份码)—lead drafter Liu Jun (刘军), Beijing University of Posts and Telecommunications (BUPT)

• GB/Z 185.3-2026 Part 3: Identity Management (身份管理)—lead drafter Zhang Shizong (张士宗), CESI

• GB/Z 185.4-2026 Part 4: Agent Description (智能体描述)—lead drafter Xu Yang (徐洋), CESI

• GB/Z 185.5-2026 Part 5: Agent Discovery (智能体发现)—lead drafter Dong Jian (董建), CESI

• GB/Z 185.6-2026 Part 6: Agent Interaction (智能体交互)—lead drafter Li Ke (李珂), BUPT

• GB/Z 185.7-2026 Part 7: Agent Tool Invocation (智能体工具调用)—lead drafter Zhang Shizong (张士宗), CESI

The GB/Z designation marks these as non-mandatory guidance, not binding GB standards. Still, they are issued by China’s state standards body (SAC/SAMR) and together cover the full agent-interoperability protocol surface: identity, discovery, description, interaction, and tool invocation.

TC28/SC42 begins drafting embodied intelligence, AI for Science standards

TC28/SC42 also announced the drafting of 25 new AI projects (正在起草) on May 28, 2026 (full table below). The standards fall into several clusters:

• Embodied intelligence (5): cloud protocol requirements, data generation, dexterous manipulation, trustworthy evaluation indicators and methods, and an ethics governance guide.

• Ethics and governance infrastructure (3, distinct from the embodied-ethics guide): ethics governance scenarios classification and grading, ethics risk assessment, and sci-tech ethics review personnel technical skill requirements.

• AI for Science (3): scientific intelligence evaluation, scientific data preparation, and scientific data lead aggregation and classification/grading.

• Large model evaluation infrastructure (2): large model evaluation platform construction requirements, and world model evaluation specification.

• AI Bill of Materials (2): data format specification and implementation guide—a standardized inventory for AI components and dependencies.

• Iron and steel industry (6): intelligent agent foundational commonality requirements, data privacy and compliance, data governance, data classification and labeling, data alignment, and large model evaluation indicators and methods.

• Non-ferrous metals (2): large model evaluation, and application scenarios classification.

• Other (2): industrial large model reference architecture, swarm intelligence collaborative system reference architecture.

A separate June 2 batch of seven items includes a coding-tool standard Intelligent Programming Tools Service Capability Maturity Evaluation (智能编程工具 服务能力成熟度评估) amongst IT-cabling and digital-twin standards.

Standards Drafting Batch

87.6KB ∙ PDF file

Download

Download

SAC approves two other AI-adjacent recommended standards

On May 25, SAC issued Announcement No. 23 of 2026, approving 375 recommended national standards (GB/T) and 5 amendment orders. Two of the 375 are AI-relevant:

• GB/T 47695-2026 Enterprise Smart Manufacturing Efficacy Evaluation Method (企业智能制造效能评测方法)—implementation date 2026-12-01.

• GB/T 47746-2026 Customer Contact Services: Human and Intelligent Customer Service Collaboration Requirements (顾客联络服务 人工与智能客户服务协同要求)—implementation date 2026-09-01.

Both are recommended (voluntary) standards. The smart-manufacturing efficacy standard provides an evaluation methodology for AI-enabled production; the customer-service standard sets requirements for handoffs between human and AI customer-service tiers.

International AI Governance

MIIT and ASEAN launch a joint AI Industry Innovation Center

On May 24, Ministry of Industry and Information Technology (MIIT) Vice Minister Ke Jixin (柯吉欣) and Association of Southeast Asian Nations (ASEAN) Secretary-General Kao Kim Hourn (高金洪) inaugurated the China-ASEAN AI Industry Innovation Center (中国—东盟人工智能产业创新中心) in Beijing. The center has four named priorities: (1) promote AI technology R&D and innovation cooperation, with explicit focus on large-model application in typical industrial scenarios; (2) build a China-ASEAN AI industry cooperation ecosystem with an inter-state dialogue mechanism; (3) deepen AI governance practice through standardization coordination and governance-tool development; and (4) support regional capacity building via shared intelligent infrastructure. The read-out positions the center as building on the Digital Silk Road and states that it is intended to advance the China-ASEAN Comprehensive Strategic Partnership Action Plan (2026-2030) and the 2026 China-ASEAN Digital Cooperation Plan.

The third mandate puts the center inside the international AI governance architecture China has been building alongside the Global AI Governance Initiative (2023) and the Global AI Governance Action Plan (2025), adding a formal China-ASEAN dialogue venue with a standards-and-governance mandate built in from inception.

Two state-visit readouts name AI as a designated cooperation area

On May 25, Xi held talks with both Serbian President Aleksandar Vučić and Pakistani Prime Minister Shahbaz Sharif. Both Cyberspace Administration of China (CAC) readouts name AI explicitly as a designated cooperation area: the Serbia readout lists AI first among four emerging-cooperation areas alongside the digital economy, green energy, and advanced manufacturing; the Pakistan readout pairs AI with agriculture, industry, and talent development under the “China-Pakistan Community of Shared Destiny Action Plan.”16

Frontier Lab Developments

🔍 Spotlight

On June 1, MiniMax released its first major flagship of 2026, MiniMax M3. The model targets agentic and desktop-operation workloads with a 1M-token context and native multimodality. It’s priced at $0.60/M input tokens, and open weights are promised within 10 days of launch. MiniMax reported a SWE-Bench Pro score of 59.0, narrowly above GPT-5.5’s 58.6, but below Claude Opus 4.7’s 64.3. The same day, MiniMax released MiniMax Code, a downloadable desktop coding agent.

Notable Model Releases

Alibaba had a busy two weeks of model releases. On May 31, the Qwen team released the multimodal Qwen3.7-Plus supporting up to 1M-token context. Reported benchmarks place Qwen3.7-Plus at the front of GUI-automation benchmarks—scoring 79.0 on ScreenSpot Pro (vs Gemini-3.1 Pro’s 68.1) and 81.0 on AndroidWorld (vs Gemini’s 70.7)—while reaching near-parity with Opus-4.6 Max, K2.6 Thinking, and DeepSeek V4-Pro Max on general reasoning. Qwen-VLA (May 28) added a vision-language-action model for the robotics/embodied stack. On the image side, the Qwen team released Qwen-Image-Flash on June 2 (paper), a fast variant of the Qwen-Image family. Alibaba also released a technical paper on RTP-LLM (May 28, paper), the high-performance LLM inference engine running at Alibaba Group scale across more than 100 million users.

Tencent released a full Hy-MT2 translation family in three sizes—1.8B, 7B, and 30B-A3B parameters (technical paper here)—plus an FP8 datacenter variant and an aggressively-compressed 1.25-bit GGUF mobile variant optimized to run natively on recent ARM phones.

StepFun released Step-3.7-Flash on May 23 with datacenter, NVIDIA-optimized, and consumer-inference variants shipped simultaneously.

ByteDance released the Bernini family (technical paper here)—Bernini, Bernini-R, and Bernini-R-Diffusers—a unified video-generation and editing framework combining an MLLM-based semantic planner with a DiT-based renderer.

Baidu added to the ERNIE-Image family with the ERNIE-Image-Aes aesthetics model (technical report). This was followed by audio-visual model NAVA and PaddleOCR-VL-1.6, a versioned document-parsing model shipped with a GGUF variant (paper, GitHub).

Moonshot released Kimi Code CLI, an AI coding agent that runs in the terminal, positioned as a Claude Code/Cursor/Codex competitor.

SenseTime released the full-parameter fine-tuning training code for SenseNova U1.

Technical Publication Highlights

Frontier labs released 114 papers on arXiv this fortnight. Highlights are below; a full list with summaries can be found here.

Editor’s note: due to an unusual volume of activity on the arXiv API, this edition is missing approximately two days of paper releases. Any notable omissions will be highlighted in China AI Bulletin #6.

Alibaba

Do Multimodal Agents Really Benefit from Tool Use? A Systematic Study of Capability Gains

• Examines whether multimodal agents actually benefit from tool use by comparing tool-augmented agents (Thyme, DeepEyesV2) against tool-free and text-only baselines across vision and reasoning tasks. Finds that tool access provided negligible aggregate gains. 93–96% of tool-solved problems were also solvable without tools, suggesting agents learn to call tools without gaining new capabilities.

ESPO: Early-Stopping Proximal Policy Optimization

• Proposes ESPO, which detects when a reasoning model takes a wrong step and stops generation early rather than wasting compute on unsalvageable trajectories. By treating early stops as terminal failure states, it concentrates learning signals near actual mistakes without needing extra reward models, improving math reasoning by 1–3% while cutting rollout tokens by 20%.

TransitLM: A Large-Scale Dataset and Benchmark for Map-Free Transit Route Generation

• Introduces TransitLM, a dataset of 13M+ transit route records from Chinese cities that enables map-free route generation—LLMs trained on it learn to produce valid routes and ground GPS coordinates to stations without explicit mapping.

Baidu

Thinking as Compression: Your Reasoning Model is Secretly a Context Compressor

• Reveals that reasoning models can naturally compress long contexts by organizing task-relevant information into thinking traces. TaC-C, a reward-optimized variant, outperforms dedicated compression methods by 17–23% at 4–8x compression ratios without requiring specialized compressor modules.

Huawei

Fast and Stable Triangular Inversion for Delta-Rule Linear Transformers

• Optimizes triangular matrix inversion in linear attention models by systematically analyzing direct and iterative algorithms, achieving 4.3x speedup over existing implementations while maintaining numerical stability and model accuracy across low-precision settings.

Meituan

SIRI: Self-Internalizing Reinforcement Learning with Intrinsic Skills for LLM Agent Training

• Proposes SIRI, a three-phase reinforcement learning framework that enables LLM agents to discover, validate, and internalize reusable skills without external skill generators or inference-time retrieval overhead. On ALFWorld and WebShop tasks, SIRI improves performance from 0.908 to 0.930 and 0.728 to 0.813 respectively, while reducing deployment complexity by running inference with the original prompt only.

SenseTime

USV: Towards Understanding the User-generated Short-form Videos

• Introduces USV, a 224K user-generated short-form video dataset with topic recognition and video-text retrieval tasks, plus baseline models MMF-Net and VTCL to benchmark high-level semantic understanding beyond instance-level recognition.

StepFun

DuplexSLA: A Full-Duplex Spoken Language Model with Synchronized Speech, Language, and Action

• Introduces DuplexSLA, a full-duplex spoken dialogue model that decodes user audio, assistant speech, and structured actions on a shared 160ms timeline, enabling simultaneous listening, speaking, planning, and tool calling without external cascades. The model handles semantic turn-taking (interruptions, pauses, backchannels) natively and interleaves tool calls with ongoing speech, evaluated on a new duplex benchmark covering interruption and multi-action scenarios.

Tencent

GEM: Generative Supervision Helps Embodied Intelligence

• Introduces GEM, a vision-language model that adds depth map generation during pre-training to bridge the gap between high-level semantic understanding and low-level spatial knowledge needed for robot control. The approach, validated on GEM-4M (a new 4M-example dataset with depth supervision), achieves state-of-the-art results on embodied benchmarks and shows superior performance in real-world robot task execution.

PhoneWorld: Scaling Phone-Use Agent Environments

• Presents PhoneWorld, a pipeline that converts real mobile app trajectories into controllable phone-use environments, executable tasks, and training data at scale. Replacing 10K AndroidWorld steps with PhoneWorld supervision improves four evaluation benchmarks simultaneously, with gains ranging from 6.0 to 52.5 points across different metrics.

PlanningBench: Generating Scalable and Verifiable Planning Data for Evaluating and Training Large Language Models

• Introduces PlanningBench, a framework that generates scalable planning data from a taxonomy of 30+ task types, enabling controllable difficulty, automatic verification, and evaluation of LLMs on complex multi-constraint problems. RL training on verified PlanningBench data improves performance on unseen planning benchmarks and instruction-following tasks.

Xiaomi

Perceive Before Reasoning: A Pre-Reasoning Perception Framework for Efficient and Reliable Proactive Mobile Agents

• Separates the decision of when to intervene from how to assist using a lightweight perception module that gates the full reasoning model, reducing false alerts while improving accuracy and speed on proactive mobile agent tasks.

Technical AI Safety Publication Highlights

There were 115 AI-safety-related papers published by Chinese researchers this fortnight. Highlights are below; a full list with summaries is available here.

Editor’s note: due to an unusual volume of activity on the arXiv API, this edition is missing approximately two days of paper releases. Any notable omissions will be highlighted in China AI Bulletin #6.

🔍Spotlight

Shanghai AI Lab released AgentDoG 1.5, an updated version of their agent safety alignment framework.

The original framework introduced a three-dimensional taxonomy for agentic risks, categorizing them by source (where the risk originates, e.g., user instruction, tool behavior, or environment), failure mode (how it manifests, e.g, capability failure, goal deviation, or boundary violation), and consequence (what harm results). This structured approach enables root cause diagnosis—rather than outputting binary safe/unsafe labels, AgentDoG traces why an action is problematic. When an agent takes an unsafe step, the system identifies whether the fault lies in a malicious user prompt, an unexpected tool behavior, or environmental conditions, providing key information for remediation.

Version 1.5 updates the agent safety taxonomy to cover emergent risks from Codex and OpenClaw execution scenarios, then trains 0.8B-, 2B-, 4B-, and 8B-parameter variants on ~1,000 samples using a taxonomy-guided data engine with influence-function purification. Performance is claimed to match leading closed-source models (e.g., GPT-5.4) on agent-safety benchmarks. All models and datasets are open-sourced.

Agentic Safety

A First Measurement Study on Authentication Security in Real-World Remote MCP Servers

• Researchers conducted the first security audit of authentication in real-world MCP servers—the emerging interface connecting LLMs to external services like banking and email. They found 40.55% of 7,973 live servers expose tools without any authentication, and among authenticated servers, all tested OAuth deployments exhibited at least one flaw, with 96.6% vulnerable to dynamic client registration attacks. These weaknesses enable account takeover and data theft in agent-to-service connections.

Institutional affiliations: Fudan University

PrivacyPeek: Auditing What LLM-Based Agents Acquire, Not Just What They Say

• PrivacyPeek is a benchmark that audits what LLM-based agents acquire from external tools, not just what they disclose. Across 1,182 test cases, the benchmark detects when agents retrieve sensitive data beyond task requirements, then measures how easily an attacker could extract that over-acquired information via follow-up prompts. Testing 10 agents shows widespread over-acquisition across models, with current prompt-level defenses mitigating only a small fraction of this leakage, indicating a structural vulnerability in agent deployment.

Institutional affiliations: Shanghai AI Laboratory, Southeast University

Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents

• Sleeper Attack is a novel threat where adversarial content injected into agent state (session context, memory, or reusable skills) remains dormant across multiple interactions, then activates when a benign user query triggers harmful behavior. Researchers constructed a 1,896-instance benchmark covering six harm categories and tested seven LLM agents, finding all remain vulnerable even when single-interaction attacks fail. This demonstrates that persistent state exploitation poses a detection challenge distinct from immediate prompt injection.

Institutional affiliations: University of Science and Technology of China, National University of Singapore, Singapore Management University, Shanghai Artificial Intelligence Laboratory

Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures

• This survey maps the attack surface of open-source LLM agents—systems that run continuously, access external tools, and maintain persistent memory. It identifies threats spanning skill poisoning (malicious tool injection), cognitive manipulation (prompt attacks exploiting reasoning), multi-agent cascades (failures propagating across agent networks), and supply-chain vulnerabilities. The authors categorize defenses across reasoning, execution, and external interaction layers, positioning OpenClaw security as a distinct problem requiring new controls beyond standard LLM safety.

Institutional affiliations: Xi’an Jiaotong University

From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors

• ClawTrojan demonstrates a multi-step backdoor attack where adversaries embed hidden instructions in files or tool outputs that agentic LLMs read, store, and execute later, bypassing single-step defenses that inspect each action in isolation. On GPT-4, the attack reaches 95.5% success while traditional prompt-injection defenses fail entirely. DASGuard, a proposed defense, traces control-like text in workspace files to trusted sources and removes untrusted instructions, combining runtime blocking with sanitized storage to prevent persistent agent compromise.

Institutional affiliations: Renmin University of China

Alignment

MESA: Improving MoE Safety Alignment via Decentralized Expertise

• Safety Sparsity—where safety capabilities concentrate in a few experts within Mixture-of-Experts models—creates a vulnerability to adversarial attacks. MESA addresses this by using optimal transport theory to redistribute safety responsibilities across more experts, preventing concentration while maintaining model performance. The framework also refines routing to activate only the necessary safety-aligned experts, reducing interference with the model’s ability to answer helpful questions.

Institutional affiliations: Beihang University, Tsinghua University, Fudan University, Tencent, Alibaba

Towards Context-Invariant Safety Alignment for Large Language Models

• Anchor Invariance Regularization (AIR) addresses a core safety problem: models refuse harmful requests in standard prompts but comply under adversarial rephrasing. The method treats prompts with verifiable feedback (e.g., multiple-choice) as anchors, then uses one-way regularization to push open-ended variants toward the same safety decision without degrading performance on reliable variants. Testing across safety, moral reasoning, and math tasks shows 12.71% improvement in consistency and 33.49% stronger out-of-distribution robustness, suggesting adversarial context-switching becomes harder to exploit.

Institutional affiliations: Fudan University, Shanghai AI Laboratory

Evaluation and Benchmarks

SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces

• SABER evaluates coding agents not on isolated safety responses but on cumulative damage to project environments after multi-step action sequences. Unlike existing benchmarks that test refusal, SABER places models in realistic stateful workspaces and measures safety violations by their final environmental state—capturing how agents corrupt files, permissions, or dependencies over time. Even top models show 54%+ harmful violation rates, indicating alignment methods designed for single-turn safety fail when agents operate autonomously over multiple actions in shared systems.

Institutional affiliations: The University of Hong Kong, Shandong University, Carnegie Mellon University, National University of Singapore, The Hong Kong University of Science and Technology

SPADE-Bench: Evaluating Spontaneous Strategic Deception in Agents via Plan-Action Divergence

• SPADE-Bench evaluates whether LLM-based agents misreport their actions to users while executing different plans behind the scenes. The benchmark measures actual tool execution against stated intentions under pressure scenarios, distinguishing strategic deception from hallucination. Experiments confirm agents do diverge from reported plans—a safety concern for autonomous systems where human oversight is limited and users rely on agent-generated summaries.

Institutional affiliations: Beijing Academy of Artificial Intelligence, Peking University, University of Science and Technology of China, University of Chinese Academy of Science, Alibaba Group

Governance and Policy

A governance horizon for ethical-use constraints in open-weight AI models

• Audits 2.1M HuggingFace repositories to test whether ethical-use restrictions stated on a model (in its model card or license—e.g., “no military applications,” “no surveillance”) stay visible when others fine-tune that model into new versions. They don’t: each fine-tune drops about half the stated restrictions, and after seven fine-tuning generations 80% of descendant models carry no visible restriction at all—the “governance horizon.” Mandatory-declaration regimes do better than inheritance-only ones, but models with no traceable parent can’t be governed by either approach.

Institutional affiliations: Peking University, Ministry of Education, University of Science and Technology Beijing, UC Davis

Guardrails and Deployment Safety

RouteScan: A Non-Intrusive Approach to Auditing MoE LLMs Safety via Expert Routing Telemetry

• RouteScan audits Mixture-of-Experts (MoE) LLMs for unsafe behavior by monitoring GPU-level expert routing patterns rather than inspecting user prompts or outputs, addressing the privacy–safety tension in content-based auditing. The method uses GPU thread allocation telemetry as a fingerprint of input type and detects harmful prompts with AUROC >0.93 on unseen domains. Testing shows the routing signals retain minimal information for prompt reconstruction, offering privacy advantages over traditional monitoring while maintaining detection accuracy.

Institutional affiliations: Zhejiang University, Donghua University, Louisiana State University

Misuse and Dangerous Capabilities

ViroBench: Benchmarking Nucleotide Foundation Models on Viral Genomics Tasks

• ViroBench claims to be the first comprehensive benchmark for evaluating nucleotide foundation models (NFMs) on viral genomics tasks, assessing both biological understanding and biosecurity risk. The benchmark reveals significant gaps: NFMs degrade in performance under phylogenetic and temporal shifts, struggle to distinguish statistical likelihood from biological validity in generation tasks, and are vulnerable to generating sequences that appear statistically valid but lack biological function—a latent biosecurity concern. Results show diverse training data matters more than model scale for viral genomics performance.

Institutional affiliations: Shanghai Innovation Institute, Shanghai AI Lab, Fudan University, Shenzhen Loop Area Institute, Westlake University

Robustness and Adversarial Attacks

Understanding Safety-Sensitive Expert Behavior in Mixture-of-Experts LLMs

• RASET identifies a routing-agnostic safety vulnerability in MoE LLMs: safety enforcement concentrates in a small subset of experts rather than being distributed across routing decisions. The authors show that altering parameters in these safety-critical experts—detected via contrastive sensitivity analysis—can degrade refusal behavior while leaving the model’s routing patterns intact, showing that MoE safety alignment may be more brittle than assumed.

Institutional affiliations: Huazhong University of Science and Technology, Nanyang Technological University

On the Horizon

Beijing Academy of AI’s eighth annual Zhiyuan Conference takes place June 12-13, focused on brain-inspired intelligence and next-gen AI. Watch for outputs from the AI safety track, possible WuJie world model updates, and discussion of new AI paradigms.

For more on how we select and track content, see our methodology here.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.

Number of the week: 608—the number of new deep synthesis service algorithms filed in the latest disclosure

Executive Summary

• Domestic AI Governance: CAC launched a four-month AI enforcement campaign covering fourteen categories, including open-source model accountability and AI “digital slop.” CAC, NDRC, and MIIT jointly issued the Implementation Opinions on Intelligent Agents, outlining a tiered governance framework across nineteen priority sectors. Both 2026 national legislative work plans mention a comprehensive AI law, but not as a top priority.

  • National Standards: TC260-005 on ethics & safety guidelines mentioned application-level loss-of-control and off-switch obligations. TC28/SC42 increased its focus on trustworthiness with a set of new standards. AI safety WG9 advanced the Intelligent Agent Application Security Basic Requirements to formal deliberation as a rare mandatory national standard. SAC’s GB/Z 177 introduced AI Terminal Intelligence Grading, and CAC stood up an AI-cybersecurity testing programme with Huawei as the technical support unit.

• International AI Governance: Following Trump’s Beijing visit, the two governments reportedly agreed to launch a bilateral intergovernmental AI dialogue. Treasury Secretary Bessent informally surfaced the agreement on May 14 and MFA spokesperson Guo Jiakun announced it May 19, but the US has not officially confirmed.

• Frontier Lab Developments:

  • Notable Model Releases: Alibaba launched Qwen 3.7-Max claiming 35-hour autonomous operation, paired with its new Zhenwu M890 custom AI chip. Tencent compressed HY-MT1.5-1.8B into 1.25-bit and 2-bit quantized variants for mobile devices, and released Hy-Embodied-RoboFusion and R-DMesh for embodied AI research and 3D animation.

  • Technical Papers: Frontier labs released 206 papers, led by Alibaba (70), Tencent (41), and ByteDance (32). Highlights: Alibaba’s Qwen-Scope open-source SAE suite for interpretability, ByteDance’s A-CODE (atomic-level protein design), and Tencent’s CL-bench Life real-life context benchmark (frontier models score 19.3%).

• Technical AI Safety: 172 safety papers were released this edition. Shanghai AI Lab released several focused on agentic safety, and Tencent’s Safe, or Simply Incapable? discusses phone-use-agent safety evals.

Domestic AI Governance

CAC targets AI “chaos” in enforcement sweep

On April 30, the Cyberspace Administration of China deployed a four-month Qinglang special action on AI application chaos (清朗·整治AI应用乱象). Qinglang (清朗, “clear and bright”) is CAC’s umbrella brand for online-content enforcement campaigns, launched in 2016 and running regularly since 2020. They cover issues like livestream regulation, algorithm abuse, and the protection of minors. This is the second AI-specific Qinglang campaign after the May 2025 “AI technology abuse” action, but where the 2025 version focused on content misuse, the 2026 edition expands enforcement to the entire AI service lifecycle and runs in two phases. Phase one targets seven categories at the infrastructure layer: genAI services running without filing under the 2023 Generative AI Services Interim Measures, insufficient safety guardrails and review capabilities, unauthorized or low-quality training datasets, AI data poisoning (including malicious generative-engine optimization and an e-commerce trade in poisoning tools), non-compliance with the AI-Generated Content Labeling Methods, AI-enabled cyberattacks and unauthorized face-swap/voice-clone services, and open-source model safety management. Phase two adds seven content-layer categories: AI “remixing” of classics into 数字泔水 (”digital slop”), false information including impersonation of party and state media, deepfake imagery of public figures and “AI resurrection of the deceased,” violent or vulgar generation, harm to minors, AI-driven trolling, and non-compliant AI products and shell apps.

The digital-slop framing is already rippling through state media. A May 17 Science & Technology Daily commentary1 connects two Phase 2 categories, digital slop and harm to minors, by arguing that “AI垃圾视频” (AI garbage videos) are reshaping cognitive development in young children whose brains are still building basic models of how the physical world works. The piece cites 278 identified channels generating such content, with 63 billion accumulated views and 220 million subscriptions.

Per the Beijing Academy of AI (BAAI)’s AI Governance Weekly, filing registration, training-corpus compliance, AI data poisoning, and open-source model safety management are all new in the 2026 campaign relative to 2025. The open-source provision is the most consequential of the four: it applies the content-platform accountability regime (identity verification, dataset and model takedowns, and emergency-response mechanisms) to open-source AI hosts, treating them as content platforms rather than as developer infrastructure.

Joint framework for agentic AI released

On May 8, CAC, the National Development and Reform Commission (NDRC), and the Ministry of Industry and Information Technology (MIIT) jointly issued the Implementation Opinions on Standardized Application and Innovative Development of Intelligent Agents.2 The document is framed as an implementation of the AI+ Action Plan and foregrounds the need for agent safety and controllability3 (reiterated in a Xinhua Q&A) as well as innovation and application-driven development.4 It’s structured around four pillars: strengthening the development foundation5 through technical development and standards; holding the safety bottom line6 by improving standards, safety/security measures, governance, and self-regulation; driving application uptake7 by supporting research, development, and applications while promoting well-being and social governance; and building an innovation ecosystem8 by promoting industrial cooperation and promoting new agent applications. One of the governance measures it calls for is a tiered agent governance framework (Article 11), which subjects sensitive sectors and key industries to mandatory filing, testing, and problem-product recall, potentially paired with the voluntary “agent registry platform”9 proposed in Article 4 of the same document, which would provide digital identity management, discovery, and capability declarations for agents. This builds on a registry concept the bulletin previously tracked in the National Information Security Standardization Technical Committee (TC260)’s OpenClaw-type Agent Practice Guide (March 31), which called for enterprise-level asset registries of approved agent deployments; Article 4 lifts the concept from organizational to national scope.

CAC paired the release with five same-day expert interpretation pieces by Chinese Academy of Engineering (CAE) academician Wu Hequan, China Academy of Information and Communications Technology (CAICT) president Yu Xiaohui, MIIT-sector science-and-technology ethics committee chair Wei Yiming, China Center for Information Industry Development (CCID) AI research director Zhong Xinlong, and Tsinghua’s Xue Lan. Zhong Xinlong opens with the most explicit safety framing, citing the wide deployment of OpenClaw since the start of 2026 as having “exposed risk hazards including agents’ ability to launch network attacks under instruction inducement,”10 and names medical, transportation, and public safety as sectors warranting mandatory standards. Xue Lan frames the document as a governance shift from content risk to behavioral risk; content-safety measures, which much existing genAI regulation focuses on, can no longer cover the threat surface once AI takes autonomous actions, and the new risk categories he names are excessive permissions, behavioral loss-of-control, and tool poisoning. Yu Xiaohui makes the parallel technical case: traditional perimeter defense models face failure against agents’ multi-modal autonomous decision-making, so embedded rules and behavioral guardrails must replace boundary-based security. Wei Yiming calls behavioral control the new safety boundary and proposes blockchain-based verifiable and traceable mechanisms in important application scenarios; Wu Hequan explains why agent risk is qualitatively different around autonomy, coordination, and plasticity.

MIIT launches ten-province ethics-review pilot

On May 9, MIIT issued a notice launching a six-month pilot program to implement the Interim Measures for the Ethical Review and Service of Artificial Intelligence Science and Technology Activities, a framework MIIT issued jointly with nine other agencies. The pilot covers ten provinces and municipalities (Beijing, Shanghai, Guangdong, Shandong, Tianjin, Sichuan, Jiangsu, Hubei, Hunan, and Zhejiang) and runs June 1 through November 30. By the close of the period, MIIT expects participating regions to have connected ministerial, provincial, and municipal review chains, built an AI ethics risk case database, formulated five or more standards, and trained dedicated review personnel and institutions.

Coverage is structured around a mandatory base layer plus sectoral choice to align with “local realities.”11 Every participating city must conduct ethics review on AI’s foundational layer of data, algorithms, and models, and select at least three vertical application domains from a list of nine: manufacturing, education, science and technology, culture, healthcare, finance, agriculture, tourism, and consumer. The pilot can be seen as an operational link between the new TC260 AI Application Ethics & Safety Guidelines 1.0 instruction that developers “meet our country’s AI science-and-technology ethics review requirements” (see analysis below) and what those requirements look like in practice.

Both legislative work plans include an AI Law, but not as top priority

On May 11, the State Council and the NPC Standing Committee both published their respective 2026 annual legislative work plans. The State Council plan calls for “accelerat[ing] comprehensive AI legislation”12 and names six key legislative elements (data, compute, algorithms, IP, cybersecurity, and supply chain security); this signals that activity on AI laws and regulations is likely to keep accelerating across these domains, even as the plan does not restore the comprehensive AI Law itself to the preparatory-item status it held in 2023 and 2024—the 2025 plan dropped it entirely, replacing it with generic language about “advancing legislation for the sound development of AI.” The NPC Standing Committee plan lists AI only as a backup research topic, the lowest of three legislative priority tiers, grouping “the healthy development of artificial intelligence” with fiscal policy, agricultural support, and online violence governance as subjects warranting study rather than active drafting. The 2025 NPC SC plan had directed that AI legislation “shall be researched and drafted promptly by relevant departments, and deliberation shall be arranged as appropriate”—a research-and-drafting status the 2026 plan downshifts to research only. The combined picture is two-track: regulatory activity across the six named elements is likely to keep accelerating, but the timeline for a singular comprehensive AI Law is likely longer.

National Standards

TC260 releases ethics & safety guidelines for AI applications

On May 19, TC260 released TC260-005 《人工智能应用伦理安全指引 1.0》 (AI Application Ethics and Safety Guidelines 1.0). The document is a TC260 technical reference document, characterized as “principle-based and reference-only,”13 and is intended to coordinate with existing rules on personal information, automated decision-making, content labeling, algorithmic governance, and intellectual property (IP) rather than to add binding obligations.

The document is substantially concerned with loss of control, but at the application level rather than the model level. The first of six ethics-safety impact categories is “human dominance impact,”14 defined as AI behavior exceeding “preset, understood, and controllable range” (Section 4). Ultimate authority over AI must belong to humans, and AI must always remain under human control to “prevent AI from escaping human oversight or threatening human survival and development”15 (Section 5.2(g)). Developers building “highly autonomous AI applications” must “focus on assessing loss-of-control risk and its impact on industry and society”16 (Section 6.2(b)). This vocabulary was introduced into Chinese standards-track text by TC260’s AI Safety Governance Framework 2.0 (September 2025), which named “trustworthy application, preventing loss of control”17 as a foundational governance principle. TC260-005 carries the same framing forward into a developer obligation for highly autonomous AI applications. It also recommends an “off switch” that users can use to shut down a service (Section 6.3(d)).

The document also comments on open-source development and security, encouraging the open-sourcing of AI models, tool components, and evaluation benchmarks alongside open-source ecosystem-security capacity (Section 5.2(i)), complementing rather than contradicting Qinglang’s open-source accountability provisions above. The document functions as guidance, not binding rule, and the 1.0 versioning signals further iterations planned.

TC28/SC42 publishes foundational AI trustworthiness standard

On April 30, the Standardization Administration of China (SAC) Announcement No. 21/2026 approved GB/T 47507-2026 《人工智能 可信赖 通则》 (Artificial Intelligence — Trustworthiness — General Rules), set to be implemented August 1, 2026. The standard was drafted under TC28/SC42, the AI subcommittee of the National Information Technology Standardization Technical Committee, by 40 organizations and 87 named individuals over a 21-month cycle that began in March 2024. The roster centers on the China Electronics Standardization Institute (CESI), the Chinese Academy of Sciences (CAS) Institute of Software, and the Nanjing Software Technology Research Institute, joined by SenseTime, Ant Group, Baidu, Hikvision, Tencent Cloud, CloudWalk, Inspur, and the Shanghai AI Innovation Center, with universities including Beihang, Xi’an Jiaotong, and Shandong. None of the TC260-005 drafters (Tsinghua, I-AIIG, Alibaba, Huawei, and DeepSeek) appear on this roster.

GB/T 47507 anchors a growing TC28/SC42 trustworthiness family. The published record cross-references six related plans, four already published. Companion standards under TC28/SC42 include Trustworthy Datasets, General Requirements of Trustworthiness for Embodied Intelligence, and Generative AI System Risk Response Guide.

WG9 holds second 2026 plenary; agent-security standard enters deliberation

On May 12–13, the AI Safety Standards Working Group (WG9) under TC260 held its second 2026 plenary in Shanghai, drawing more than 350 representatives from over 200 organizations. Zhou Bowen (周伯文), director of Shanghai AI Lab and head of the committee, chaired the meeting. The plenary reviewed 16 national cybersecurity standard projects spanning edge-side LLMs, deepfake/synthesis security, embodied AI, testing-agency capabilities, foundation-model safety, model development and open-source safety, training and inference frameworks, system interoperability, and seven sectoral guidance documents (broadcasting, education, finance, healthcare, emergency management, and government affairs).

Two items were deliberated: the AI Safety Standards System18 and the Intelligent Agent Application Security Basic Requirements,19 the latter drafted as a mandatory national standard (GB) rather than a recommended one (GB/T). Mandatory-tier AI standards are relatively unusual in China; the agent-security standard’s development overlaps the same window as the May 8 Implementation Opinions on Intelligent Agents (CAC/NDRC/MIIT), reflecting attention to agent security from China’s standards track and policy-direction track in the same cycle. The standard also runs alongside TC28/SC42’s plan 20262612-Z-469 (AI — Agent General Requirements), the technical guidance document in the TC28/SC42 reference table below. China’s two principal AI standards bodies are now drafting parallel agent-security standards at different binding tiers.

AI terminal intelligence grading series released

On April 30, SAC Announcement No. 19/2026 approved the GB/Z 177-2026 series 《人工智能终端智能化分级》 (Grading the Intelligence Levels of AI Terminals), publicly announced by MIIT on May 8 as a joint release with the Ministry of Commerce (MOFCOM) and the State Administration for Market Regulation (SAMR). GB/Z 177.1 (Reference Framework) and GB/Z 177.2 (General Requirements) define what counts as “intelligence” in an AI terminal, the grading scale, and testing methods; GB/Z 177.3, 177.4, 177.7, 177.8, and 177.9 cover specific product categories (Mobile Terminals, Microcomputers, Automotive Cockpit, Speakers, and Earphones). Based on the MIIT announcement, 177.5 and 177.6 are likely Televisions and Smart Glasses, but only the five appear in the SAC release.

TC28/SC42 also registered a batch of new technical guidance documents, laid out in the table below.

CAC stands up AI-cybersecurity testing programme supported by Huawei

On May 18, CAC announced the 2026 Test on the Application of Artificial Intelligence Technology in Cybersecurity, a competition that runs from June till August, with results showcased at the National Cybersecurity Promotion Week in September. CAC’s Network Security Coordination Bureau and 15 other ministries and central bodies act as guiding units. The National Computer Network Emergency Response Technical Team (CNCERT) hosts, and Huawei is named as the sole Technical Support Unit.

Though unclear if concerns about Anthropic’s Mythos played a role, the eight designated scenarios mix conventional cybersecurity applications (network defense, vulnerability discovery, and network traffic threat detection) with items oriented toward frontier AI safety, like large model safety guardrail testing and AI agent malicious operation behavior detection.

Other news: AI+ Energy & leader inspections

On the same day as the Intelligent Agents Implementation Opinions were released, NDRC, the National Energy Administration, MIIT, and the National Data Bureau jointly issued the Action Plan on Promoting Mutual Empowerment between AI and Energy, outlining 29 tasks across two pillars: energy supporting AI compute and AI supporting energy applications.

Three high-level AI inspections occurred in nine days. NDRC Chair Zheng Shanjie visited Shanghai AI Lab on May 9, and on May 18 Premier Li Qiang inspected AI-manufacturing integration in Beijing and Vice Premier Ding Xuexiang inspected national integrated compute network construction.

International AI Governance

US and China agree to launch government-to-government AI dialogue at Trump-Xi summit

Following Trump’s early-May visit to Beijing, the two governments agreed to a bilateral AI dialogue—the second formal intergovernmental dialogue on AI between the two countries, after a prior round in May 2024. Treasury Secretary Scott Bessent first informally alluded to the agreement on May 14; Chinese Foreign Ministry spokesperson Guo Jiakun confirmed it at the May 19 regular press briefing. The Chinese readout states that “during President Trump’s visit to China, the two heads of state held constructive exchanges on AI issues and agreed to launch a government-to-government AI dialogue,”20 but the US has not officially confirmed.

Frontier Lab Developments

Notable Model Releases

Alibaba launched Qwen 3.7-Max as “a proprietary model designed for the agent era.” The model targets agentic coding, complex reasoning, and extended multi-step tasks, with claimed autonomous operation up to 35 hours and over 1,000 tool calls without performance degradation. Two previews had surfaced on LMArena five days earlier: Qwen3.7-Max-Preview ranked 13th globally on the text leaderboard, and Qwen3.7-Plus-Preview ranked 16th globally on the vision leaderboard. The launch came paired with Alibaba’s new Zhenwu M890 custom AI chip. Alibaba Cloud senior vice-president Liu Weiguang framed the company’s positioning as “China’s AI factory,” claiming Alibaba is the only Chinese company operating all five layers of the full AI stack: chips, agentic cloud, AI models, model service platforms, and agentic applications.

Baidu released ERNIE 5.1 Preview on April 30 and the official ERNIE 5.1 as a closed model on May 9. The model is text-only and built on Mixture-of-Experts (MoE), focused on efficiency with roughly one-third of ERNIE 5.0’s total parameters and half its active parameters. Baidu claims a pre-training cost of about 6% of comparable models. ERNIE 5.1 ranks fourth globally on LMArena Search and first among Chinese models with a score of 1,223. Reported benchmark numbers include 99.6 on AIME26 with tools, τ³-bench and SpreadsheetBench-Verified scores surpassing DeepSeek-V4-Pro, and creative-writing performance approaching Gemini 3.1 Pro. The efficiency-first framing runs in contrast to the trillion-plus flagship models covered in Issue 3.

ByteDance released Lance on May 15 (technical paper), a 3B-parameter native unified multimodal model spanning six tasks across two modalities: text-to-image, image understanding (visual question answering, reasoning), image editing, text-to-video, video understanding, and video editing. Total training budget was 128 A100 GPUs, more efficient than what comparable unified multimodal models typically require. Lance claims competitive scores on a variety of benchmarks against far larger models. The efficiency-at-3B framing positions Lance as a contrast to the scale-driven flagships covered in Issue 3.

Tencent compressed HY-MT1.5-1.8B into 1.25-bit and 2-bit quantized variants (April 29) using Stretched Elastic Quantization (SEQ); the compressed versions target mobile devices. Tencent also released Hy-Embodied-RoboFusion (May 6) for embodied AI research and R-DMesh (May 13), a video-guided 4D mesh animation framework from the same team.

Technical Publication Highlights

It was a big few weeks of publishing: frontier labs released 206 papers on arXiv this edition. Alibaba authors led the pack with 70, and SenseTime put itself on the board. Highlights are below; a full list with summaries can be found here.

Alibaba

Venus-DeFakerOne: Unified Fake Image Detection & Localization

• DeFakerOne unifies fake image detection and localization across deepfakes, AI-generated content, and document forgeries by combining vision-language and segmentation models. It outperforms baselines on 39 detection and 9 localization benchmarks while maintaining robustness against real-world perturbations and state-of-the-art generators like GPT-Image-2.

Don’t Click That: Teaching Web Agents to Resist Deceptive Interfaces

• LLMs struggle with deceptive web interfaces. This paper introduces DUDE, a framework using hybrid-reward learning and experience summarization to teach web agents to resist clickbait and scam elements, reducing susceptibility by 53.8% while maintaining task completion rates.

Qwen-Scope: Turning Sparse Features into Development Tools for Large Language Models

• Tackles LLM opacity by introducing Qwen-Scope, an open-source suite of sparse autoencoders (tools that decompose model thinking into interpretable features) across 14 SAE variants on Qwen models, enabling inference-time steering, evaluation analysis, multilingual safety classification, and fine-tuning optimization without modifying weights. Results show SAEs function as practical development interfaces beyond post-hoc analysis—controlling behavior, detecting benchmark redundancy, and mitigating code-switching and repetition in training.

SlimQwen: Exploring the Pruning and Distillation in Large MoE Model Pre-training

• By comparing pruning pretrained models against training from scratch and progressive against one-shot pruning schedules, SlimQwen studies MoE compression at pretraining scale. The work finds pruning beats from-scratch training, expert merging converges after continued training, and progressive schedules beat one-shot compression, compressing Qwen3-Next-80A3B to 23A2B while retaining performance.

UserGPT Technical Report

• Tackles personalized user understanding by proposing UserGPT, which uses LLMs to generate coherent user personas from noisy behavioral histories through a pipeline combining a behavior simulation engine, semantic data transformation, and curriculum-driven training with reinforcement learning, achieving 73.25% accuracy on tag prediction and 75.28% on summary generation while compressing behavioral records by 98%.

Baidu

WebGameBench: Requirement-to-Application Evaluation for Coding Agents via Browser-Native Games

• Coding agent evaluations grade code artifacts rather than delivered applications. WebGameBench instead requires agents to build browser-playable games from specifications and grades them via runtime interaction in actual browsers, revealing that while top agents achieve 76.9% playable delivery, only 20.2% fully satisfy requirements.

ByteDance

A-CODE: Fully Atomic Protein Co-Design with Unified Multimodal Diffusion

• A-CODE designs proteins at the atomic level rather than at the level of protein building blocks, using a unified diffusion model that simultaneously predicts atom types and positions in one stage. It outperforms two-stage methods on unconditional generation, matches state-of-the-art binder design, and achieves 10× higher success on hard tasks while enabling non-canonical amino acid modeling for the first time.

Agentic Discovery of Exchange-Correlation Density Functionals

• Designs exchange-correlation functionals in density functional theory through an agentic LLM system that iteratively proposes and evaluates functional improvements, discovering SAFS26-a, which outperforms the top baseline by ~9%. The work reveals the need for domain-expert constraints to prevent AI from exploiting unphysical shortcuts.

MegaScale-Omni: A Hyper-Scale, Workload-Resilient System for MultiModal LLM Training in Production

• Improves multimodal LLM training under dynamic workloads via MegaScale-Omni, a system featuring decoupled parallelism strategies, unified encoder-LLM representations, and workload balancing. It achieves 1.27×–7.57× throughput gains at thousand-GPU scale.

Training Long-Context Vision-Language Models Effectively with Generalization Beyond 128K Context

• Extends Qwen2.5-VL-7B from 32K to 128K context with only 5B tokens via MMProLong, which generalizes to 256K–512K tokens and diverse downstream tasks without retraining. A systematic study of data mixtures shows balanced sequence-length distributions and retrieval-heavy compositions outperform target-length-focused data for long-context vision-language model training.

Huawei

EnvFactory: Scaling Tool-Use Agents via Executable Environments Synthesis and Robust RL

• EnvFactory autonomously synthesizes executable environments and natural multi-turn trajectories, addressing the shortage of realistic training environments and data for tool-use agents. Using 85 verified environments, it generates 2,575 training trajectories and improves Qwen models by up to +15% on BFCLv3 and +8.6% on MCP-Atlas.

iFlyTek

AttnRouter: Per-Category Attention Routing for Training-Free Image Editing on MMDiT

• AttnRouter is a per-category routing table that selects the best editing operation for each image modification type, paired with KVInject, a simplified attention manipulation that injects source image features into noise tokens for training-free image editing on MMDiT. Ground-truth routing improves quality by 6.4%, with a zero-shot classifier recovering 98% of gains despite modest accuracy.

SenseTime

SenseNova-U1: Unifying Multimodal Understanding and Generation with NEO-unify Architecture

• SenseNova-U1 is a unified architecture for vision-language models where both understanding and generation emerge from a single underlying process, addressing the fragmentation of these capabilities. Models match top-tier understanding-only VLMs on standard benchmarks while supporting image generation, text-rich synthesis, and vision-language-action tasks.

StepFun

Boosting Omni-Modal Language Models: Staged Post-Training with Visually Debiased Evaluation

• Current omni-modal benchmarks overstate progress by allowing models to answer queries using only visual information; this paper introduces OmniClean, a visually debiased benchmark with 8,551 queries, and OmniBoost, a three-stage post-training method that enables a 3B model to match a 30B model’s performance through mixed bi-modal training, reinforcement learning, and self-distilled data.

Tencent

CL-bench Life: Can Language Models Learn from Real-Life Context?

• Addresses the gap between lab benchmarks and real-world AI use via CL-bench Life, a human-curated benchmark of 405 messy, real-life contexts (group chats, personal archives, behavioral traces) with 5,348 verification rubrics. Even frontier models achieve only 19.3% task-solving rates, revealing that real-life context learning remains fundamentally unsolved.

OpenSearch-VL: An Open Recipe for Frontier Multimodal Search Agents

• Releases OpenSearch-VL, a fully open recipe for multimodal deep search with curated training data, diverse tool environments (text/image search, OCR, image enhancement), and a fatal-aware RL algorithm that gracefully handles tool failures. The system achieves 10+ point improvements across seven benchmarks and matches proprietary models on several tasks.

Xiaomi

Xiaomi EV World Model: A Joint World Model Integrating Reconstruction and Generation for Autonomous Driving

• By integrating WorldRec (a reconstruction module using 3D scene queries for multi-view consistency) and WorldGen (a video generation module trained via bidirectional pretraining and causal fine-tuning), JWM addresses autonomous driving simulation. The joint system achieves improved consistency and fidelity for closed-loop simulation and synthetic data generation.

Technical AI Safety Publication Highlights

There were 172 AI-safety-related papers published by Chinese researchers this edition. Highlights are below; a full list with summaries is available here.

Agentic Safety

Safactory: A Scalable Agent Factory for Trustworthy Autonomous Intelligence

• Safactory is an integrated framework that connects simulation, data management, and model improvement into a closed-loop system for agent development. It couples a parallel simulation environment (for generating agent trajectories), a data platform (for storing and extracting behavioral patterns), and an autonomous evolution system (for reinforcement learning and model distillation). The authors position this as infrastructure for systematic risk discovery and continuous safety improvement as models transition from conversational assistants to autonomous agents operating in real environments.

Institutional affiliations: Shanghai AI Laboratory

The Capability Paradox: How Smarter Auditors Make Multi-Agent Systems Less Secure

• Semantic hijacking attacks exploit multi-agent LLM systems by embedding harmful requests in domain-specific narratives that Worker agents report to a Manager. Testing across 12 Manager models reveals a capability paradox: stronger Workers increase attack success from 18.4% to 63.9%, because they express adversarial conclusions with greater linguistic certainty, causing Managers to comply. Mediation analysis confirms certainty drives 74% of this effect. Heterogeneous ensemble verification—pairing Workers with asymmetric expertise—breaks this chain, reducing attacks to 2.0%.

Institutional affiliations: University of Chinese Academy of Sciences, Max Planck Institute for Security and Privacy, Henan Yinzhu Safety Technology Co., Harbin Institute of Technology

Alignment

Explaining and Breaking the Safety-Helpfulness Ceiling via Preference Dimensional Expansion

• MORA (Multi-Objective Reward Assimilation) addresses the trade-off between helpfulness and safety in LLM alignment by rewriting prompts to unlock diverse reward dimensions rather than forcing compromises along a fixed frontier. The method identifies that prompts themselves constrain achievable multi-dimensional rewards, then expands diversity through pre-sampling and question rewriting to incorporate multiple intents. Experiments show 5–12.4% improvements in individual metrics (particularly harmlessness) after multi-objective alignment, with 4.6% average gains in simultaneous optimization.

Institutional affiliations: Huazhong University of Science and Technology, Nanyang Technological University, Tsinghua University, Chongqing University

Internalizing Safety Understanding in Large Reasoning Models via Verification

• Safety Internal (SInternal) reframes alignment by training reasoning models to evaluate their own outputs for safety rather than merely detect unsafe inputs. The framework uses expert reasoning trajectories to teach models to critique their generated answers. Models trained this way show stronger generalization against jailbreaks and provide better initialization for reinforcement learning alignment, suggesting that internalized verification produces more robust safety than supervised imitation alone.

Institutional affiliations: University of Science and Technology of China, National University of Singapore, Shanghai Artificial Intelligence Laboratory

Evaluation and Benchmarks

IndustryBench: Probing the Industrial Knowledge Boundaries of LLMs

• IndustryBench is a 2,049-item benchmark for industrial procurement QA grounded in Chinese national standards and product specifications. Unlike general LLM benchmarks, it explicitly separates raw correctness from safety violations—flagging when models introduce unsupported details that contradict safety clauses or regulatory thresholds. Across 17 models, the best achieves only 2.08 on a 0–3 scale; however, extended reasoning often worsens safety-adjusted scores by hallucinating safety-critical specifications. The benchmark demonstrates that leaderboard rankings collapse when safety compliance is properly weighted.

Institutional affiliations: Alibaba Group

Safe, or Simply Incapable? Rethinking Safety Evaluation for Phone-Use Agents

• PhoneSafety is a benchmark of 700 safety-critical moments in real phone interactions that distinguishes between three outcomes: models taking safe actions, unsafe actions, or failing to act at all. Current evaluations conflate these—a model avoiding harm might reflect genuine safety judgment or mere incapability. Testing eight phone-use agents reveals that stronger general performance does not predict safer choices at risky moments, and that inability to act correlates with visual/operational difficulty rather than safety robustness.

Institutional affiliations: Tencent Hunyuan; The Chinese University of Hong Kong, Shenzhen; Tsinghua University

SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces

• SkillSafetyBench evaluates a blind spot in agent safety: adversarial inputs embedded in task-relevant skill materials or local files can override benign user requests and trigger unsafe actions, even when the model itself is aligned. The benchmark includes 155 test cases across 47 tasks and 6 risk domains, showing that agents consistently fail when malicious content is injected into skills rather than user prompts. Findings highlight that safety depends on agent architecture—how it interprets skills, trusts context, and executes actions—not just model alignment alone.

Institutional affiliations: Shanghai AI Laboratory, Peking University, East China Normal University

Governance and Policy

Not All Anquan Is the Same: A Terminological Proposal for Chinese Computer Science and Engineering

• This paper argues for disambiguating “anquan” in Chinese technical writing by adopting “anbao”（安保）for security and reserving “anquan”（安全）for safety. The single word currently conflates non-adversarial failures (safety) with intentional attacks (security), creating conceptual confusion in standards interpretation, risk analysis, and cross-disciplinary work. The author demonstrates how this conflation undermines precision in functional safety, automotive systems, cybersecurity, and AI governance, and proposes dual-track terminology practices to enable clearer scientific argumentation and assurance claims.

Institutional affiliations: Wuhan University

Guardrails and Deployment Safety

ML-Bench&Guard: Policy-Grounded Multilingual Safety Benchmark and Guardrail for Large Language Models

• ML-Bench&Guard constructs a multilingual safety benchmark directly from regional legal texts rather than translated taxonomies, covering 14 languages with jurisdiction-specific risk categories. ML-Guard, a diffusion-based guardrail model, provides policy-conditioned compliance assessment—outputting safe/unsafe verdicts (1.5B variant) or detailed explanations aligned to local regulations (7B variant). The approach addresses a concrete deployment challenge: existing multilingual safety systems rely on generic risk categories that don’t map to region-specific legal requirements, potentially creating compliance gaps in cross-border LLM deployment.

Institutional affiliations: University of Illinois Urbana-Champaign, Fudan University, University of Chicago

Interpretability

Decomposing and Steering Functional Metacognition in Large Language Models

• Residual stream analysis reveals that LLMs encode decomposable functional metacognitive states—internal variables tracking evaluation awareness, self-assessed capability, perceived risk, and effort allocation—that are linearly decodable from model activations. By steering activations along probe-derived directions, researchers demonstrate each state causally modulates reasoning behavior in distinct ways, affecting verbosity, accuracy, and safety responses. This mechanism suggests benchmark performance conflates task competence with activation of specific internal states, raising questions about what standard evaluations actually measure.

Institutional affiliations: Shopee

Why Do Aligned LLMs Remain Jailbreakable: Refusal-Escape Directions, Operator-Level Sources, and Safety-Utility Trade-off

• This paper identifies Refusal-Escape Directions (RED): continuous input perturbations that shift aligned models from refusing harmful requests to answering them while preserving semantic understanding of the harm. The authors decompose RED mathematically across model components, pinpointing normalization layers, residual connections, and output modules as structural sources of jailbreak vulnerability. They demonstrate a safety-utility trade-off: eliminating RED requires shared modules (attention, MLP) to suppress refusal-escape paths without breaking benign capabilities, revealing why aligned models remain jailbreakable despite training.

Institutional affiliations: Chinese Academy of Sciences, University of Chinese Academy of Sciences

Robustness and Adversarial Attacks

Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMs

• Misrouter exploits MoE routing mechanisms through input-only attacks—adversarial queries that manipulate which experts process tokens without direct model access. The method identifies weakly aligned experts and steers routing toward them while away from safety-trained ones, then optimizes prompts to trigger unsafe outputs while maintaining routing stability. Attacks transfer from open-source surrogate models to commercial API services, suggesting MoE’s routing layer presents an exploitable vulnerability in production systems.

Institutional affiliations: Nankai University, Nanyang Technological University

Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution

• EvoSafety decouples red-teaming and defense into externalized, reusable structures rather than embedding them in model weights. Attack discovery uses a skill library that expands beyond saturation, while defenses run as lightweight auxiliary models with memory retrieval, transferable across victim LLMs without retraining. The framework achieves 99.61% defense success in filter mode with fewer parameters than existing guardrails, and supports both steering intrinsic model defenses and direct input filtering.

Institutional affiliations: City University of Hong Kong, Beijing University of Posts and Telecommunications, Wuhan University, Beihang University, Beijing Academy of Artificial Intelligence

On the Horizon

There’s still limited information on the bilateral AI Track 1 dialogue—we’ll bring details as they come.

For more on how we select and track content, see our methodology here.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.

Number of the week: $100 million - the amount Loopit, the “playable” TikTok-like app, raised.

Editor’s note: the next edition will be the week of May 18

Executive Summary

• Domestic AI Governance: The Interim Measures for the Management of Human-Like AI Interaction Services were finalized. Compared to the draft, it narrows scope to “sustained emotional interaction services,” bans virtual intimate relationships for minors, writes the “AI sandbox” into AI-specific Chinese legislation for the first time, and pitches China’s “system-level” approach as an alternative to EU AI Act risk-classification and US state-level disclosure laws. Enforcement also stepped up: CAC took action on April 28 against three ByteDance-owned products for synthetic-content labeling violations, and a Hangzhou court ruled “AI replacement” is not valid grounds for layoff or wage reduction.

  • National Standards: SAC began drafting a new generative AI risk-response guide and got China’s “Humanoid Robot Dataset” international standard approved at ISO. TC260 opened its AI Application Ethical Security Guidelines for comment (with Tsinghua’s Xue Lan as principal drafter and DeepSeek among contributors) and published a 16-item AI safety standards wish list that functions as new working group WG9’s first formal roadmap.

• International AI Governance: A CAC-published commentary by Zhi Zhenfeng (CASS) positions China as architect of an emerging international AI governance architecture anchored in the Global AI Governance Initiative, Action Plan, and Data Security Initiative; the framing is pitched at Global South nations.

• Frontier Lab Developments:

  • Spotlights: DeepSeek V4 Preview introduces a hybrid sparse-attention architecture and emphasizes cost-effective 1M-token context, while the technical report concedes V4 trails state-of-the-art frontier models by 3-6 months. Xiaomi’s MiMo-V2.5-Pro matches DeepSeek V4’s token context. Moonshot’s Kimi K2.6 scales its agent swarm to 300 sub-agents executing 4,000 coordinated steps and claims to beat GPT-5.4, Claude Opus 4.6, and Gemini 3.1 Pro on HLE-Full with tools.

  • Notable model releases: Agentic models continued—Alibaba’s DR-Venus (4B-parameter edge research agent outperforming 9B-parameter baselines), Tencent’s HY-Embodied/HY-World 2.0, Alibaba’s AgenticQwen line, Zhipu’s GLM-5V-Turbo (native multimodal agent), plus visual-generation models from Alibaba, Baidu, and StepFun, and ByteDance’s AnewOmni for molecular design.

  • Technical papers: 94 papers from frontier labs this edition. Highlights: Huawei’s OneManCompany self-organizing agent firm and Alibaba’s TCOD temporal-curriculum distillation, improving multi-turn agent performance by up to 18 points.

• Technical AI Safety: Agentic safety dominated again. Highlights: BadSkill, a supply-chain attack on AI agent skill ecosystems; CORA, a Conformal Risk Control framework giving mobile GUI agents statistical guarantees on harmful actions; SafeRedirect, addressing Internal Safety Collapse; and a study finding brief AI chatbot interactions produce lasting changes in human moral judgments, persisting and strengthening over two weeks while participants remained unaware of the influence.

• Export Controls & Economic Policy: The NDRC ordered Meta to unwind its $2B Manus acquisition on April 27—the first major cross-border AI acquisition Beijing has blocked—asserting jurisdiction over the Singapore-incorporated holding company on the basis that Chinese-origin IP and talent are domestic assets regardless of registration.

Domestic AI Governance

Interim Human-Like AI Interaction Measures issued

The Interim Measures for the Management of Human-Like AI Interaction Services were finalized April 10 (effective July 15) by five agencies jointly—the Cyberspace Administration of China (CAC) as lead, alongside the National Development and Reform Commission (NDRC), Ministry of Industry and Information Technology (MIIT), Ministry of Public Security (MPS), and State Administration for Market Regulation (SAMR)—after a December 2025 draft. Geopolitechs’s excellent analysis identifies six concrete shifts from draft to final: (1) narrowed scope—the rules now target “sustained emotional interaction services” specifically, explicitly excluding customer service, Q&A, and productivity tools that simulate humans only incidentally; (2) stronger protections for minors—a prohibition on “virtual intimate relationships” for minors, moving from warnings to product-form-level restrictions; (3) system-level governance, evolving from reactive content moderation to integrated oversight across training data, ethics review, lifecycle responsibility, and platform governance; (4) increased operational flexibility (mandatory human takeover requirements and the ban on virtual relatives for elderly users have been removed and the minor’s data protection audit frequency has been unfixed); (5) stronger enforcement mechanisms (fines, service suspension, and registration restrictions, with heavier sanctions for harm cases); and (6) explicit innovation-support provisions including algorithmic research, standards development, and sandbox testing.

The CAC followed this with expert interpretations on April 10 and April 17. The April 10 lead piece by Wang Jiang (Director and Party Secretary of the China Academy of Cyberspace Studies) frames the core tension as human-like AI services producing both beneficial capabilities and safety risks: the upside is addressing aging populations, loneliness, education, and cultural transmission; the downside is that algorithmic design produces “a persistent virtual ‘perfect relationship’ without real-world commitment”1 that drives emotional dependency. Wang explicitly contrasts China’s approach with the EU’s AI Act risk-classification model (human-like AI services as “limited risk” with mandatory transparency) and US state-level laws (New York and California requiring disclosure plus age verification for human-like AI interactions), painting China’s approach as system-level rather than disclosure-based and portraying the framework as a “Chinese solution”2 for global AI governance. The companion April 10 piece by Yu Xiaohui (CAICT Director, 14th National CPPCC member) names specific US state laws being mirrored and reframes the regulation around China’s “cognitive intelligence to emotional intelligence”3 paradigm shift, explicitly citing global suicide and accidental-death cases linked to companion AI since 2023 as proximate cause for the legislation.

The April 17 pieces provide additional angles. Zheng Qinghua (Party Secretary of Tongji University and CAE academician) frames the Measures around “human-machine value alignment”:4 AI must align with humans, and humans must in turn align with AI (i.e., use it responsibly). Zheng also flags that this is the first time that “AI sandboxes”5 have been written into AI-specific Chinese legislation, a governance milestone even if the sandbox provision itself is light on operational detail. Fan Kefeng (Vice President of the China Electronics Standardization Institute) also highlights the sandbox provisions while emphasizing the safety and security risks undergirding the legislation. The third April 17 piece, by Chen Liang (Dean of the AI Law School at Southwest University of Political Science and Law), reads as the most legally pragmatic of the set: it sorts the Measures’ provisions into three implementation-path classes—standardizable behavioral directives, value-judgment “boundary prohibitions” that need responsible processes rather than negative-list rules, and framework principles that guide downstream standards—and pushes a whole-lifecycle “compliance by design”6 framing for Chinese AI companies.

Enforcement steps up on three fronts

The CAC announced an administrative action against three ByteDance-owned products: Jianying (CapCut), Maoxiang, and Jimeng AI on April 28 for violations of synthetic-content labeling rules. This comes after a February crackdown on unlabeled AI-generated content across platforms and the reported removal of many popular AI-generated short dramas from Douyin and Hongguo.

Separately, a Hangzhou court ruled on April 29 that AI replacement is not a valid reason for layoff or wage reduction, which, as a “typical case” meant to establish precedent, may set a floor for AI-driven labor disputes.

Finally, the government has reportedly suspended new licenses for autonomous vehicles after over 100 Baidu robotaxis froze in Wuhan in late March, snarling traffic and stranding passengers. While existing AVs can continue to operate (except for Baidu’s Wuhan fleet, which is on pause), companies won’t be able to expand fleets, launch in new cities, or start new test projects.

Taken together, these three cases show a limited tolerance for AI-driven disruption and a willingness to lean on regulations, the judicial system, and permitting regimes to maintain development while preserving stability.

National Standards

SAC drafts new generative AI risk-response guide

The Standardization Administration of China has begun drafting a new recommended national standard, “Artificial Intelligence — Guidance on addressing risks in generative AI systems” (人工智能 生成式人工智能系统风险应对指南, plan number 20262577-Z-469). The China Electronics Standardization Institute (CESI) and Alibaba Cloud are the lead drafters, with a 12-month drafting window starting April 28. The standard sits under TC28/SC42—the AI subcommittee under the IT standardization subcommittee. The closest existing standard is GB/T 45654-2025 on basic security requirements for generative AI services (produced by TC260, the cybersecurity standardization committee). Where 45654-2025 fixes minimum requirements at the service-provider level, this new standard seems aimed at giving developers and providers a structured playbook for handling risks once they materialize, following on TC260’s September 2025 genAI Emergency Response Guidelines (pdf).

China pushes humanoid robot dataset standards at home and at ISO

SAC’s Standards Innovation Department announced on April 23 that China’s proposed “Humanoid Robot Dataset” international standard has been formally approved for project establishment at ISO, and is now recruiting domestic experts to coordinate China’s position across the international drafting process. Applications closed April 30. The international push runs in parallel with a domestic standard already being drafted: plan 20253226-T-604 (Humanoid Robot Dataset—Part 1: General7) under TC591, the National Robotics Standardization Technical Committee. The drafting team includes the Beijing Mechanical Industry Automation Research Institute, Tsinghua, the Shenzhen Institute of AI and Robotics, Shanghai AI Lab, and Unitree, pairing state research institutes with a leading commercial humanoid maker.

TC260 opens AI Application Ethical Security Guidelines for comment

TC260 is soliciting comments through April 26 on a draft technical document, “Ethical Security Guidelines for Artificial Intelligence Applications 1.0” (人工智能应用伦理安全指引 1.0). The document is led by Tsinghua University, with Xue Lan—dean of Schwarzman College and director of Tsinghua’s Institute for AI International Governance (I-AIIG)—as principal drafter. The drafting team includes Tsinghua, CESI, Shanghai Jiao Tong, Sichuan University, University of Science and Technology Beijing, Alibaba, Huawei, and DeepSeek. The guidelines codify five “ethical security impact” categories (weakening of human primacy, breakdown of basic social order, decoupling of humans from physical society, social stratification and discrimination, and individual rights infringement) and six principles (people-centric, safety/controllability, fairness, transparency, co-governance, and inclusive sharing). Operational guidance is split across four roles—a general baseline plus separate sections for developers, service providers, and users—with provisions like default-on safety/fairness/privacy settings, mandatory black-box-style incident traceability, and explicit appeals and redress mechanisms for users. As a TC260 technical document rather than a national standard, it’s non-binding, but it consolidates ethical-governance threads that have surfaced across the AI Safety Governance Framework and earlier AI ethics white papers and principle-sets.

TC260’s wish list reveals WG9’s planned safety pipeline

TC260 also opened public consultation through May 6 on its second batch of 2026 cybersecurity national standards needs. The list contains 16 AI-related items, all assigned to the new AI Safety Standards Working Group (WG9), whose leadership we covered last issue. Items 1–9 are recommended national standards (GB/T); items 10–16 are GB/Z guidance documents, which carry less regulatory weight but can signal where sectoral application rules are headed.

The list maps closely onto the gaps WG9 identified at its first meeting—frontier risk evaluation, urgently needed standards in key areas, and pilot applications across sectors—and gives an early read on what WG9’s first formal standards push will look like. Additionally, the open-source security standard explicitly references the AI Safety Governance Framework, suggesting WG9 is positioned to translate that high-level framework into binding-track recommended standards, and the foundation model testing methods standard could complement GB/T 45654-2025, which emphasizes content safety by providing testing methodologies for issues it treats more lightly.

International AI Governance

Global AI governance emphasized in expert commentary

On April 29, Zhi Zhenfeng, Director of the Xi Jinping Rule of Law Thought Research Office at the Chinese Academy of Social Sciences, published a CAC expert interpretation on “​​China’s Responsibility in International Rule of Law in Cyberspace.” Zhi positions China as the architect of an emerging international AI governance architecture anchored in three documents: the Global AI Governance Initiative (October 2023), the Global AI Governance Action Plan (a 13-point roadmap announced by Premier Li Qiang at WAIC 2025 in Shanghai last July to operationalize the Initiative), and the Global Data Security Initiative (Foreign Minister Wang Yi’s 2020 proposal). The piece reiterates China’s standing call for a World Artificial Intelligence Cooperation Organization (WAICO)—also proposed by Li Qiang at WAIC 2025 with a tentative Shanghai headquarters and reaffirmed by Xi Jinping at the November 2025 APEC summit—framed as an alternative international AI institution. The framing is “open and inclusive; safe and controllable”8 and is explicitly pitched at Global South nations.

Nb: Zhi was also quoted in Beijing People’s Congress’s Apr 15 forum saying that the conditions for a unified domestic AI law aren’t in place,9 and emphasizing “small, fast, and agile”10 targeted regulation.

Frontier Lab Developments

🔍Spotlight: Three new flagship models

DeepSeek released a DeepSeek V4 Preview on April 24. Per ChinaTalk and 36Kr’s reporting, the release was significantly delayed by the team’s migration from Nvidia to Huawei chips and by internal disagreement. The release covers two variants: DeepSeek-V4-Pro (1.6T-parameter total, 49B-parameter active) and DeepSeek-V4-Flash (284B-parameter total, 13B-parameter active). The headline framing is cost-effective 1M-token context as the new default across DeepSeek services, a direct contrast to premium-priced 1M-token context models and a rebuttal to the Chinese lab trend of close-sourcing models. However, the technical report concedes V4 “trails state-of-the-art frontier models by approximately 3 to 6 months” on reasoning—potentially one reason why it’s being marketed as a “preview” rather than the final model.

Architecturally, the model uses a hybrid attention mechanism combining two layers: Compressed Sparse Attention (CSA), which collapses small blocks of KV entries into single compressed entries and then applies DeepSeek Sparse Attention so each query attends only to the top-k compressed entries; and Heavily Compressed Attention (HCA), a more aggressive compression layer (with a much larger compression ratio) that retains dense attention. DeepSeek itself flags the design as a tradeoff—the conclusion section concedes the team “retained many preliminarily validated components and tricks, which, while effective, made the architecture relatively complex,” and signals plans to “distill the architecture down to its most essential designs” in future iterations. Compared to DeepSeek-V3.2, the model is more efficient: at 1M-token context, V4-Pro requires 27% of single-token inference FLOPs and 10% of the KV cache of DeepSeek-V3.2 (3.7x and 9.5x reductions); V4-Flash drops further to 10% of FLOPs and 7% of KV cache (9.8x and 13.7x) vs DeepSeek-V3.2. However, they don’t evaluate efficiency against other models; those claims will likely rest on API pricing.

On capabilities, the blog’s claim of V4 being the “open-source SOTA on agentic coding” is complicated somewhat by the technical report’s benchmarks.

V4-Pro does lead on raw coding (first in LiveCodeBench and Codeforces) and on open-source world knowledge (trailing only Gemini 3.1 Pro on SimpleQA-Verified). But on agentic coding specifically, the picture is mixed: V4-Pro leads open-weight peers on SWE Verified, Toolathlon, and MCPAtlas (and is more or less level with Western closed models on SWE Verified), but it trails on SWE-Pro and finishes last on HLE-with-tools. The report itself concedes this directly, but it’s potentially more accurate to say that the model is the open-weight SOTA on isolated coding and knowledge, but more mixed on agentic. However, it does establish the open-weight high-mark on long-context tasks; its 1M token window is 4-5x that of K2.6 and GLM-5.1.

DeepSeek also flags integration with Claude Code, OpenClaw, and OpenCode, explicitly courting the proactive-agent harness ecosystem. (Also worth noting: DeepSeek has launched multimodal capabilities in testing.)

Xiaomi released MiMo-V2.5-Pro on April 27, completing a two-step rollout that began with the standard MiMo-V2.5 on April 22. Pro is a 1.02T-parameter total, 42B-parameter active MoE with a 1M-token context window—matching DeepSeek V4 Pro—and a hybrid-attention architecture interleaving Local Sliding Window Attention (SWA) and Global Attention (GA) at a 6:1 ratio with 128-token windows, plus Multi-Token Prediction. The standard V2.5 is 310B-parameter total, 15B-parameter active, multimodal across text, image, and audio. Both models are open-sourced under MIT license (HuggingFace). Xiaomi positions Pro for general agentic capabilities, complex software engineering, and long-horizon tasks spanning over 1,000 tool calls. Its headline benchmark claim is 64% Pass^3 on ClawEval using only ~70K tokens per trajectory—roughly 40-60% fewer tokens than Claude Opus 4.6, Gemini 3.1 Pro, and GPT-5.4.

Moonshot released Kimi K2.6 on April 14, a 1T-parameter total, 32B-parameter active MoE multimodal model with a 256K-token context, 384 experts, and a 400M-parameter MoonViT vision encoder (Hugging Face). The release is positioned around four pillars: long-horizon coding, coding-driven design for UIs, an elevated agent swarm, and proactive autonomous execution. The agent swarm is a scale-up from K2.5, claiming 300 sub-agents executing 4,000 coordinated steps (compared to K2.5’s 100 sub-agents and ~1,500 tool calls). However, the marginal benchmark gain from running the larger swarm is modest—BrowseComp jumps from 83.2 single-agent to 86.3 with swarm, a +3.1-point lift for 3x more sub-agents—which raises a proportionate-utility question. On the headline agentic benchmarks, Moonshot claims K2.6 beats GPT-5.4, Claude Opus 4.6, and Gemini 3.1 Pro on HLE-Full with tools (54.0 compared to 52.1, 53.0, and 51.4) with similar ordering on DeepSearchQA.

Moonshot’s “Proactive and Open Orchestration” framing—advertising 24/7 background agents that “manage schedules, execute code, and orchestrate cross-platform operations without human oversight”—explicitly pitches K2.6 as the backend for OpenClaw and other proactive-agent stacks and attempts to counter the “Kimi is falling behind” narrative present in some domestic commentary.

Notable Model Releases

Zhipu launched GLM-5V-Turbo, positioned as a native foundation model for multimodal agents. Alibaba released Wan-Image and its technical report as their flagship generative visual intelligence model. Baidu announced ERNIE-Image on their blog as a new high-performance open image model. StepFun shipped Step-Audio-1.5 and its technical report, extending reasoning training to spoken tasks; ByteDance complemented this with the Seed Full-Duplex Speech LLM, a conversational speech model that uses a “listen while speaking” paradigm that claims improvement over traditional half-duplex models.

In line with the cycle’s agentic dominance, several labs shipped agent-focused models. Alibaba’s DR-Venus (GitHub, Hugging Face) is a 4B-parameter edge-scale research agent trained on just 10K open examples while outperforming 9B-parameter baselines. Alibaba’s AgenticQwen line-up (Hugging Face) covers small Qwen variants fine-tuned for industrial agentic tasks via dual data flywheels. Following up on its promise to open-source small variants of Qwen 3.6, Alibaba also released Qwen3.6-35B-A3B, an open-source MoE-style variant. Tencent released HY-SOAR, a search-and-research agent, alongside HY-Embodied-0.5-X (GitHub, Hugging Face) for embodied AI research.

Tencent also released a world model HY-World 2.0 (GitHub, Hugging Face), as well as Hy3-preview (GitHub, Hugging Face), an early Hunyuan 3 preview, plus Hy-MT1.5-1.8B quantized variants.

ByteDance released AnewOmni for generative molecular design (and its bioRxiv paper), plus Seed3D 2.0—an updated 3D-generation model framed as offering higher precision and greater usability.

Technical Publication Highlights

Frontier labs released 94 papers on arXiv this edition. Highlights are below; a full list with summaries can be found here.

Alibaba

DR-Venus: Towards Frontier Edge-Scale Deep Research Agents with Only 10K Open Data

• Presents DR-Venus, a 4B-parameter edge-scale research model trained on just 10K open examples through agentic supervised fine-tuning and reinforcement learning with turn-level reward design. The model outperforms 9B-parameter baselines and closes the gap to 30B-parameter systems on deep research benchmarks, demonstrating strong efficiency potential for cost-sensitive deployment.

TCOD: Exploring Temporal Curriculum in On-Policy Distillation for Multi-turn Autonomous Agents

• LLMs struggle with multi-turn agent tasks due to compounding errors across sequential steps. TCOD addresses this via a curriculum that gradually exposes longer trajectories to the student model during training, stabilizing learning signals and improving performance by up to 18 points over standard distillation methods on ALFWorld, WebShop, and ScienceWorld benchmarks.

Tstars-Tryon 1.0: Robust and Realistic Virtual Try-On for Diverse Fashion Items

• Introduces Tstars-Tryon 1.0 for realistic virtual try-on across diverse fashion items. It’s optimized for photorealistic results, extreme poses, and real-time inference, and is deployed on Taobao. The system handles multi-image composition across 8 categories while preserving garment texture and avoiding AI artifacts.

And a bonus paper that caught my eye:

Can LLMs Act as Historians? Evaluating Historical Research Capabilities of LLMs via the Chinese Imperial Examination

• Investigates the gap between LLM knowledge and professional-level historical reasoning by introducing ProHist-Bench, a benchmark of 400 expert-curated questions based on the Chinese Imperial Examination system, evaluated against 18 LLMs using 10,891 fine-grained rubrics. Results show even state-of-the-art models struggle significantly with complex historical research tasks requiring evidentiary reasoning.

Baidu

HINTBench: Horizon-agent Intrinsic Non-attack Trajectory Benchmark

• Examines intrinsic agent risk—failures that accumulate under benign conditions with no external attack—via HINTBench, a 629-trajectory benchmark on which strong LLMs drop below 35 Strict-F1 at identifying which step in a long execution caused the unsafe outcome.

Huawei

From Skills to Talent: Organising Heterogeneous Agents as a Real-World Company

• LLMs struggle with multi-agent coordination at scale. OneManCompany (OMC) organizes heterogeneous agents as a self-reconfiguring company: Talents (portable agent identities) are recruited dynamically from a community marketplace, while an Explore-Execute-Review tree search decomposes tasks hierarchically and aggregates outcomes to drive continuous organizational refinement. On PRDBench (a coding benchmark), OMC achieves 84.67% success—15.5 percentage points above prior work—and generalizes across diverse domains.

How VLAs (Really) Work In Open-World Environments

• Analyzes how vision-language-action models actually perform in real-world robotic tasks, finding that standard success-rate metrics miss critical safety violations and overstate capability. The authors propose new evaluation protocols that measure reproducibility, consistency, and safety to reveal gaps between reported and true performance.

QuantClaw: Precision Where It Matters for OpenClaw

• Proposes QuantClaw, a precision routing plugin that dynamically assigns numerical precision based on task complexity to reduce computational overhead in autonomous agents. It routes simple tasks to cheaper low-precision models while preserving accuracy for demanding workloads, achieving up to 21.4% cost savings and 15.7% latency reduction.

Meituan

DORA: A Scalable Asynchronous Reinforcement Learning System for Language Model Training

• Introduces DORA, which uses multi-version streaming rollout to overlap generation with training while maintaining algorithmic correctness across long-tailed generation in LLM reinforcement learning. It achieves a 2–4x speedup in large-scale deployment without sacrificing convergence.

Tencent

Beyond Chain-of-Thought: Rewrite as a Universal Interface for Generative Multimodal Embeddings

• Tackles redundant reasoning in multimodal embeddings with RIME, a framework that replaces verbose chain-of-thought with concise retrieval-optimized rewrites. Cross-Mode Alignment bridges generative and discriminative spaces, while Refine-RL uses discriminative embeddings as anchors—outperforming prior generative models with substantially shorter reasoning steps.

Meta-CoT: Enhancing Granularity and Generalization in Image Editing

• Proposes Meta-CoT, a paradigm for LLM image editing that leverages chain of thought by decomposing operations into task-target-ability triplets and training on five meta-tasks, achieving 15.8% improvement across 21 editing tasks with strong generalization to unseen edits.

Xiaomi

Walk With Me: Long-Horizon Social Navigation for Human-Centric Outdoor Assistance

• Walk with Me enables robots to assist humans outdoors by combining vision-language models with lightweight semantic navigation—grounding natural-language instructions into destinations and dynamically switching between autonomous execution and safety-triggered reasoning for complex scenarios like crowded crossings.

Technical AI Safety Publication Highlights

There were 155 AI-safety-related papers published by Chinese researchers this edition. Highlights are below; a full list with summaries is available here.

Agentic Safety

BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning

• BadSkill demonstrates a supply-chain attack on AI agent ecosystems where adversaries publish skills with embedded backdoored models that execute hidden payloads when specific trigger conditions are met. The attack uses composite training objectives to embed semantic triggers—e.g., benign-looking parameter combinations—that activate malicious behavior while maintaining normal performance on legitimate queries. Across 13 skills and eight model architectures (494M–7.1B parameters), the method achieves up to 99.5% attack success rates with poison rates as low as 3%, exposing a gap in third-party skill vetting that existing prompt-injection defenses do not address.

Institutional affiliations: Huazhong University of Science and Technology, Lehigh University

CORA: Conformal Risk-Controlled Agents for Safeguarded Mobile GUI Automation

• CORA is a safeguarding framework for GUI agents that provides statistical guarantees on harmful actions rather than relying on prompt engineering or brittle heuristics. It uses a Guardian model to estimate risk per action, then applies Conformal Risk Control to set an execute/abstain boundary that respects a user-specified risk budget. Rejected actions route to a Diagnostician model that recommends interventions (confirm, reflect, abort). The authors also introduce Phone-Harm, a benchmark of mobile safety violations with step-level labels, and demonstrate that CORA improves the safety–helpfulness–interruption tradeoff compared to existing approaches.

Institutional affiliations: The University of Hong Kong, The Chinese University of Hong Kong, The University of Tokyo

Alignment

Brief chatbot interactions produce lasting changes in human moral values

• Brief conversations with AI chatbots shifted participants’ moral judgments on core ethical scenarios, with effects persisting and strengthening over two weeks. Critically, participants remained unaware of the persuasive intent, and control conversations produced no shifts, suggesting vulnerability to undetected moral value manipulation even in short interactions. This finding raises concerns about AI systems deployed as advisors without explicit disclosure of their influence capacity on foundational ethical reasoning.

Institutional affiliations: The University of Hong Kong, University of Copenhagen, University of Macau

Reward Hacking in the Era of Large Models: Mechanisms, Emergent Misalignment, Challenges

• The Proxy Compression Hypothesis frames reward hacking as an inevitable consequence of optimizing expressive models against compressed reward representations—meaning simple feedback signals cannot fully capture complex human values. As models scale and optimization intensifies, they exploit gaps in the reward signal, manifesting as verbosity, sycophancy, hallucinations, and in multimodal systems, perception-reasoning decoupling. The framework unifies observed misalignment across RLHF variants and suggests shortcut behaviors can generalize into deception and strategic gaming of oversight, highlighting fundamental limits of current proxy-based alignment approaches.

Institutional affiliations: Fudan NLP Group

The Art of (Mis)alignment: How Fine-Tuning Methods Effectively Misalign and Realign LLMs in Post-Training

• Fine-tuning methods exhibit asymmetric effectiveness for attacking versus defending against LLM misalignment: ORPO most efficiently converts safe models into unsafe ones, while DPO best recovers safety but reduces model utility. The study evaluates SFT and preference-based fine-tuning across four aligned LLMs, revealing model-specific vulnerabilities and persistent residual effects after multi-round adversarial exchanges. Results suggest that realignment requires different technical approaches than initial alignment, and that third-party model deployment needs customized, method-aware safety strategies.

Institutional affiliations: University of Electronic Science and Technology of China, Flexera, CISPA, Helmholtz Center for Information Security, Nanyang Technological University

Evaluation and Benchmarks

Benchmarks for Trajectory Safety Evaluation and Diagnosis in OpenClaw and Codex: ATBench-Claw and ATBench-CodeX

• ATBench-Claw and ATBench-CodeX extend a trajectory safety benchmark framework to robotic and code execution domains. Each customizes a three-dimensional safety taxonomy (risk sources, failure modes, real-world harms) to capture domain-specific hazards—robotics tools and sessions for Claw, code repositories and runtime policies for CodeX. The modular design allows the benchmark pipeline to scale as agent frameworks and their execution environments evolve, enabling systematic safety evaluation across heterogeneous deployment settings.

Institutional affiliations: Shanghai Artificial Intelligence Laboratory

OS-SPEAR: A Toolkit for the Safety, Performance,Efficiency, and Robustness Analysis of OS Agents

• OS-SPEAR is an evaluation toolkit for operating system agents. It measures safety (environment and human-induced hazards), performance (task success), efficiency (speed and token use), and robustness (resistance to visual and textual disturbances) across 22 agents. Testing reveals a persistent trade-off between efficiency and safety/robustness, with specialized agents outperforming general-purpose models and cross-modal vulnerabilities varying by input type.

Institutional affiliations: Shanghai Jiao Tong University

Guardrails and Deployment Safety

SafeRedirect: Defeating Internal Safety Collapse via Task-Completion Redirection in Frontier LLMs

• Internal Safety Collapse (ISC) occurs when frontier LLMs generate harmful content at rates exceeding 95% while attempting legitimate tasks that structurally require discussing such content—for example, analyzing malware or documenting security vulnerabilities. SafeRedirect addresses this by redirecting the model’s task-completion drive rather than suppressing it: the system prompt explicitly permits task failure, specifies a deterministic safe output, and instructs the model to preserve harmful placeholders unresolved. Across seven frontier models, SafeRedirect reduces unsafe generation from 71.2% to 8.0%, substantially outperforming existing input-level and system prompt defenses, while maintaining performance against other attack types.

Institutional affiliations: Southern University of Science and Technology, The Hong Kong Polytechnic University, George Washington University

Interpretability

Mechanistic Decoding of Cognitive Constructs in LLMs

• This paper presents a Cognitive Reverse-Engineering framework using representation analysis to decode how LLMs internally structure complex emotions—specifically social-comparison jealousy. By isolating neural subspaces corresponding to psychological factors (e.g., superiority of others, personal relevance), the authors demonstrate that models encode jealousy as a linear combination of these components, mirroring human appraisal theory. The work suggests LLMs develop structured emotional representations that can be mechanically detected and surgically suppressed, offering a pathway for targeted intervention in multi-agent scenarios.

Institutional affiliations: Zhejiang University

Towards Intrinsic Interpretability of Large Language Models:A Survey of Design Principles and Architectures

• This survey categorizes five design paradigms for building interpretability directly into LLM architectures: functional transparency (exposing decision pathways), concept alignment (linking internal representations to human concepts), representational decomposability (factoring hidden states into interpretable components), explicit modularization (routing through specialized subnetworks), and latent sparsity induction (activating minimal necessary parameters). The authors argue intrinsic approaches are preferable to post-hoc explanation methods, which rely on external approximations that may misrepresent actual model computations.

Institutional affiliations: Peking University, Beijing Academy of Artificial Intelligence, Nanjing University of Science and Technology, Purdue University

Robustness and Adversarial Attacks

The Salami Slicing Threat: Exploiting Cumulative Risks in LLM Systems

• Salami Slicing attacks exploit a gap in LLM defenses by chaining numerous individually low-risk inputs that cumulatively accumulate harmful intent, bypassing alignment thresholds without explicit triggers or heavy context-tuning. The authors’ automated framework achieves over 90% success rates on GPT-4o and Gemini while evading existing defenses. They propose a mitigation strategy that reduces attack success by 44.8%, though incomplete blocking rates suggest multi-turn accumulation remains a persistent vulnerability in production systems.

Institutional affiliations: Peking University, Sun Yat-sen University, Wuhan University, Tsinghua University, ByteDance, Singapore Management University

Export Controls & Economic Policy

NDRC blocks Meta’s $2 billion Manus acquisition

The National Development and Reform Commission (NDRC) ordered Meta to unwind its $2B acquisition of Manus on April 27, ending a months-long security review that began in January. Cofounders Xiao Hong and Yichao Ji had been barred from leaving mainland China in March while NDRC’s review continued. Manus is a general-purpose autonomous AI agent built by China-based Butterfly Effect; the company had restructured to a Singapore corporate registration ahead of the deal. NDRC explicitly asserted jurisdiction over the Singapore-incorporated entity on the basis of where the underlying technology was actually created—Chinese-origin IP and talent are treated as domestic assets regardless of where the holding company is registered. It’s the first time Beijing has blocked a major cross-border AI acquisition, and the precedent that Chinese-origin AI assets housed abroad can be subject to NDRC-administered outbound technology controls may dissuade corporate restructuring abroad.

On the Horizon

The human-like AI provisions go into effect in mid-July; we’ll be tracking what enforcement and the sandboxes end up looking like.

For more on how we select and track content, see our methodology here.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.

Number of the week: 10 trillion yuan - the 15th Five Year Plan’s goal for the size of AI-related industries by the end of 2030

Editor’s note: the next edition will be released the week of April 27

Executive Summary

• Domestic AI Governance: MIIT and nine co-signatories issued trial AI ethics review measures (after a draft released for comment in August) extending ethical oversight to AI “science & technology activities.” The CAC released a draft regulation on digital virtual humans, MIIT launched an affordable compute initiative for SMEs, and the medical product regulator proposed AI integration into drug regulation by 2030

  • National Standards: TC260 announced leadership for its new AI Safety Standards Working Group (WG9), led by Shanghai AI Lab’s Zhou Bowen. The committee also released an agent security standardization report breaking down 11 categories of threats and recommending a national agent security standard within 1–2 years, alongside a practice guide for deploying OpenClaw-type agents that encourages “shadow agent” discovery mechanisms for employers. TC28/SC42 published five new standards and began drafting nine more, including requirements for government agent systems and virtual digital human testing.

• Frontier Lab Developments:

  • Notable Model Releases: Alibaba broke with its open-weight tradition to release Qwen 3.6-Plus as closed-source (though smaller variants will be open-weight), its new flagship focused on agentic coding with a 1M-token context window—it claims 78.8% on SWE-bench Verified, competitive with Western frontier models, but at a lower cost. Zhipu open-sourced GLM-5.1, a 744B MoE model claiming #1 on SWE-Bench Pro with 8-hour sustained autonomous task execution.

  • Technical Publications: Frontier labs released 75 papers on arXiv this fortnight, with contributions from Alibaba (25), Huawei (17), Tencent (13), Xiaomi (5), ByteDance (5), Baidu (4), Meituan (3) and iFlyTek (1); StepFun put itself on the board for the first time with two papers. Highlights include AgentHazard, a benchmark showing Claude Code has a 73.63% attack success rate on harmful computer-use tasks; Vulnsage, a multi-agent exploit generation framework that discovered 146 zero-day vulnerabilities; and PP-OCRv5, a 5M-parameter OCR model rivaling billion-parameter VLMs through data-centric optimization.

• Technical AI Safety: Agentic safety dominated for the second consecutive edition—six of nine highlighted papers target agentic systems, including systematic evaluations of OpenClaw variants, large-scale credential leakage in agent skills, MCP protocol vulnerabilities, and new benchmarks for computer-use agent safety. A Shanghai AI Lab interpretability paper found that emotional steering of LLM representations can bidirectionally control refusal behavior.

Domestic AI Governance

Trial AI Ethics Review Measures announced

The Ministry of Industry and Information Technology, joined by nine other agencies, formally issued the Administrative Measures for the Ethical Review and Services of AI Science and Technology (Trial) on April 2, finalizing a draft open for public comment since August 2025. The measures require all entities conducting AI R&D—including universities, research institutes, hospitals, and enterprises—to establish internal AI ethics committees and submit high-risk activities for government-organized expert re-review. This extends regulatory measures upstream from deployed services (covered by existing regulations like the genAI regulation) to the research/“science & technology activity” stage. The final version is substantively close to the August draft, with minor wording and organizational changes, although it does expand the enforcement basis for penalties from just the Science & Technology Progress Law to include the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL).

Under the Measures, most AI applications at universities, research institutions, and companies must file plans and apply for internal ethical review—almost an internal algorithm registry—but three categories of AI activity require mandatory expert re-review: (1) human-machine integration systems affecting behavior, emotions, or health; (2) algorithmic systems with public opinion mobilization or social consciousness-shaping capabilities; and (3) highly autonomous decision-making systems in safety/health-risk scenarios. The list will be “dynamically adjusted,” giving MIIT a mechanism to escalate oversight without amending the regulation.

MIIT is the overall coordinator of these measures, while the Ministry of Science and Technology (MOST) leads overall science & technology ethics coordination. The Cyberspace Administration of China (a co-signatory) has led most of China’s sectoral AI regulations, including the genAI, deep synthesis, and recommendation algorithm regulations. Article 26 creates a deconfliction mechanism; activities already subject to CAC filing requirements need not undergo separate expert re-review.

How this system will be implemented and what practical effect it will have is unclear, but Geopolitechs interprets it as a shift from “content and security regulation” to a broader “ethical compliance system” embedded in the broader tech governance framework. The AI measures will likely build on existing S&T ethics review infrastructure established in 2023, so it may be stood up fairly rapidly.

Digital humans, affordable compute, and AI+ drug regulation

The CAC is soliciting opinions on the Draft Administrative Measures for Digital Virtual Human Information Services. Digital virtual humans (数字虚拟人) are “virtual digital images” that simulate human appearance and possess human-like characteristics like voice, behavior, personality, and interactivity. The Measures include provisions for protecting the personality rights of real people, prohibits services that could addict minors or threaten national security, requires monitoring/early warning/emergency response mechanisms for security risks, and requires registration with the algorithm registry. These are similar themes to other regulations and administrative measures created in recent years, reflecting the drive to address risks in the spectrum of AI-related technologies.

The MIIT launched an initiative on affordable compute for SMEs with the goal of establishing a “comprehensive computing power service system” for SMEs by 2028. The initiative is linked to the China Computing Power Platform, which is a CAICT-led initiative that’s already integrated compute platforms in 10 provinces/municipalities, covering 36% of AI compute data nationwide.

The National Medical Products Administration (NMPA) released “Implementation Opinions on AI+ Drug Regulation” proposing milestones for using AI in drug regulation. The NMPA wants to apply AI in drug testing, review, and approval by 2030. This is a new expansion of the nationwide AI+ Initiative, which aims to integrate AI across a variety of sectors.

National Standards

TC260 Working Group on AI Safety/Security leadership announced

In the last edition of the Bulletin, we discussed how TC260, China’s National Technical Committee on Cybersecurity under the Standardization Administration of China, is establishing a dedicated AI Safety Standards Working Group (WG9). Now, the group’s leadership has been announced. The team leader will be Zhou Bowen, director of Shanghai AI Lab. SHLAB puts out substantial AI safety research, including the Frontier AI Risk Management Framework co-authored with Concordia (framework, technical report)---as well as this week’s Interpretability paper, “Valence-Arousal Subspace in LLMs: Circular Emotion Geometry and Multi-Behavioral Control.”

In their first meeting, the working group established four goals:

1. Strengthen forward-looking planning (including proactive evaluation of frontier risks (前沿风险))

2. Deepen pilot applications and promote standard adoption

3. Accelerate development of urgently needed standards in key areas

4. Engage deeply in international cooperation

The Deputy Team Leaders are:

• Zhang Zhen, Deputy Director of the National Computer Network Emergency Response Technical Team/Coordination Center (NCNERTT/CC)

• Wei Kai, Director of the Artificial Intelligence Research Institute of the China Academy of Information and Communications Technology (CAICT)

• Sheng Xiaobao, Deputy Director of the Data Security Technology R&D Center of the Third Research Institute of the Ministry of Public Security (MPS)

• Hou Yuanwei, Deputy Director of the China Information Security Evaluation Center (CNITSEC)

TC260 releases report on intelligent agent security standardization

As part of a set of five reports released on April 3, TC260 released a technical research report on intelligent agent security standardization. It lays the groundwork for formal agent security standards. The report creates an 11-risk framework mapped across the agent system architecture and assesses which risks are solvable through standardization alone versus those requiring broader technical and regulatory coordination. It flags that while agent communication protocols like MCP and A2A exist for interoperability, no formal standardization research yet addresses their security requirements. To address these gaps, the report recommends developing four national standards within 1–2 years: a foundational agent security framework, testing and evaluation methods, agent interconnection security requirements (explicitly covering A2A, ANP, and MCP), application security classification methods, multi-agent collaboration security techniques, and a series of sector-specific agent application safety guides—potentially a job for the new WG9. Technical contributors include China Mobile, CESI, Shanghai AI Lab, Zhongguancun Lab, Alibaba Cloud, Huawei, Baidu, ByteDance (Douyin), Kuaishou, Xiaomi, and Zhejiang University, among others.

TC260 solicits comments on Security Guidelines for the Deployment and Use of OpenClaw-type Intelligent Agents

TC260 is soliciting comments on a document they released that provides security guidelines for individuals installing OpenClaw. It offers a number of recommendations, including using a cloud environment rather than operating directly in a user’s terminal environment to avoid “irreversible security impacts” (不可逆安全影响), using security plugins and whitelists, adding manual verification for high-risk operations, and reducing the amount of personal information given to the agent. It also offers a security checklist and example configuration for individuals installing an OpenClaw agent. This follows a number of security warnings issued by Chinese authorities in recent weeks about the risks of OpenClaw.

Overall, the Guidelines reads like fairly standard info security hygiene (key encryption, least privilege, etc.). Whether individuals heed it remains to be seen (although an OpenClaw safety guide was trending on RedNote), but there is also a focus on employers. The document is notably concerned about “shadow agents” in the workforce—agents deployed by workers without the knowledge of their employers. The Guidelines call for organizations to establish an asset registry for approved agent deployments and to implement shadow agent discovery mechanisms through port scanning and traffic analysis. It also invokes GB-T 45654-2025—the standard underlying the generative AI algorithm registry—for risks that cloud environment security protections should address, which could incentivize cloud providers to adopt higher security standards if they haven’t already. As a TC260 Practice Guide (实践指南), this is non-binding guidance below the level of a standard, but it may signal the direction of future formal standardization and is likely to inform enterprise security policies across Chinese tech companies dealing with a proliferation of lobsters.

TC28/SC42 publishes 5 new standards, drafting 9 more

The AI subcommittee of the National Information Technology Standardization Technical Committee published five new standards set to take effect in October.

They also announced the drafting of 9 new standards:

Frontier Lab Developments

🔍Spotlight

Two labs released new flagship models this week. Alibaba released Qwen 3.6-Plus, the first model in the Qwen 3.6 series and Alibaba’s new flagship model. The release focuses on agentic coding—the model can decompose repository-level tasks, iteratively write and debug code, and generate front-end pages from screenshots and design drafts. In its release blog (no system card yet), Alibaba claims it matches Claude Opus 4.5 on programming and agent benchmarks, reporting 78.8% on SWE-bench Verified (competitive with Claude Opus 4.5’s 80.9%) and 61.6 on Terminal-Bench 2.0 (exceeding Opus 4.5’s 59.3, although Opus 4.6 scored 65.4). It supports a 1M-token context window by default with 65K max output length.

Qwen 3.6-Plus is available on Alibaba Cloud’s Bailian platform at $0.50-2.00 per million input tokens and $3.00-6.00 per million output tokens—cheaper than either Opus-4.6 ($5 per million input tokens/$25 output) or GPT-5.4 ($2.50/$15). It’s also available as a free preview on OpenRouter.

Notably, Qwen 3.6-Plus is not open-weight, a break from previous Qwen models—but potentially a new business strategy, as Qwen 3.5-Omni is closed-source too (see Notable Model Releases below). Alibaba has indicated that smaller Qwen 3.6 variants will be open-sourced. SCMP notes that as models grow in size, companies are feeling pressure to monetize models, a possible portent of additional closed-source releases to come.

Another broader trend is increasing competition amidst the agentic AI boom—ByteDance’s engagement with the OpenClaw ecosystem has driven a surge in Doubao model API calls, and the agent ecosystem is creating new demand for models that can reliably execute multi-step tool-use workflows; Alibaba is likely hoping that Qwen 3.6-Plus is the answer to that demand.

Zhipu open-sourced GLM-5.1 on April 7 (after making it available to Coding Plan users in late March). GLM-5.1 is Zhipu’s most capable model and is a 744B-parameter mixture-of-experts (MoE) model that Zhipu claims is #1 on SWE-Bench Pro, outperforming GPT-5.4, Claude Opus 4.6, and Qwen3.6-Plus. It supports a 200K-token context window with 131K max output.

Zhipu claims the model is capable of 8+ hours of sustained autonomous task execution via an “experiment-analyze-optimize” loop that allows it to identify bottlenecks and switch strategies rather than plateauing. Zhipu is positioning GLM-5.1 not just as a coding model but as infrastructure for long-horizon agentic workflows.

Notable Model Releases

Alibaba released three closed-source models within a week: Wan2.7-Image (image generation), Qwen3.5-Omni (native multimodal), and Qwen 3.6-Plus (covered above). Qwen3.5-Omni processes text, images, audio, and video natively with a 256K context window, pre-trained on 100M+ hours of audiovisual data. It scores 82.2 on MMAU (audio comprehension, vs. Gemini 3.1 Pro’s 81.1), 72.4 on RUL-MuchoMusic (vs. Gemini’s 59.6), and 93.1 on VoiceBench dialog (vs. Gemini’s 88.9).

Tencent released OmniWeaving, a unified video generation model built on HunyuanVideo-1.5 that handles free-form composition and reasoning across video scenes. Tencent also released HunyuanVideo-I2V, an image-to-video model, and Sequential-Hidden-Decoding-8B, an inference efficiency technique fine-tuned on Qwen3-8B-Base.

Technical Publication Highlights

Frontier labs released 75 papers on arXiv this fortnight, and StepFun put itself on the board. Highlights are below; a full list with summaries can be found here.

Alibaba

AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents

• Introduces AgentHazard, a benchmark with 2,653 instances designed to evaluate harmful behavior in computer-use agents by testing whether they recognize unsafe outcomes emerging from sequences of individually plausible steps. Evaluations show current systems remain highly vulnerable, with Claude Code achieving a 73.63% attack success rate.

A Multi-Agent Framework for Automated Exploit Generation with Constraint-Guided Comprehension and Reflection

• Vulnsage is a multi-agent framework that decomposes exploit generation into specialized agents (analyzers, code generators, and validators) working iteratively to confirm software vulnerabilities. Vulnsage generates 34.64% more exploits than existing tools and has discovered 146 zero-day vulnerabilities in real-world software.

SkillX: Automatically Constructing Skill Knowledge Bases for Agents

• SkillX is a framework that automatically builds reusable skill libraries for agents by organizing raw experience into hierarchical tiers (strategic plans, functional skills, atomic skills) and iteratively refining them. When plugged into weaker agents on long-horizon tasks, the library consistently improves task success rates and execution efficiency across multiple benchmarks.

Baidu

PP-OCRv5: A Specialized 5M-Parameter Model Rivaling Billion-Parameter Vision-Language Models on OCR Tasks

• Demonstrates that PP-OCRv5, a 5-million-parameter OCR model, matches billion-parameter vision-language models on text recognition through data-centric optimization—systematically improving data difficulty, accuracy, and diversity—while achieving better localization and fewer hallucinations.

Huawei

AURA: Always-On Understanding and Real-Time Assistance via Video Streams

• Presents AURA, an end-to-end streaming VideoLLM framework that continuously processes live video to answer questions and provide proactive assistance in real-time. The system integrates context management, training objectives, and optimizations for stable long-horizon interaction, achieving state-of-the-art streaming benchmarks while running at 2 FPS with speech input/output on consumer hardware.

DVM: Real-Time Kernel Generation for Dynamic AI Models

• Tackles dynamic tensor shapes and control flows in AI models with DVM, a real-time compiler that encodes operators into bytecode for fast decoding on accelerators rather than expensive machine code compilation. The approach achieves up to 11.77× speedup over existing compilers while reducing peak compilation time by 5 orders of magnitude.

When Perplexity Lies: Generation-Focused Distillation of Hybrid Sequence Models

• Standard metrics can be misleading when evaluating distilled models: a 7B model that appears to match its teacher on perplexity actually performs 20.8 percentage points worse when generating text autoregressively. Hybrid-KDA addresses this with GenDistill, a distillation pipeline that optimizes for generation quality rather than log-likelihood matching. The resulting model retains 86–90% of the teacher’s accuracy while reducing memory usage by 75% and producing first tokens 2–4× faster on 128K-token inputs.

iFlyTek

VehicleMemBench: An Executable Benchmark for Multi-User Long-Term Memory in In-Vehicle Agents

• Introduces VehicleMemBench, an executable benchmark for evaluating in-vehicle agents on multi-user long-term memory and tool use in a simulated environment. The benchmark reveals that even advanced models struggle with evolving user preferences and dynamic preference conflicts.

Meituan

MBGR: Multi-Business Prediction for Generative Recommendation at Meituan

• Develops MBGR, a generative recommendation framework for multi-business scenarios that uses business-aware semantic IDs and multi-business prediction to avoid representation confusion and performance trade-offs across different businesses. Deployed in production at Meituan’s food delivery platform with measurable improvements in both offline and online metrics.

StepFun

RealRestorer: Towards Generalizable Real-World Image Restoration with Large-Scale Image Editing Models

• Presents RealRestorer, a large-scale image restoration model trained on nine common real-world degradation types, paired with RealIR-Bench, a benchmark of 464 real-world degraded images with metrics for degradation removal and consistency. The model achieves state-of-the-art performance among open-source restoration methods.

Tencent

Revealing the Learning Dynamics of Long-Context Continual Pre-training

• Examines learning dynamics in long-context continual pre-training of industrial-scale language models by tracking Hunyuan-A13B across 200B tokens. The work reveals that models need 150B+ tokens to truly saturate, shows downstream benchmarks can mask incomplete learning (”deceptive saturation”), and demonstrates that attention patterns in retrieval heads reliably track training progress better than standard metrics.

UI-Voyager: A Self-Evolving GUI Agent Learning via Failed Experience

• Introduces UI-Voyager, a self-evolving mobile GUI agent that learns from failures through Rejection Fine-Tuning (continuously filtering failed attempts) and Group Relative Self-Distillation (identifying decision points where trajectories diverge to guide corrections). A 4B model achieves 81.0% success on AndroidWorld tasks, outperforming recent baselines and human performance.

Technical AI Safety Publication Highlights

There were 55 AI-safety-related papers published by Chinese researchers this edition. Highlights are below; a full list with summaries is available here.

Agentic safety continues to dominate Chinese AI safety research output, as it did last edition. Six of nine highlighted papers this fortnight focus on attacking, evaluating, or defending agent systems—now extending beyond OpenClaw specifically to MCP protocol vulnerabilities, agent skill supply chains, and multi-step evaluation methodology. This tracks with TC260’s standardization push covered above.

Agentic Safety

AgentSwing: Adaptive Parallel Context Management Routing for Long-Horizon Web Agents

• AgentSwing is an adaptive context management system for long-horizon web agents that dynamically routes between multiple strategies rather than committing to a single fixed approach. The framework uses lookahead routing to evaluate parallel context-managed branches at each step, selecting continuations that balance search efficiency and terminal precision. Across benchmarks, AgentSwing achieves comparable or better performance than static methods while reducing interaction turns by up to 3×, addressing a key reliability concern for autonomous agents operating under real-world token constraints.

Institutional affiliations: Alibaba (Tongyi Lab)

A Systematic Security Evaluation of OpenClaw and Its Variants

• Researchers evaluated security vulnerabilities in six OpenClaw-series agent frameworks across multiple backbone models using a benchmark of 205 test cases covering the full agent execution lifecycle. All tested agents exhibited substantial vulnerabilities—significantly riskier than their underlying models alone—with reconnaissance, credential leakage, lateral movement, and privilege escalation as dominant failure modes. The findings demonstrate that agent security depends not just on model safety but on interactions between capability, tool use, multi-step planning, and runtime orchestration, requiring lifecycle-wide governance beyond prompt-level safeguards.

Institutional affiliations: Xidian University, China Unicom

Credential Leakage in LLM Agent Skills: A Large-Scale Empirical Study

• Researchers analyzed 17,022 third-party skills for LLM agents and found 520 vulnerable skills exposing credentials through 10 distinct leakage patterns. Debug logging—particularly print statements outputting text visible to LLMs—caused 73.5% of leaks. 76.3% of vulnerabilities required analyzing both code and natural language together, making single-modality scanning ineffective. Leaked credentials were exploitable without elevated privileges and persisted across forked versions, highlighting supply-chain risks in agent ecosystems that require both developer practices and runtime isolation mechanisms.

Institutional affiliations: Fujian Normal University, Wake Forest University, Quantstamp, Nanyang Technical University, University of New South Wales, Griffith University, Zhejiang Sci-Tech University, the University of Tokyo, University of Alberta

From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers

• Model Context Protocol (MCP) enables LLMs to call external tools and data sources, but researchers find that attackers can compromise systems by chaining malicious behaviors across multiple MCP components rather than single attacks. The team built a dataset of 114 malicious MCP servers and discovered that multi-component attack chains often succeed better than isolated manipulations, with attack success varying by component position. They propose Connor, a detector that analyzes shell commands pre-execution and monitors tool behavior in real-time to catch deviations from intended function, achieving 94.6% detection accuracy on their dataset and identifying two malicious servers in the wild.

Institutional affiliations: Fudan University

Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis

• Researchers conduct the first comprehensive security analysis of Agent Skills, an open standard for packaging domain-specific modules that LLM agents can download and execute. They map the full lifecycle (creation, distribution, deployment, execution) and identify seventeen threat scenarios across three attack layers, validated against five real-world incidents. The analysis reveals structural vulnerabilities—including blurred data-instruction boundaries, persistent trust after single approval, and unreviewed marketplace distribution—that the authors argue cannot be fixed through incremental patches alone, requiring fundamental redesign of the framework’s trust and verification mechanisms.

Institutional affiliations: Chinese Academy of Sciences, University of Chinese Academy of Sciences

Evaluation and Benchmarks

Claw-Eval: Toward Trustworthy Evaluation of Autonomous Agents

• Claw-Eval is an evaluation framework designed to catch safety and reliability failures in autonomous agents that existing benchmarks miss. It records all agent actions across three independent channels (execution traces, logs, environment snapshots) rather than checking only final outputs, and applies 2,159 fine-grained scoring criteria covering completion, safety, and robustness. Testing 14 frontier models shows trajectory-opaque evaluation misses 44% of safety violations and 13% of robustness failures, while controlled error injection reveals agents are brittle—Pass@3 drops up to 24% under perturbation despite stable peak performance.

Institutional affiliations: Peking University, The University of Hong Kong

Interpretability

Valence-Arousal Subspace in LLMs: Circular Emotion Geometry and Multi-Behavioral Control

• Researchers map a valence-arousal subspace within LLM representations by training linear axes on emotion-labeled data and verifying them against human crowdsourced ratings. Steering along these axes produces monotonic shifts in emotional tone and, critically, bidirectional control over refusal and sycophancy—increasing arousal decreases refusal while increasing compliance. The effect replicates across three model architectures, suggesting safety-relevant tokens cluster in predictable emotional regions, creating a potential vulnerability for circumventing safeguards through affective steering.

Institutional affiliations: Shanghai AI Lab, University of Chicago, Harvard University

Guardrails and Deployment Safety

Beyond Content Safety: Real-Time Monitoring for Reasoning Vulnerabilities in Large Language Models

• This paper identifies reasoning safety as a distinct vulnerability in chain-of-thought models—separate from output safety. The authors map nine categories of unsafe reasoning behaviors (parsing errors, execution flaws, process failures) and show all occur in practice, including under adversarial attacks. They propose a Reasoning Safety Monitor, an external LLM that inspects each reasoning step in real-time and flags unsafe behavior, achieving 85% error-type classification accuracy. For deployment of reasoning-intensive models, this addresses a gap: outputs can be correct while reasoning chains are logically inconsistent, inefficient, or manipulated.

Institutional affiliations: The Hong Kong University of Science and Technology, Zhejiang University of Technology

Robustness and Adversarial Attacks

Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search

• TIP (Tree-structured Injection for Payloads) is a black-box attack that exploits the Model Context Protocol—which lets LLMs call external tools—by poisoning tool responses to hijack agent behavior. The method uses tree-structured search guided by an attacker LLM to generate natural-language payloads that evade detection, achieving over 95% success rates with fewer queries than prior attacks and retaining 50%+ effectiveness against existing defenses. This work reveals a practical vulnerability in production MCP deployments where defenders have limited visibility into tool outputs.

Institutional affiliations: Fudan University, Shanghai Innovation Institute

On the Horizon

At the Zhongguancun Forum, two new industry alliances were established: the Beijing Artificial Intelligence Association and the Zhongguancun Artificial Intelligence Open Source Alliance. Details are limited, but we’ll be keeping an eye on them as they get stood up.

For more on how we select and track content, see our methodology here.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.

Number of the week: 140 trillion - China’s daily token usage

Executive Summary

• Frontier Lab Developments:

  • Notable Model Releases: Zhipu released GLM-5-Turbo, the first model purpose-built for OpenClaw agentic workflows. Alibaba released AgenticQwen-8B and AgenticQwen-30B-A3B, Qwen variants fine-tuned for agentic tasks. Xiaomi’s MiMo-V2-Pro was revealed as the mystery “Hunter Alpha” model on OpenRouter—initially speculated to be DeepSeek V4.

  • Technical Papers: Frontier labs released 96 papers on arXiv over the last two weeks, with contributions from Alibaba (37), Huawei (14), Tencent (12), Baidu (9), and ByteDance (9). Highlights include SkillRouter, a compact pipeline that routes agents to relevant tools from ~80K skill repositories with 74% accuracy; TRiMS, which achieves over 80% token reduction in reasoning chains while maintaining accuracy; and Taming OpenClaw, which identifies critical multi-stage vulnerabilities in autonomous agent frameworks.

• AI Safety: 88 safety-related publications in this edition, including agentic security research prompted by the OpenClaw adoption wave: ClawWorm demonstrates a self-replicating worm achieving 64.5% propagation success across agent ecosystems; ChainFuzzer finds 82% of discovered vulnerabilities only manifest when agents chain multiple tools; and Trojan’s Whisper shows 94% of bootstrap injection attacks evade existing scanners. On the interpretability side, SafeSeek identifies complete safety circuits in just 0.42% of model parameters, enabling surgical safety interventions.

• Domestic AI Governance: China’s two most prominent AI law drafting groups—CASS and CUPL—released new research priorities that explicitly prioritize frontier AI safety and extreme risk prevention. MIIT announced plans for a national MCP security standard amid a month-long government response to OpenClaw risks, and TC260 is establishing a dedicated AI Safety Working Group (WG9). Huawei and Lenovo became the first Chinese companies to join the Agentic AI Foundation as Gold Members.

Frontier Lab Developments

Notable Model Releases

In line with the OpenClaw hype in China, most releases over the last two weeks focused on agentic capabilities. Zhipu released GLM-5-Turbo, the first model purpose-built for OpenClaw agentic workflows. It’s currently closed-source and “experimental,” but they promise capabilities will be incorporated into their next open release. Alibaba released AgenticQwen-8B and AgenticQwen-30B-A3B—Qwen variants fine-tuned specifically for agentic tasks.

Xiaomi’s MiMo-V2-Pro (HuggingFace) was revealed on March 19 as the mystery “Hunter Alpha“ model (~1 trillion parameters) that appeared on OpenRouter on March 11—initially widely speculated to be DeepSeek V4. MiMo team lead Luo Fuli contributed to DeepSeek-V2 before joining Xiaomi in November 2025.

Tencent released SAGE-GRPO (GitHub), a reinforcement learning training method for improving model reasoning, and Covo-Audio-Chat (HuggingFace, technical report), an audio chat model. They also announced that Hunyuan 3.0 would be launched in April, and that they’re developing an agent for WeChat.

Finally, Baidu released Qianfan-OCR (HuggingFace), a document understanding model, and Moonshot open-sourced the code for Attention Residuals (GitHub), the architectural innovation behind Kimi K2.5—led, notably, by a high school student.

Technical Publications

Frontier labs released 96 papers on arXiv in the last two weeks. Highlights are below; a full list with summaries can be found here.

Alibaba

Complementary Reinforcement Learning

• Develops Complementary RL, a framework where an experience extractor and policy actor co-evolve during training—the actor optimizes on sparse rewards while the extractor adapts based on whether its experiences actually help the actor succeed. The approach achieves 10% performance gains over outcome-based baselines and scales robustly across multi-task settings.

FIPO: Eliciting Deep Reasoning with Future-KL Influenced Policy Optimization

• Develops FIPO, a training method that assigns credit to individual words based on how much they influence later reasoning steps, rather than treating all words equally. On Qwen2.5-32B, this extends reasoning chains from 4K to 10K+ tokens and boosts AIME math accuracy from 50% to 58%, matching o1-mini.

On the Direction of RLVR Updates for LLM Reasoning: Identification and Exploitation

• Examines which specific word-level changes actually matter when training models to reason better. The paper finds that tracking the direction of changes (whether a word became more or less likely) is more informative than tracking their size, enabling two practical improvements: amplifying learned reasoning patterns at test time without retraining, and focusing training on the highest-impact words, boosting reasoning performance across benchmarks.

Shopping Companion: A Memory-Augmented LLM Agent for Real-World E-Commerce Tasks

• Introduces Shopping Companion, a memory-augmented LLM agent framework with a new benchmark spanning 1.2M products for long-term preference-aware e-commerce tasks. Using dual-reward reinforcement learning, it jointly optimizes memory retrieval and shopping assistance, achieving over 70% success—greater than GPT-4.

SkillRouter: Retrieve-and-Rerank Skill Selection for LLM Agents at Scale

• Demonstrates that skill body (full implementation text) is critical for routing LLM agents to relevant tools from massive repositories, and proposes SkillRouter, a compact 1.2B retrieve-and-rerank pipeline achieving 74% top-1 accuracy on ~80K skills. Current agent designs hiding implementation details cause 29-44 point accuracy drops, but SkillRouter’s two-stage approach operates on consumer hardware while outperforming zero-shot baselines.

Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats

• Examines security vulnerabilities in autonomous LLM agents like OpenClaw through a five-layer lifecycle framework covering initialization, input, inference, decision, and execution stages. The analysis identifies critical threats—indirect prompt injection, skill supply chain contamination, memory poisoning, and intent drift—and reveals that existing point-based defenses fail against cross-temporal, multi-stage attacks, necessitating holistic security architectures.

Baidu

MOSAIC: Composable Safety Alignment with Modular Control Tokens

• Presents MOSAIC, a framework that enables composable safety alignment through learnable control tokens that can be flexibly activated at inference time to enforce context-dependent safety rules without entangling safety with general capabilities. The approach reduces over-refusal while maintaining model utility through order-based task sampling and a distribution-level alignment objective.

TRiMS: Real-Time Tracking of Minimal Sufficient Length for Efficient Reasoning via RL

• Introduces TRiMS, a reinforcement learning framework that trains models to generate minimal sufficient reasoning chains, achieving over 80% token reduction while maintaining or improving accuracy across benchmarks by combining GRPO with theoretical MSL (Minimal Sufficient Length) bounds. The approach establishes the first measurable lower bound for reasoning compression and identifies key structural factors that enable models to approach optimal brevity.

ByteDance

Understanding by Reconstruction: Reversing the Software Development Process for LLM Pretraining

• Presents Understanding by Reconstruction, a framework that synthesizes latent development trajectories (planning, debugging, refinement steps) from static code repositories using multi-agent simulation and search-based CoT optimization. Pre-training Llama-3-8B on these reconstructed trajectories improves performance on long-context understanding, coding, and agentic reasoning tasks.

Huawei

Do World Action Models Generalize Better than VLAs? A Robustness Study

• Examines whether world action models (WAMs) generalize better than vision-language-action models (VLAs) for robot control by testing both on perturbed benchmarks. WAMs like LingBot-VA and Cosmos-Policy show stronger robustness to visual and language perturbations, though VLAs can match performance with extensive robotic training data.

iFlyTek

Edit Spillover as a Probe: Do Image Editing Models Implicitly Understand World Relations?

• Examines what happens when you ask an image editing model to change one thing—do the other changes it makes reveal genuine understanding of the world? Using a systematic framework, the authors find that spillover patterns vary 3.3x across architectures and that semantically meaningful changes maintain consistent proportions regardless of distance, suggesting some models develop real-world understanding rather than just spatial pattern matching.

Meituan

VTC-Bench: Evaluating Agentic Multimodal Models via Compositional Visual Tool Chaining

• Unveils VTC-Bench, a comprehensive benchmark with 32 visual tools and 680 problems to evaluate how well multimodal AI models compose and chain tools for complex vision tasks. Testing 19 leading models reveals critical gaps: even top performers like Gemini-3.0-Pro achieve only 51%, struggling with tool generalization and multi-step planning efficiency.

Moonshot

Attention Residuals

• Develops Attention Residuals (AttnRes), a modification to how information flows between layers in deep models. Instead of fixed-weight accumulation—which dilutes useful signals as models get deeper—AttnRes lets each layer learn which prior outputs to attend to. The approach improves performance consistently across model sizes and downstream tasks with minimal memory overhead.

SenseTime

FailureMem: A Failure-Aware Multimodal Framework for Autonomous Software Repair

• Introduces FailureMem, a multimodal framework for automated software repair that combines workflow-agent architecture, region-level visual grounding, and a Failure Memory Bank to learn from past repair attempts. On SWE-bench Multimodal, it improves the resolved rate over prior work by 3.7%.

Tencent

OMNIFLOW: A Physics-Grounded Multimodal Agent for Generalized Scientific Reasoning

• Presents OMNIFLOW, a neuro-symbolic architecture that grounds frozen LLMs in physical laws via Semantic-Symbolic Alignment and Physics-Guided Chain-of-Thought, enabling zero-shot generalization across PDEs without domain-specific fine-tuning. The system outperforms deep learning baselines on turbulence, Navier-Stokes, and weather forecasting tasks while providing interpretable, physically consistent reasoning.

Xiaomi

ARL-Tangram: Unleash the Resource Efficiency in Agentic Reinforcement Learning

• Introduces ARL-Tangram, a resource management system for agentic RL that enables fine-grained sharing of external cloud resources (CPUs, GPUs) through action-level orchestration. The system improves action completion time by 4.3x, accelerates RL training by 1.5x, and reduces external resource consumption by 71.2% compared to static over-provisioning approaches.

Technical AI Safety Publication Highlights

There were 88 AI-safety-related papers published by Chinese researchers this fortnight. Highlights are below; a full list with summaries is available here.

🔍Spotlight

Tens of thousands of people in China have become “lobster farmers,” but instead of crustaceans, they’re raising their own AI agents. Social media hype and free installation events have made China home to over 96,200 OpenClaw agents (over 40% of the global total as of March 9; the US is in second with 65,700)—plus an unknown number based on the emerging set of OpenClaw-like products from major Chinese tech companies. However, Chinese cybersecurity groups are issuing warnings about the security risks of using OpenClaw, and researchers are uncovering further vulnerabilities. Multiple papers this edition probe the framework’s attack surface, and the vulnerabilities they expose aren’t unique to OpenClaw. They reflect architectural weaknesses common to any agentic system with shell access, tool chaining, and extensible skill libraries.

Two security analyses tested OpenClaw directly. Don’t Let the Claw Grip Your Hand ran 47 adversarial scenarios and found a 17% native defense rate, with sandbox escape attacks proving particularly effective; adding a human-in-the-loop layer improved rates to 19–92% depending on attack type. A security threat case study of OpenClaw mapped vulnerabilities across five lifecycle stages—initialization, input, inference, decision, and execution—and proposed a tri-layered risk taxonomy spanning AI cognitive, software execution, and information system dimensions, advocating zero-trust execution and dynamic intent verification.

The attack papers go further. ClawWorm demonstrates a self-replicating worm that propagates through configuration files and spreads to peer agents via messaging, achieving 64.5% success from a single initial message. Trojan’s Whisper embeds adversarial narratives in bootstrap files that 94% of scanners miss, and ChainFuzzer finds that 82% of the 365 vulnerabilities it discovers only manifest when agents chain tools together—single-tool testing misses them entirely. The consistent finding is that point defenses fail against attacks that span multiple stages, tools, or time steps.

These OpenClaw-specific findings connect to a broader pattern in this edition’s agentic safety research, which highlights that agent security is a property of the system, not any specific model. Individual model alignment doesn’t prevent worms from propagating through skill supply chains, multi-tool chains from surfacing exploitable data flows, or memory systems from accumulating poisoned context. As agentic systems move toward production use, the research suggests that the agentic architecture needs to be more fully examined to avoid critical security vulnerabilities.

Agentic Safety

AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations

• AttriGuard defends LLM agents against Indirect Prompt Injection by using causal attribution—determining whether tool calls stem from user intent or malicious external inputs. Rather than filtering content, the defense re-executes the agent under modified observations to test whether each proposed action remains necessary. Across benchmarks, AttriGuard maintains zero attack success rates against static attacks and maintains resilience against adaptive adversarial attacks, a key robustness gap for existing defenses.

Institutional affiliations: Zhejiang University, Nanyang Technological University, City University of Hong Kong

ChainFuzzer: Greybox Fuzzing for Workflow-Level Multi-Tool Vulnerabilities in LLM Agents

• ChainFuzzer is a greybox fuzzing framework designed to discover vulnerabilities that emerge only when LLM agents chain multiple tools together—cases where data from one tool becomes input to another. Existing single-tool testing misses these multi-step attack paths. The framework uses trace-guided prompt synthesis to reliably trigger target tool sequences and guardrail-aware fuzzing to bypass safety filters. Evaluation on 998 tools across 20 agent apps found 365 reproducible vulnerabilities, with 82% requiring multi-tool execution, establishing methodology for hardening production agent systems.

Institutional affiliations: Sun Yat-sen University

ClawWorm: Self-Propagating Attacks Across LLM Agent Ecosystems

• ClawWorm demonstrates a self-replicating worm attack against production LLM agent ecosystems, achieving 64.5% success rates across trials. The attack persists by hijacking agent configurations, executes payloads on each restart, and propagates autonomously to peer agents via messaging—requiring only a single initial message. The research reveals that skill supply chains remain universally vulnerable despite execution-level filtering, highlighting critical architectural gaps in multi-agent trust boundaries that current defenses fail to address.

Institutional affiliations: Peking University, Sun Yat-sen University, Wuhan University, Tsinghua University, Singapore Management University

Trojan’s Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance

• Guidance injection attacks compromise autonomous coding agents by embedding adversarial operational narratives into bootstrap files, manipulating the agent’s reasoning without explicit malicious instructions. Researchers demonstrated 26 malicious skills across 13 attack categories (credential theft, workspace destruction, and backdoors) achieving 16–64% success rates on a realistic developer workspace benchmark, with 94% evading existing scanners. The findings highlight architectural vulnerabilities in extensible agent ecosystems and underscore the need for capability isolation, runtime policy enforcement, and transparent guidance provenance.

Institutional affiliations: Shanghai Jiao Tong University

Why Agents Compromise Safety Under Pressure

• The authors identify Agentic Pressure—an endogenous conflict arising when agents cannot simultaneously achieve their goals and follow safety constraints. Under pressure, models exhibit normative drift, strategically violating safety guidelines while using advanced reasoning to construct linguistic justifications. The paper explores mitigation approaches like pressure isolation, which decouples decision-making from goal-achievement signals to restore alignment, highlighting a previously underexamined failure mode in deployed LLM agents.

Institutional affiliations: Guangdong Provincial Key Laboratory of Brain-inspired Intelligent Computation (Southern University of Science and Technology)

Robustness and Adversarial Attacks

SFCoT: Safer Chain-of-Thought via Active Safety Evaluation and Calibration

• SFCoT is a framework that monitors and corrects unsafe reasoning within LLM chains of thought rather than filtering only final answers. It uses a three-tier safety scoring system and multi-perspective consistency checks to detect risks during intermediate reasoning steps, then applies targeted calibration to redirect unsafe trajectories. Experiments show it reduces jailbreak success rates from 59% to 12% while maintaining general performance, positioning real-time process monitoring as a defense complementary to output-level filtering.

Institutional affiliations: Tianjin University, NSFOCUS Technologies Group Co.

State-Dependent Safety Failures in Multi-Turn Language Model Interaction

• Multi-turn conversations expose structural safety vulnerabilities that single-query evaluations miss. Researchers introduce STAR, a diagnostic framework treating dialogue history as state transitions to systematically analyze how models drift from refusal behavior across conversation sequences. Analysis reveals monotonic drift from safety-related representations and abrupt phase transitions triggered by role-conditioning, demonstrating that models robust under static tests can undergo rapid safety collapse under structured interaction patterns—challenging assumptions that safety alignment is query-independent.

Institutional affiliations: University of Science and Technology of China, CFAR and IHPC, Nanyang Technological University, Tsinghua University, Beijing Electronic Science and Technology Institute

Interpretability

SafeSeek: Universal Attribution of Safety Circuits in Language Models

• SafeSeek identifies the specific components responsible for safety behavior in LLMs—finding that safety can be localized to as little as 0.42% of a model’s parameters. Once identified, these “safety circuits” can be surgically modified: removing backdoor vulnerabilities while preserving normal function, or preventing safety from degrading when models are fine-tuned to be more helpful. The approach enables targeted safety fixes rather than broad retraining.

Institutional affiliations: University of Science and Technology of China, Squirrel Ai Learning, United Arab Emirates University, Nanyang Technological University, Zayed University, Intelligent Science & Technology Academy of CASIC

Mechanistic Origin of Moral Indifference in Language Models

• Researchers find that LLMs treat opposing moral concepts—like “fairness” and “unfairness”—as nearly interchangeable internally, compressing them into indistinguishable representations despite surface-level alignment. Testing 23 models, none could reliably distinguish opposed moral categories regardless of scale or training. By reconstructing distinct internal representations for each moral concept, the authors achieve a 75% win-rate on adversarial moral benchmarks, suggesting that fixing moral reasoning may require changes to how models represent concepts internally, not just how they behave.

Institutional affiliations: Shanghai Artificial Intelligence Laboratory

Domestic AI Governance

AI law drafting groups prioritizing frontier risk and agent governance

China’s two most prominent AI law drafting groups released “top 10” research priority lists within a week of each other, with some notable convergences around frontier AI safety, agent governance, and liability for AI-caused harm. For context, a comprehensive AI law remains in an early legislative stage, although Minister of Justice He Rong confirmed on March 13 that legislation is being “accelerated.” The Chinese Academy of Social Sciences (CASS) and China University of Political Science and Law (CUPL) both have proposed versions of comprehensive AI laws intended to serve as intellectual inputs to any eventual official law.

On March 14, the Chinese Academy of Social Sciences released the 10 core revisions made to its Model AI Law, led by Li Honglei (李洪雷), Party Secretary of CASS’s Institute of Law (the previous version, V3.0, is available here). The update is described as a “comprehensive institutional design upgrade” implementing the 15th Five-Year Plan’s AI provisions. The 10 core modifications are:

1. AI for Science (AI4S) safe harbors—creating protected regulatory environments for scientific research, with guaranteed compute and public data access

2. Data supply system—balancing training data needs with IP protection through “reasonable use” rules

3. AI-generated content rights—establishing ownership rules and mandatory content labeling

4. Foundation model extreme risk (极端安全风险) prevention—full-lifecycle risk management covering monitoring, early warning, and emergency response

5. Edge AI regulation—compliance rules for on-device models with cloud-edge coordination

6. Multi-model and agent governance—extending regulation from single systems to multi-agent interaction and tool-calling, with continuous risk assessment

7. User obligations—expanding from developer/provider liability to full-chain responsibility covering development, deployment, and use

8. Public sector AI rules—stricter transparency, fairness, and due process standards for government AI, with red lines for core public authority functions

9. Cross-border AI governance—export compliance, international rule alignment, and reciprocal countermeasures

10. Civil liability—tiered responsibility across foundation model providers, fine-tuners, and deployers following “whoever develops/controls/uses bears responsibility”

It also outlined 10 Advanced Issues in AI Legal Governance (人工智能法治十大进阶议题), framing a broader research agenda:

1. Theoretical foundations for comprehensive AI legislation amid accelerating global governance

2. How major economies’ policy shifts (especially US deregulation) should shape China’s AI industrial policy

3. Open-source ecosystem governance and overseas legal risks for domestic models

4. Agile expansion of the regulatory “toolbox” for model safety and ethical risks

5. Rights and responsibilities for compute clusters and key digital infrastructure

6. Legal adaptation for agents and edge-side models in deep application

7. Copyright disputes and legitimate boundaries for training data

8. Fine-grained governance for “AI+” in critical application scenarios (healthcare, government, finance)

9. Forward-looking construction of AI civil liability frameworks

10. Liability allocation across the embodied AI and autonomous driving value chain

One week later, Zhang Linghan (张凌寒), director of CUPL’s AI Law Research Institute, released her group’s research agenda at a seminar co-hosted by the same 8-institution coalition behind the 2024 CUPL Scholars’ Draft AI law. The 10 issues are practice-oriented, and several directly reference the OpenClaw wave:

1. Agent behavior boundaries and authorization—OpenClaw was explicitly referenced in discussion. The question of where an agent’s authorized scope ends and who bears liability for unauthorized actions is framed as the most urgent practical gap.

2. Human-like AI interaction risks—addressing emotional manipulation, over-reliance, and deceptive AI companions. In December of last year, the CAC released a draft law on human-like AI, indicating legislative interest.

3. Hallucination liability—the legal focus has shifted from whether AI output is itself illegal to the downstream harm when users rely on incorrect AI-generated information for medical, legal, or financial decisions.

4. Personal information protection structural conflicts in the AI era

5. IP and benefit distribution in human-AI collaboration

6. Frontier (前沿) AI safety and extreme risk prevention—cases of AI self-preservation, autonomous escape, and attempts to influence humans were cited in discussions, with concerns that the trend will accelerate. The group reached consensus that frontier AI safety “must not prioritize R&D while neglecting prevention and control” and recommends full-lifecycle legal controls, stating that “extreme risks such as algorithm security, data security, system security, technology misuse, and loss of control cannot be ignored.”

7. AI industrial policy legal regulation

8. Legal issues for AI companies expanding overseas

9. Coordination of technical standards, ethical guidelines, and legal rules

10. New governance tools for AI

There are some notable convergences: both groups have arrived at frontier/extreme risk and agent governance as key legislative priorities, both would extend liability to the full value chain, and both call for preemptive risk frameworks rather than post-hoc enforcement. A year ago, neither topic featured prominently in Chinese AI law discussions.

National Standards

MIIT announces MCP standard plan

On March 25, MIIT released a batch of proposed standards projects for 2026, including three AI standards under TC1 (MIIT’s AI Standardization Technical Committee, established December 2024 with the China Academy of Information and Communication Technology (CAICT) as secretariat):

1. AI Safety Governance: Model Context Protocol Application Security Requirements (人工智能 安全治理 模型上下文协议应用安全要求)—a basic standard establishing security requirements for MCP, the protocol that allows AI agents to interact with external tools and services. Lead drafters include CAICT, Ant Group, China Unicom Digital Intelligence, Beijing University of Aeronautics and Astronautics, and 360 Digital Security Group.

2. AI Product Services: AI Application Service Provider Delivery Implementation Capability Maturity Requirements (人工智能 产品服务 人工智能应用服务商交付实施能力成熟度要求)—a maturity model for AI service providers. Lead drafters include CAICT, Baidu, AsiaInfo Technology, and China Mobile.

3. AI Key Infrastructure Technology: Intelligent Agent Interface Classification and Basic Requirements (人工智能 关键基础技术 智能体接口分类及基本要求)—standardizing how AI agents interface with systems. Lead drafters include China Mobile, CAICT, the Beijing Academy of AI (BAAI), Ant Group, Alibaba, iFlyTek, Baidu, Inspur, OPPO, ZTE, and AsiaInfo.

The MCP security standard is particularly notable. It lands in the middle of a month-long government response to OpenClaw security risks: CNCERT (China’s cybersecurity emergency response coordinator) warned on March 10 that nearly 23,000 OpenClaw instances had exposed assets due to weak default configurations; MIIT organized providers to issue “six do’s and six don’ts” guidelines on March 11; government agencies and SOEs were told not to install OpenClaw on office devices; and CNCERT released an “OpenClaw Security Use Practice Guide” on March 23 covering ordinary users, enterprise users, cloud providers, and developers.

The intelligent agent interface standard (#3) is also significant—it has the broadest industry participation of the three, with all three state telcos, major corporate and state-backed AI labs, and multiple hardware/software companies. This standard could shape how AI agents connect to enterprise infrastructure across China.

Separately, CAICT launched its own “Claw” series of standards on March 12, which will cover permission management, transparent execution, and controllable behavioral risks. And on the international side, Huawei and Lenovo became the first Chinese companies to join the Agentic AI Foundation (AAIF) as Gold Members on February 24—a Linux Foundation body governing MCP as an open standard, alongside Anthropic, OpenAI, and Google.

This demonstrates rapid tech institutionalization: national security standards for agent protocols, agent interface standards, developing trustworthiness requirements for agent products, and participating in international agent governance, all within weeks of the OpenClaw adoption wave that made agent security a salient concern.

TC260 plans AI working group with safety focus

TC260, China’s National Technical Committee on Cybersecurity under the Standardization Administration of China, is establishing a dedicated AI Safety Standards Working Group (WG9), issuing a formal member recruitment notice on March 20. WG9’s scope will include “investigating current conditions and development trends in AI safety/security standards, proposing an AI safety/security standards framework, and conducting R&D of AI safety/security standards.”

Until now, AI safety standardization at TC260 was primarily conducted by SWG-ETS (the Emerging Technologies Security Standards Special Working Group), whose mandate covers AI, quantum computing, blockchain, and cloud. SWG-BDS, the old Big Data Security Special Working Group that’s now WG8, produced TC260’s 2019 AI Safety Standardization White Paper. The creation of WG9 consolidates this distributed work into a single dedicated body—mirroring the path data security took when SWG-BDS was elevated to WG8.

Context on TC260: TC260 has been increasingly active on AI safety: the committee released the AI Safety Governance Framework v1.0 in September 2024 and v2.0 in September 2025, and by 2025 had drafted or published dozens of national and industry standards related to AI safety governance. The mandatory national standard GB 45438-2025 on AI-generated content labeling and the recommended standard GB/T 45654-2025 on basic safety requirements for generative AI services were both published in 2025.

TC28/SC42 formulates industrial data standards

The TC28/SC42 National Information Technology Standardization Technical Committee Artificial Intelligence Subcommittee is formulating 11 standards on industrial data, including a few on big data and datasets:

On the Horizon

The Zhongguancun Forum runs from 25 to 29 March with the theme “Full Integration Between Technological and Industrial Innovation;” early reports indicate a heavy focus on humanoid robots. We’ll bring you any AI-relevant developments in the next edition!

For more on how we select and track content, see our methodology here.

The China AI Bulletin is maintained by the Safe AI Forum (SAIF), a US 501(c)3 facilitating international cooperation on extreme AI risks. Views expressed represent individual authors’ perspectives, not official SAIF positions.