Join War on the Rocks and gain access to content trusted by policymakers, military leaders, and strategic thinkers worldwide.
In the lead-up to General Secretary Xi Jinping’s September 2026 visit to the White House to discuss, among other topics, AI, U.S. Treasury Secretary Scott Bessent met with Chinese Vice Premier He Lifeng at JPMorgan Chase’s New York City offices. At the meeting, U.S. officials proposed establishing a dialogue between the United States and China, which would serve as a mechanism for notification of AI-related national security incidents. Bessent clarified the intent as: “We think that just like with any cross-border activity, that moving from opaque to more transparency between the No. 1 and the No. 2 AI powers in the world is very important.”
The Chinese government readout of the subsequent meeting between Xi and U.S. President Donald Trump stated the two countries “can continue their dialogue on AI, exchange views on its risks and benefits, and jointly prevent the misuse and abuse of AI,” and affirmed that “AI must be kept under human control.” The latter statement echoes the countries’ 2024 agreement about the role of human control in nuclear weapons, where the United States and China agreed to “the need to maintain human control over the decision to use nuclear weapons.” Meanwhile, the U.S. readout of the 2026 meeting noted that the United States and China agreed to establish the “U.S.-China Super Intelligence (SI) Dialogue to exchange views on risks and benefits related to SI. The next exchange will occur by November 2026.” They also agreed to form “a bilateral communication channel for SI incidents.”
What purpose might this agreement serve? And what should the upcoming November 2026 exchange of views between the United States and China about AI tackle first (and what should it avoid)? The proposed dialogues and communication channels would not restrain AI innovation on the part of the United States or China, nor would they change the underlying balance of AI power between them. They also do not come with any enforcement or verification mechanisms. In other words, they do not represent a form of AI arms control.
Instead, it is more useful to evaluate these efforts through the lens of confidence-building measures: voluntary, non-binding measures aimed at reducing opacity and facilitating communication between rivals in ways that could, potentially, reduce tensions and the risks of inadvertent or accidental escalation — in this case, as they pertain to AI. The Cold War history of confidence-building measures between the United States and the Soviet Union can shed some light on the prospects of AI confidence-building measures between the United States and China in the contemporary era. But there are elements of both the geopolitical context and the nature of AI technology that suggest new challenges and opportunities for confidence-building measures.
When it comes to the military applications of AI, the United States and China both perceive a salient tradeoff. On the one hand, they are locked in a broader strategic and geopolitical rivalry, of which fierce competition — or even an “arms race” — over AI is an integral component. Indeed, as Trump opined in the context of U.S.-Chinese relations, “whoever wins AI wins.” AI is a central component of China’s most recent five-year plan, which calls on the country to “seize the commanding heights of science and technology development.” AI provides potentially transformative military advantages, including improving intelligence collection and analysis, decision-support, targeting recommendations, command and control, autonomous maneuver and target acquisition, and even improving routine “back office” functions of military organizations. This is only underscored by recent demonstrations of AI tools on the battlefield in the conflicts in the Middle East and Ukraine.
At the same time, both countries share mutual concerns about AI’s national security risks, particularly the extent to which systems may be implicated in decisions about the use of nuclear weapons (though China sees the security risks of AI from both an international security and regime and party security perspective). As AI technologies are increasingly incorporated into the military capabilities and decision-making process of two nuclear-armed great powers, this creates new, potentially destabilizing risks. In a 2021 official position paper about regulating military applications of AI, for example, China recognized the risks that AI may pose for “the deepening of strategic miscalculation, undermining of strategic mutual trust, escalation of conflicts, and damaging global strategic balance and stability.”
Even if neither party fully delegates control over the actual deployment of nuclear weapons to intelligent machines, the integration of AI into the broader set of capabilities and decisions related to nuclear command and control, early warning, and launch decisions creates new forms of uncertainty and may exacerbate escalation risks.
For example, using AI tools to support decision-making around nuclear use or provide various courses of action may bias decisions in favor of more escalatory options. Research has shown that some large language models (including China’s DeepSeek model) are more inclined to recommend nuclear options during simulated crises. Relying on AI for intelligence and early warning may result in skewed (or, more concerningly, hallucinated) intelligence analysis, distorting assessments of impending nuclear threats. Just this spring, a false, AI-generated intelligence report nearly “started a war” between the United States and China during the U.S. military operation against Iran. Even if both the United States and China presumably want to “win” the AI race, neither would prefer to inadvertently or accidentally stumble into an AI-triggered war (especially a nuclear one).
One way to manage these risks is through arms control agreements. Indeed, there are growing calls among some experts and practitioners to work toward arms control for AI, especially between the United States and China. But this is problematic, both because of global arms control trends and because of the nature of AI technology. With the expiration of New START in February and the emergence of a new, tripolar nuclear age, there appears to be little appetite among great powers for new arms control agreements. As a dual-use, general-purpose technology, AI also presents distinct impediments to arms control, giving rise to both challenges in detecting cheating and willingness to disclose capabilities. On top of this, deep uncertainty about the future military implications (and advantages) of AI and the rapid pace of innovation are likely to make great powers reluctant to accept any constraints on AI development.
But arms control is not the only option. Historically, confidence-building measures have emerged, even among rivals, in contexts where states perceive a shared interest in facilitating communication and promoting transparency around military capabilities to avoid outcomes, such as inadvertent conflict, that are mutually understood to be detrimental. Confidence-building measures were developed during the Cold War in the wake of the Cuban Missile Crisis for precisely this purpose. In 1963, the United States and Soviet Union formed a bilateral hotline to institute a means of crisis communication. During the 1967 and 1973 wars between Israel and its Arab neighbors, the United States used the hotline to communicate with the Soviet Union to prevent miscalculations. As détente became increasingly fragile in the late 1970s, the 1963 hotline eventually led to the 1987 agreement to establish Nuclear Risk Reductions Centers within the U.S. State Department and Soviet Ministry of Defense. More recently, in 2013, the centers’ role was extended to communicate about crises related to information and communications technologies, such as cyber crises. Former U.S. President Barack Obama used the hotline on Oct. 31, 2016, to warn Russian President Vladimir Putin about cyber-enabled election interference.
Another notable Cold War confidence-building measure agreement includes the 1972 Incidents at Sea Agreement between the United States and the Soviet Union to reduce the risks of maritime crises. The 1975 Helsinki Final Act, under the auspices of what was then the Conference on Security and Co-operation in Europe, is another paradigmatic example. It has since been renegotiated and expanded multiple times, most recently in the 2011 Vienna Document.
Confidence-building measures are not a panacea for fostering stability between great power rivals, and they often lack the verification and enforcement mechanisms that are a hallmark of arms control agreements. Their voluntary nature makes confidence-building measures relatively easy to abrogate. For instance, following its full-scale invasion of Ukraine, in 2023 Russia announced that it would stop sharing information about its armed forces per the provisions of the Vienna Document. The process of negotiating confidence-building measures may also become an end in itself, eclipsing a narrower (and potentially more fruitful) focus on the tangible military and security benefits that confidence-building could accomplish. That said, well-scoped efforts to facilitate communication between rivals, especially during times of crisis, often represent an improvement from the status quo. Moreover, while confidence-building measures are unlikely to deter aggression, observing deviations from shared expectations about behavior developed through confidence-building could provide early warning.
Therefore, despite their constraints, the fact that the United States and Soviet Union could establish confidence-building measures during the Cold War to mitigate escalation risks suggests some optimism about a U.S.-Chinese agreement for AI. However, four factors unique to AI also suggest limitations around generalizing from the historical lessons of Cold War confidence-building measures to the present situation.
The first limitation is that, thankfully, a Cuban Missile Crisis-type of event has not yet occurred for AI. Setting aside legitimate skepticism about the doom narrative that tech leaders, especially in the United States, are promulgating, the reality is that there simply has not been a crisis between the United States and China triggered by AI that comes close to the magnitude of 1962. The Cuban Missile Crisis was a formative moment because it crystallized a vivid, salient, shared sense of nuclear danger, prompting efforts to institutionalize mechanisms to avoid such dangers even under heightened geopolitical tensions. In the absence of an AI crisis of comparable magnitude, it is not clear that both sides agree on a shared set of nuclear risks related to AI, beyond the broad acknowledgment that maintaining some degree of human involvement in decisions about nuclear use is important.
Second, and relatedly, there is little agreement between the United States and China about key terms and concepts related to AI escalation. For example, both states have articulated different definitions of what might constitute a lethal autonomous weapon (and, therefore, what class or type of weapon might warrant greater restrictions or even an outright ban). China applies a high threshold, defining “unacceptable” lethal autonomous weapons as those that meet five criteria, such as acting across the kill chain with an “absence of human intervention and control during the entire process of executing a task.” It is not clear that any current capability satisfies all five criteria. The United States defines such a system as one that, “once activated, can select and engage targets without further intervention by an operator.” There are also distinct concepts of the role of human beings in decisions about the use of force. U.S. policy distinguishes between “appropriate levels of human judgment” in decisions about autonomous and semi-autonomous weapon systems (a more permissive approach), while calling for “human control” in the context of decisions about using nuclear weapons. In a 2025 white paper, China uses slightly different language, affirming that “it is essential to ensure that human beings take the ultimate responsibility and that all relevant weapons systems are under human control to prevent unauthorized actions.”
The third issue is that, unlike nuclear weapons, AI is not a weapon system. It is a general-purpose technology that not only has manifold civilian applications, but it also has varied military applications relevant for nuclear and non-nuclear conflicts. This means that conversations about how to construct stabilizing measures to mitigate the potential escalation risks stemming from AI, even if they are narrowly scoped to focus on the nexus of AI and nuclear weapons, have to cover a lot of ground. Many AI applications beyond the discrete concern about human control over the decision to launch nuclear weapons, as noted earlier, may also contribute to nuclear instability. At the same time, many of these capabilities are also important for the overall military competition, limiting the prospects of voluntary restraints.
Finally, the private sector is an integral actor in any AI confidence-building measure effort. The costs, resources, institutional knowledge, and skill necessary to sustain continued innovation at the AI frontier mean AI power is concentrated in a handful of firms that control access to key AI inputs. Militaries are uniquely dependent on these private firms. Yet, these actors have their own equities and interests in AI that may not converge with government interests, especially around potential confidence-building efforts that involve more intrusive measures to inspect AI systems at the design and development stage or share sensitive information.
In light of these factors, how should the upcoming bilateral conversations between the United States and China proceed? Policymakers should prioritize four specific lines of effort.
First, perhaps counterintuitively, broader sensitivities in the U.S.-Chinese relationship about AI may create space for both parties to make progress around narrower, mutually shared concerns about nuclear escalation, provided that more contentious issues are understood to be off the table. U.S. interlocutors, in particular, may be tempted to broach topics that go beyond the issue of AI-related nuclear risks, strategic stability, and how to mature mechanisms to mitigate escalation. These may include other important policy challenges, such as addressing disagreements about what constitutes AI safety and security risks more broadly, global governance of AI, export controls and restrictions on Chinese AI models, and other related areas where there are significant gaps between the U.S. and Chinese positions.
The U.S.-Chinese AI dialogue should focus on building progress within the one clear area where both parties have already reached some form of agreement: human control over decisions to use nuclear weapons. The challenge will be how to construct the conversation in such a way that avoids playing into Chinese concerns about U.S. efforts to arrest China’s AI development. Recent calls from U.S. AI leaders, such as Anthropic CEO Dario Amodei’s appeal to “pace the frontier,” are not conducive to progress on confidence-building because they reinforce Chinese perceptions that the United States is seeking to consolidate its advantages and restrict more open approaches or AI diffusion in ways that might benefit China. That may be the case (and may be the right policy), but it is a distraction when it comes to confidence-building measures to manage escalation.
Second, policymakers should aim to build on the existing foundation of the 2024 agreement about human control over nuclear weapons, rather than expanding the scope of the dialogue. The simple statement that humans should control nuclear use decisions leaves much unsettled and insufficiently defined, particularly in light of competing terminology and definitions both states have advanced on this issue. Therefore, the initial rounds of the dialogue should laser-focus on improving the clarity and consistency of core concepts and definitions. Parties should build on the 2024 agreement to develop a confidence-building framework that more clearly defines shared understandings about what constitutes “autonomous” capabilities and what human control means in practice, not only for the specific decision to launch nuclear forces, but also for related issues around early warning and nuclear command, control, and communications.
Third, policymakers should home in on getting to common ground about observable behavior. The focus should be less on restrictions on the development of the technology itself, but more on working toward the development of observable indicators about the use of AI in nuclear systems that both parties agree would be dangerous. Both sides would benefit from shared understandings about the potential pathways to and off-ramps from escalation at the AI-nuclear intersection, and the observable patterns and indicators that the situation may be increasingly on or off those escalation pathways — or, at a minimum, exchanging information about how each side would perceive different types of escalation scenarios. Such information could be exchanged in a way that does not reveal sensitive information about AI systems, but is instead focused on behavior and organizational and decision-making processes.
Finally, how the U.S. government makes choices around regulating frontier AI labs and the firms that control related AI infrastructure inputs can be a form of confidence-building. Confidence-building measures do not need to be official agreements with rivals. Unilateral, voluntary declarations of restraint can also be a way to build confidence, and can run parallel to or support bilateral or multilateral agreements. Therefore, how the government opts to collaborate with (and control) the firms responsible for designing and developing AI systems relevant for military operations, command and control, and decision-making is relevant for the prospects of confidence-building with rivals like China. Instantiating regulatory regimes or other frameworks for relevant private actors around things like incident reporting about accidents or unintended negative outcomes, or sharing information about safeguards around system design for certain applications, can buttress the credibility of adversary-facing confidence-building measures. In turn, failure to instantiate these domestic-level mechanisms may undermine the effectiveness of any future U.S.-Chinese agreement.
Looking ahead, there may also be opportunities to explore cross-domain confidence-building efforts in light of the operational linkages between related technologies and operating environments, especially AI, cyberspace, outer space, and nuclear systems. This suggests other issue areas where the United States and China may perceive common concerns, such as around the cybersecurity of AI systems. Recent examples in both countries, such as OpenAI agents hacking Hugging Face or research demonstrating the use of the AI tool “WeWorm” to hack WeChat, highlight these concerns. Successful confidence-building measure efforts in one issue area could be used as scaffolding to build in other areas. But the focus in the immediate term should be on the most exigent risks.
The United States and China are only in the early stages of meaningful confidence-building measures to reduce AI escalation risks. Moreover, confidence-building measures are not a panacea for stabilizing great power relations (and were never intended to be). However, the fact that both the United States and China already perceive incentives to form confidence-building measures around AI and nuclear risk is an important starting point.
Erica D. Lonergan is an assistant professor in the School of International and Public Affairs at Columbia University. This article was initially drafted for a Perry World House conference on “Emerging Technology Agreements for Nuclear Risk Reduction,” which was made possible in part by a generous grant from the Consortium to Reduce Nuclear Dangers. The views expressed are solely the author’s and do not reflect those of Perry World House, the University of Pennsylvania, or the Consortium to Reduce Nuclear Dangers.
Image: U.S. Department of the Treasury via Wikimedia Commons
