Think tank proposes email-style channel for US-China AI incident alerts

Where the mechanism stands

According to the IAPS memo, U.S. Treasury Secretary Scott Bessent said after meeting Chinese Vice Premier He Lifeng on September 20, 2026 that the United States had proposed a "notification mechanism" for AI incidents that could affect national security. Both countries later agreed to it at the Trump-Xi summit. The memo says some U.S. officials believe the channel could be established by the end of 2026.

The paper, written by Sarah Godek and coauthored by Clarissa Koh, Karson Elmgren, Cara Labrador and Craig Jolley, is meant to be ready ahead of the next meeting between Bessent and He. It covers how communication should work, who should be notified, what should be shared, and when the channel should be used.

Email over hotline, principals first, then agencies

The authors argue for text-based asynchronous notification, such as an email connection, rather than a telephone hotline. They say synchronous hotlines do not fit the Chinese political context, where lower-level officials are generally not authorized to have impromptu conversations with foreign counterparts. The memo points to precedents: a U.S.-China space safety email link set up in 2015, the Washington-Moscow "hotline" that uses email, and the U.S. and Russian Nuclear Risk Reduction Centers, which have exchanged thousands of written notifications per year since 1987.

To start, the channel would be a voluntary, direct link between Bessent and He. The memo notes that neither is close to where an incident would occur. AI incidents will likely be first detected by frontier developers, military cyber entities, or cloud providers' cybersecurity teams, and escalation to principals may take too long. Over time, notification should be delegated to agencies. The authors say government-to-government contact is needed because some Chinese developers are under U.S. sanctions and China controls export of sensitive data, which exposes private companies to regulatory risk.

The memo suggests pairings by incident type:

• General frontier incidents: the U.S. Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) with a technical Chinese counterpart such as TC260's Working Group 9, the China Academy of Information and Communications Technology (CAICT), or the Shanghai AI Laboratory. Examples include model self-exfiltration, autonomous replication, or concerning steganographic collusion between models.
• Non-military AI-enabled cyber incidents: DHS and CISA with the Cyberspace Administration of China and CNCERT/CC. The FBI and China's Ministry of Public Security could handle incidents involving non-state actors, such as attempts to use models for hacking financial infrastructure or bioweapons development.
• Military AI-enabled incidents: a U.S. Cyber Command and PLA Cyberspace Force channel for cyber incidents, and adaptation of the existing Defense Telephone Link and theater command-level communications for physical incidents like rogue autonomous vessels.

Making the channel reliable and trusted

The authors say the channel should begin on a voluntary basis to be effective immediately, with reliability added later. They report early signs that Beijing may be receptive: Yuyuan Tantian, a commentary account affiliated with state broadcaster CCTV, has suggested both sides could discuss what happens when a party does not follow through on notification requirements.

A near-term option is an MOU, which the memo describes as more binding than a stated commitment and useful for clarifying process and notification thresholds. The two countries are reportedly considering an MOU on military crisis communication, and the authors suggest one on AI incident notification could follow. They advise against an automatic cancellation mechanism for non-use, which would be hard to adjudicate, and against export controls as leverage, which they say would likely be politically disruptive.

On trust, the memo says the sides should discuss what evidence to provide in which circumstances, and that incident information depends on logging of AI development and deployment activities. Over time they could move toward a verified architecture in which shared information is validated securely and privately. In one example, recomputation and zero-knowledge proofs could show that a malfunction followed from a benign prompt without disclosing the agent's actions or model weights. Tamper-proof logging can ensure logs are not modified after generation, and the Office of the Director of National Intelligence and related agencies can help validate information received.

A template for the first hours

IAPS also proposes a written notification template listing the fields a receiving government would need in the first hours of an incident. It follows three principles: it can be sent within hours of detection, it focuses on facts and confidence levels rather than attribution, and it includes the minimum required technical detail.

The memo says the template should come with a pre-agreed understanding of what the recipient may do with the information. By default, a notification would be confidential government-to-government communication, used only for incident response. The source text is cut off before the remaining restrictions on onward sharing are listed.

For the market and policymakers, the memo is a concrete blueprint rather than an official plan. It shows what one policy institute thinks a workable first version could look like, with the final design left to the two governments.