Trump and Xi Agree to Explore AI Safety Guardrails — But Skeptics Say the Devil Is in the Details

When Donald Trump boarded Air Force One in Beijing on May 15, he carried news that would have seemed implausible even six months ago: he and Chinese President Xi Jinping had discussed, in direct terms, the prospect of the world’s two largest AI powers coordinating on safety guardrails for frontier artificial intelligence.

“We discussed possibly working together for guardrails,” Trump told reporters during the return flight — careful, hedged language, but language nonetheless from a president who has generally treated AI regulation as an obstacle to American competitiveness rather than a priority in its own right.

Treasury Secretary Scott Bessent, who accompanied Trump to Beijing, provided more texture on CNBC shortly after. The discussions would focus on how to formulate “best practices for AI to make sure nonstate actors don’t get a hold of these models” — a framing that positions the threat not as one country’s AI against another’s, but as a shared vulnerability to AI capabilities falling into the hands of non-governmental actors.

What Changed the Calculus

The timing of this diplomatic moment is not accidental, and a single event more than anything else explains why both governments now feel urgency where they previously felt comfortable with strategic ambiguity.

In early April 2026, Anthropic published a controlled technical assessment of Mythos Preview — a frontier AI model the company declined to release publicly specifically because it concluded the model posed unprecedented cybersecurity risks. The assessment documented that Mythos had independently identified exploitable vulnerabilities in every major operating system and web browser it was asked to analyze, producing working exploit code in several cases.

The assessment was deliberately public and deliberately alarming. Anthropic’s explicit message: this is what capability levels the industry has already reached, before public deployment. The implicit message, quickly absorbed by national security establishments in Washington, Beijing, and allied capitals: if a safety-focused American AI lab has built something with this capability, it is reasonable to assume that others — including state actors with fewer constraints on deployment — have built or will soon build something comparable.

For the Trump administration, which had previously invoked the Defense Production Act to require companies training the largest AI models to share safety testing results with government regulators, Mythos was the concrete example that gave that policy teeth. For Beijing, it was a demonstration that American AI development had moved into a zone where unilateral action looked inadequate.

What Was Actually Agreed — and What Wasn’t

The gap between “discussed the possibility of guardrails” and “agreed on guardrails” is significant, and analysts are spending considerable energy parsing exactly where the Beijing talks landed.

Bessent’s public statement used the phrase “agreed AI guardrails” — a characterization that sounded more concrete than Trump’s own phrasing. But subsequent reporting from Axios, the Council on Foreign Relations, and Carnegie Endowment experts suggests that no formal agreement exists: no named structure, no agreed scope, no working group, and no timeline for follow-up conversations.

What does appear to exist is a mutual acknowledgment that frontier AI merits some form of bilateral dialogue — which is itself more than existed before. The US and China have conducted limited AI safety conversations through back-channel academic exchanges since 2024, but these Beijing discussions represent the first explicit presidential-level engagement on the subject.

Gizmodo captured the skeptical view sharply: “Trump Says He Discussed ‘Standard’ AI Safety Guardrails With Xi. There’s No Such Thing.” The point is legitimate — there is no internationally agreed framework for what AI safety guardrails means, no body that could enforce them, and significant definitional disagreement about which AI capabilities are dangerous enough to merit coordination.

The Structural Complications

Even if both governments wanted to rapidly formalize an AI safety framework, the structural complications are formidable.

The most fundamental problem is that AI-enabled cyber offense is already deeply embedded in both nations’ strategic planning. The US intelligence community has been exploring frontier models for signals intelligence, vulnerability discovery, and influence operations. China’s People’s Liberation Army has been extensively documented using AI for similar purposes. Both sides are, in effect, being asked to constrain tools they are actively developing and deploying.

The chip export controls that have defined US-China tech relations since 2022 add another layer of complexity. Washington has spent three years trying to deny Beijing access to advanced semiconductors for AI training. It is strategically awkward to simultaneously pursue export controls — a policy premised on the belief that Chinese AI development is a national security threat — and cooperative AI safety measures that would require some degree of information sharing.

There is also the question of what “nonstate actors” means in practice. The stated mutual concern is AI capabilities reaching terrorist groups, criminal organizations, or rogue states. But the definition of who qualifies as a problematic actor, and what AI capabilities are dangerous enough to merit coordinated prevention, is itself deeply political.

What Experts Recommend

The foreign policy establishment has been thinking about US-China AI dialogue for several years, and the emerging consensus is more cautious than the Biden-era optimism about multilateral AI governance.

The Council on Foreign Relations has recommended what it calls “targeted dialogue with maximum pressure” — limiting AI safety conversations to narrow, specific technical areas (biological AI risk, nuclear command-and-control AI, autonomous weapons) while maintaining competitive pressure on capability development and market access. The argument is that broad cooperation is both politically infeasible and strategically unwise; targeted dialogue on the most catastrophic risk categories might be achievable.

Carnegie Endowment researchers framed the current moment as “a previously impossible AI conversation” that is now becoming necessary. Their analysis focuses on the specific overlap between AI capability advances and traditional arms control frameworks — noting that classic Cold War verification mechanisms may provide a template for some AI safety measures, though the technology makes verification much harder.

What Comes Next

The immediate successor to the Beijing discussions is unclear, and the administration has been careful not to oversell what was agreed. But several concrete markers will indicate whether this represents a genuine diplomatic opening or a presidential aside that evaporates under the weight of US-China competition.

The first marker is whether a formal working group or diplomatic contact point gets established. Without institutional continuity, AI safety discussions remain dependent on presidential-level goodwill that can evaporate with any given geopolitical event.

The second marker is whether the discussions remain at the level of “nonstate actors” — a relatively uncontroversial framing — or begin to address the harder questions of state-sponsored AI capabilities and autonomous weapons. The harder conversation is the more consequential one.

The third marker is the reaction from allies. Japan, South Korea, the EU, and the UK have their own stakes in how frontier AI is governed internationally. A bilateral US-China framework that excluded allies would create its own set of strategic complications.

For now, what exists is a signal — from the two countries that between them account for the majority of global AI investment and capability development — that frontier AI has entered the realm of strategic dialogue that requires head-of-state attention. Whether that signal leads anywhere concrete will define a significant part of the AI governance story for the rest of the decade.