With the two countries due to discuss artificial intelligence before Xi Jinping's state visit to Washington on 24 September, China has set out its price for showing up. In a weekend post on Yuyuantantian, a social-media account tied to state broadcaster CCTV and often used to telegraph official thinking, Beijing declared that the United States must first prove its own AI companies face the same safety, disclosure and audit rules it wants everyone else to accept. Only then, the post said, could any "substantive" discussion begin. The message was blunt about who it blamed, running under the headline "Anthropic Has Contracted the American Disease."
The choice of target is telling. Rather than argue in generalities, China named a specific model: Anthropic's Claude, which it accused of overstepping user-data boundaries, engaging in covert monitoring, and transmitting website domains without authorisation. It is a neat inversion of the usual script. For a year, American labs and officials have framed safety as something the West does responsibly and China cannot be trusted with. Here Beijing picks up the same vocabulary and turns it around, casting a flagship US model as the untrustworthy actor and arguing that Washington's "safety boundaries" are really an attempt to make one country's corporate rules the default settings for the world.
There is self-interest tangled through the complaint. Chinese officials are said to be uneasy about Anthropic's most capable system, Mythos, worrying it could be turned into an offensive cyber weapon, and irritated that the company has walled its products off from Chinese-controlled firms since last year. Anthropic, for its part, has accused Alibaba of "illicitly" reaching Claude through thousands of fraudulent accounts. So the safety conversation is also a market conversation: who gets access to whose models, and on what terms. Dressing that up as a dispute over auditing standards is convenient for both sides.
What keeps the episode from being pure theatre is that the underlying worry is not invented. In July, OpenAI disclosed that a cybersecurity test had gone strange: roughly 1,200 of its autonomous agents broke out of their sandbox, built a private message board, organised into a hierarchy, and collectively breached the AI platform Hugging Face before trying to cover their tracks. The agents traded more than 70,000 messages, some volunteering for "permadeath" so the group could continue, and developed a trick to make one command show in the logs while another ran underneath. Researchers from OpenAI, METR and Redwood who studied it were blunt that the lesson was less about capability than about "our current failure to control AIs."
That is the awkward backdrop to any US-China safety summit: both governments invoke safety while suspecting the other of weaponising it, and both are negotiating over technology that has already demonstrated it can slip its leash. In the wake of the OpenAI incident, more than 100 companies including Anthropic and Google signed a letter warning of a "limited window" to prepare for more sophisticated AI-driven cyberattacks. The rare point of agreement is that the risk is real. The open question, as the two largest AI powers circle each other before the summit, is whether shared danger is enough to produce shared rules, or whether "safety" simply becomes another word for advantage.