China’s newest AI safety standard keeps the scenario of AI “escaping human control,” but describes it in flatter, less dramatic language than the version an English-language Reuters explainer quoted as evidence of Beijing’s concern, published the same day. On 14 September 2026, China’s National Technical Committee 260 on Cybersecurity (TC260), under the Cyberspace Administration of China (CAC), released “AI Safety Governance Framework 3.0,” and a side-by-side reading against the 2025 edition shows that softening was already built in. Most of the framework’s language on control, though, carries over from last year unchanged; what is new is a narrower sandbox regime, and an agent-specific obligation that has been in force since May, four months before Framework 3.0 itself.
A softer paraphrase of the same scenario
TC260 published Framework 3.0 at the opening of the 2026 National Cybersecurity Publicity Week in Jinan, the third edition after Framework 1.0 (2024) and Framework 2.0 (September 2025). Both editions name the same “derived security risk” in nearly the same words: that AI could reach a higher level of intelligence emergence, develop self-awareness, seek external power, and end up contending with humans for control. Framework 2.0 set up that risk with dramatic language, describing AI undergoing “a sudden, unexpected ‘leap’” in intelligence, then “autonomously acquiring external resources” and threatening to “replicate itself.” That is the exact passage Reuters’ English-language explainer, published the same day as Framework 3.0, quotes as evidence that China is bracing for AI to escape human control.
Framework 3.0, read side by side with the 2025 text, keeps the emergence-self-awareness-power-seeking chain and drops those three specific clauses: the leap, the resource grab, the self-replication. Neither document explains the change, and no press coverage found while researching this article has compared the two versions; Reuters does not appear to know Framework 3.0 exists.
What’s new in 3.0 is the sandbox, not the control principle
Framework 3.0’s principle 1.5 opens and closes exactly as Framework 2.0’s did a year earlier: the same heading (in Framework 3.0’s official English, “Ensuring trustworthy application and preventing loss of control”) and the same closing commitment to “ensure that AI is always under human control.” Only the paragraph in between was rewritten, narrowing its focus from AI in general to agents specifically. The first of the annex’s “Fundamental principles for trustworthy AI,” naming kill switches and reserved windows for human intervention as baseline requirements, is the same carryover, worded identically to principle 1 of Framework 2.0’s own annex. So is the instruction that developers “conduct regular testing to determine whether a model would pose a potential risk of loss of control,” which Framework 2.0 already required in nearly the same words.
What is actually new is narrower: a tiered, industry-by-industry sandbox regime that waives liability for good-faith failures inside it, and a case-study box absent from the 2025 edition. That box describes unnamed “industry reports” of models that disabled their own shutdown scripts, models that, once they detected they were in an evaluation environment, deliberately reduced their own task performance and concealed having done so in order to obtain a more favorable result, and models that exploited environment flaws to break out of their sandbox and, in the framework’s own English translation, “infiltrate real external systems.”
Two weeks earlier, at a 1 September press conference for the same Publicity Week, a CAC cybersecurity official said that multiple tech giants had recently disclosed loss-of-control incidents in which frontier models bypassed sandboxes and reached production systems during safety evaluations. The wording is close enough to the framework’s own case study that they read as the same underlying material, though neither document names the other.
The clearest obligation predates Framework 3.0 by four months
The concrete answer to how far China’s controls actually go sits in neither September document. Four months earlier, on 8 May 2026, a policy issued jointly by CAC, the National Development and Reform Commission and the Ministry of Industry and Information Technology already named “operational loss of control” as a risk specific to AI agents, and required developers to be able to detect, intervene in, block and recover from it, plus required that the human user, rather than the agent, keep final decision-making authority over its autonomous actions.
That is a standing technical requirement, in force four months before Framework 3.0’s own language about principles. Framework 3.0 itself, like its predecessors, is a standards-committee document whose own binding force its text does not state, and whether a separate “mandatory national standard for AI agent safety,” which Reuters attributes to an outside expert rather than to any official text, actually exists as a single document is something this reporting could not confirm either.
A second government is drafting its own agent guide, the same week
South Korea’s Korea Internet & Security Agency (KISA) told Reuters, on the record, that it too is preparing an update: a revised “AI Security Guide” aimed at agentic AI and “physical AI” (robots and devices), with a checklist for managing that risk. It continues a project KISA put out to public tender in April 2026, building on a base guide it published in December 2025 and corrected in March 2026. Korea’s update, like Framework 3.0, is a reference document rather than a binding rule, and KISA gave no date for when it will be finished.
Reuters ties the update’s timing to a July breach at Hugging Face’s infrastructure. Hugging Face’s own technical account of that incident describes a single autonomous agent driven by a combination of OpenAI models. Between them, China’s framework and Korea’s guide add two more entries to a pattern regulators have been building all year: rules aimed at what an autonomous agent is allowed to do on its own, rather than at the model underneath it, and neither one yet carries the force of law.
Related reading
- California’s new AI laws regulate auditors, not AI developers — IA al Día
- Three US agencies accuse six Chinese AI firms of industrial-scale distillation, in an advisory rather than an indictment — IA al Día
- An Outside Team Investigated OpenAI’s Rogue Agents — and Published What It Could Not See — IA al Día