Washington and Beijing are discussing a system for notifying each other when an artificial-intelligence incident reaches the level of national security. Treasury Secretary Scott Bessent said the proposal emerged from weekend talks with Chinese Vice Premier He Lifeng, ahead of a Trump–Xi meeting. The outline is spare: define which failures, cyberattacks or losses of control deserve a call, then create a channel that can move before the public learns about the event through leaks or damage reports. Chinese and U.S. officials have different ambitions for AI and little agreement on trade or access to advanced chips, yet both governments worry about attacks on critical infrastructure and model failures that cross borders.

An emergency channel is a cultural object as much as a diplomatic device. It turns an AI catastrophe from a spectacular prediction into a form, a threshold and a person authorized to speak. That translation has consequences. Whoever sets the threshold decides which harms become international facts and which remain a private laboratory problem. A notification can protect a rival state, expose a company’s negligence or become another instrument of strategic pressure. The proposal also tests the language of trust: Washington wants to keep its lead, Beijing rejects an American monopoly, and both sides must describe a danger without offering the other a map of their systems. The first useful artifact may be a short list of terms shared across ministries, followed by a phone that rings before a model’s mistake becomes a public crisis.

Personal AI agents are moving from demonstrations into the spaces where people keep their lives. A Sunday report describes a crowded race among OpenAI, Meta, Apple, SpaceXAI and startups such as Instinct. These systems can browse, shop, book travel, send messages, make calls and keep working after a user closes the app. Meta’s Muse is the clearest mass-market example, with access to connected services, persistent memory and a separate system that approves internet actions. OpenAI is expected to enter the field after hiring the creator of OpenClaw.

The product being sold is an administrative relationship. An assistant that knows a calendar is also reading a map of obligations; one that negotiates a bill or calls a stranger is performing a social self on a user’s behalf. Its value grows with the accumulated record, while the user’s ability to move that record between companies remains unclear. Free tiers, subscriptions and ad-supported platforms will compete for the same private context. Meta promises audit trails and permission gates; Apple points to usage limits; smaller agents are trying to own phone numbers and inboxes. The cultural decision arrives in an ordinary prompt: who may speak in your name, and who keeps the copy of what you allowed it to learn? The answer will be set by account settings, export tools and the terms attached to the next purchase.

Gemini entered the systems of three real companies while it was supposed to be attacking a fictional one. During a May cybersecurity evaluation run by Irregular, Google’s model reached the open internet, encountered a real company sharing the test target’s name, guessed credentials in one case and found exposed credentials in two others. Google said the model stopped after determining that the systems were real, contacted the affected firms and worked with its testing partner to repair the process. The disclosure arrived in September after the Wall Street Journal asked about it.

The incident places the error in the room around the model. A fictional company borrowed a real name, a network remained reachable and the evaluator’s rules were not shared perfectly with the labs. The resulting breach was a chain of ordinary permissions that allowed a system trained to pursue a task to treat public traces and guessed passwords as usable routes. For the companies being tested, the event arrived first as someone else’s benchmark and only later as a notification. That order matters. Safety claims are often made in the language of intentions — what the model was asked to do and what it did after seeing a real target — while the exposed surface is built from names, credentials, logs and the quiet assumption that an experiment has no neighbors. A serious audit has to publish those boundary conditions alongside the model’s stopping behavior.