Two statements from the same man, on the same day, in the same London briefing room. First: artificial intelligence is “potentially dangerous.” Second: the United States “absolutely must” work with Chinese AI companies. Put them next to each other and they sound like a contradiction. We usually don’t rush to share the dangerous thing with the rival.
Jensen Huang made both remarks on October 15, 2026, and the tension between them is not an accident of phrasing. It’s the actual argument. Huang’s position, as he framed it, is that talking across borders beats building walls around the science. From where I sit — looking at how agent systems are actually assembled — that’s less a diplomatic sentiment than a statement about architecture.
Walls Partition Deployment, Not Behavior
Export controls and access restrictions operate on artifacts. Chips, weights, licenses, datacenter capacity. They are policies about where a thing may physically sit. Agent behavior does not live there.
An agent is a loop: a model, a scaffold that decides when to call what, a set of tools with real-world side effects, and some memory of what happened. The dangerous properties of that loop — unbounded tool access, goal drift across long horizons, the willingness to take an irreversible action without checking back in — are properties of the design pattern, not of the silicon underneath. Restrict the hardware and you change who can train a frontier model. You do not change what a poorly-interlocked agent does once someone, anywhere, builds one.
That asymmetry is why I read Huang’s remarks as technically grounded rather than merely commercially convenient. He has obvious business reasons to want open channels; nobody needs to pretend otherwise. But the engineering point stands on its own. Agent safety is mostly a problem of shared conventions, and conventions are the one thing you cannot develop unilaterally.
The Interoperability Problem Nobody Is Solving
Consider what two non-communicating AI ecosystems actually produce. Not two sets of models — two sets of assumptions baked into how agents handle the hard cases.
- Different ideas of what counts as an irreversible action. One ecosystem’s agent requires human confirmation before moving money or deleting a data store. The other’s treats those as routine tool calls. When those agents transact with each other, the weaker assumption wins.
- Different interlock conventions. If there’s no shared notion of how an agent declares its own capabilities, permissions, and principal, every cross-system interaction becomes a trust decision made with no information.
- Different evaluation baselines. If two labs measure “can this agent be talked into exfiltrating credentials” using incompatible methods, neither result tells you anything about the other’s system.
- No incident channel. When a deployed agent fails in a novel way, the failure mode is useful information. Isolated ecosystems discover the same failure twice, separately, each time in production.
None of that is fixed by a treaty. It’s fixed by engineers agreeing on protocol-level details: how identity and authority propagate through a chain of tool calls, what a refusal looks like on the wire, which actions sit behind a mandatory human gate. That work requires researchers reading each other’s papers and arguing about edge cases. It’s hard to do with a wall in between.
New Social Norms Means New Technical Norms
Huang also told the Associated Press that society needs new social norms for the age of AI. That phrase can sound soft, the kind of thing a CEO says when the specifics are inconvenient. I’d argue the opposite. Social norms are what get encoded into defaults, and defaults are what actually govern agent behavior at scale.
Somebody decides whether an agent’s default tool permission is deny or allow. Somebody decides whether long-running agents checkpoint their reasoning for audit or run opaque. Somebody decides whether an agent is permitted to spawn sub-agents with inherited credentials. Those choices are made by small teams, early, often without much deliberation, and then they propagate into thousands of downstream systems because that’s what defaults do. Norms are how those decisions stop being arbitrary.
Huang pointed to Anthropic’s Mythos as evidence that the dialogue is needed now rather than later. I won’t speculate past what he said about it. But the general shape of his claim — that capability jumps arrive faster than the conventions meant to contain them — matches what anyone building agent systems has watched happen over the past few years. The scaffolding practices always lag the model.
Where This Leaves Builders
If you’re designing agent architecture right now, the policy debate is not background noise. It determines whether the safety properties you implement will have counterparts to interoperate with, or whether you’re writing conventions that stop at your own API boundary.
Huang’s framing suggests the competitive and the cooperative tracks can run in parallel: compete on models, coordinate on interlocks. That’s a harder position to hold than either pure openness or pure containment, and it’s the one that matches how these systems are actually built. Dangerous technologies have historically gotten safer through shared standards, not through silence. Agents won’t be the exception.
🕒 Published: