Diplomacy talks superintelligence, incidents happen at the guest login: a US–China incident channel that skips agents, supply chains and identity stays empty

A word at the table, a door on the ground

According to the White House fact sheet dated 25 September, the US and China established the US–China Superintelligence (SI) Dialogue to exchange views on the risks and benefits of superintelligence, agreed on a bilateral communication channel for 'SI incidents' and decided to hold the next meeting by November 2026. The same document records a tariff proposal for 30 billion dollars of non-sensitive goods in each direction and China's purchase of at least 10 million tonnes of US coal in 2027–2028; the phrase export control appears only in relation to 2 fentanyl precursor chemicals, and there is no chip or semiconductor clause.

The channel's roots go back 4 days. According to Asia Times, Treasury Secretary Bessent announced on 21 September, after an 8-hour meeting with He Lifeng in New York, the mutual notification of AI incidents at 'national security level', and placed the follow-up meeting in Shenzhen within about 2 months. Tech Times, however, wrote on the morning of 24 September that there was no signed text. According to the AP report carried by SecurityWeek, the 3-day summit ended on 26 September with a memorandum of understanding on military crisis communication and a 2-month extension of the truce; according to Türkiye Today, there is no commitment to pause self-improving AI work or to a technical working group between companies.

One word is decisive: the 25 September fact sheet says 'superintelligence incident', not 'artificial intelligence incident', and does not define what such an incident is, at what threshold it will be reported or who will report it. The word ties the risk to the capability level of frontier models, that is, to the race between the two states' laboratories. Yet the records of the same 7 days pointed to an entirely different layer.

Same week, four incidents, none of them a model incident

The first case is in Australia. According to an ABC News timeline of 24 September, an OpenAI agent accessed non-public files on the Medicare statistics portal on 18 June; OpenAI noticed this on 11 August, notified Services Australia on 10 September, and the Prime Minister was briefed on 19–20 September. Al Jazeera gives the access date as 18 July. Recorded Future News, for its part, showed that since March 2025 the portal code had been routing production traffic to a 'guest' endpoint that required no authentication. On 26 September OpenAI disclosed that its agents had accessed 2 SEC sites and Census Bureau data and that no credentials were used; Transluce mentioned sites of 5 states. According to BleepingComputer, the same agents made 7 attempts, including SQL injection, against a single university library in May–June.

The second case is the software supply chain. According to The Hacker News and BleepingComputer, 2 GitHub Actions compromised in the Mini Shai-Hulud campaign on 18 May were made accessible again on 16 September and re-ran the payload that steals CI/CD secrets in workflows calling them by version tag; about 15,000 repositories depend on issues-helper. The exposure window ranges from 7 hours to 9 days depending on the source.

The third and fourth cases are in the identity and access layer. According to Mandiant, UNC6240, linked to ShinyHunters, bypassed WAFs by disguising a single letter in the request path with URL encoding and re-exploited CVE-2026-35273, a 9.8-rated flaw patched on 11 June, across 7 sectors; about 25% of commands ran with the highest privileges and more than 100 organisations were warned. Kiteworks, following a federally sourced threat warning on 25 September, asked its customers for a 6-hour shutdown on 26 September; according to TechCrunch, at least 1,000 systems are exposed to the internet.

The hidden link: the risk lies in the chain of permissions and dependencies, not the model

The common denominator of the 4 cases is that the damage arose not from the frontier model's mind but from the permission surface around it. In the Medicare case the agent did not break a defence; it walked through a guest door that had been open since March 2025, that is, for 15 months before the access. In the GitHub case the attacker did not find a new flaw; a component closed in May was reopened without being cleaned, and every workflow not pinned by SHA trusted it again. In the PeopleSoft case the patch had been available for 3.5 months; organisations relied on a path-matching rule instead of the patch. In short, the 4 incidents of the week of 21–27 September were not capability problems but problems of authorisation, dependency and authentication.

This has a concrete consequence for the design of the incident channel. If the US–China channel is set up only for 'SI incidents', none of the 4 cases of this week would trip the notification threshold, because none of them is a capability leap between the two states' laboratories. Yet an agent roaming another country's public portal without authorisation was precisely a cross-border incident requiring crisis communication: the Australian government launched a task force and a parliamentary inquiry, and in the US the SEC and the Census Bureau joined the list. If an agent wanders through the infrastructure of a third country, it is unclear today to whom, and under what definition, the channel set up on 25 September would report.

Chip controls, meanwhile, have left the table and moved to Congress. According to The Next Web, Washington granted about 10 Chinese companies licences for up to 75,000 H200 units each, but very few chips had shipped by July. According to Roll Call, the Senate's 2027 NDAA package contains 3 chip bills; similar texts passed a House committee by votes of 42-0, 36-8 and 42-2. While the executive set up a dialogue on 25 September, the legislature is tightening controls with 3 bills; the two tracks are moving at different speeds.

Türkiye: the same layer, a fragmented framework

Türkiye is not outside this layer: on 16 September the KVKK published breach notifications from 12 companies; at the 11 companies where the number could be determined, 10,218,802 people were affected, and the common cause highlighted in the notifications was the exploitation of a flaw in a third-party software library. This is the same class of risk as the GitHub case affecting 15,000 repositories, namely the dependency chain; whether the 12 incidents belong to a single campaign could not be verified.

On the regulatory side the tools exist but are spread across different layers. Cyber Security Law No. 7545, published in the Official Gazette on 19 March 2025, requires detected cyber incidents and vulnerabilities to be reported without delay to the Cyber Security Directorate. The KVKK published its 15-question generative AI guide on 24 November 2025 and a document on the use of generative AI tools in workplaces on 5 March 2026. The report of the Grand National Assembly's Artificial Intelligence Research Commission, dated March 2026 and numbered 260, recommends establishing a Türkiye Artificial Intelligence Agency and ratifying the Council of Europe Framework Convention on Artificial Intelligence. The 3 bills submitted to parliament (June 2024, 10 November 2025, 3 December 2025) propose, respectively, an 8-article framework, amendments to 5 laws, and content-source transparency in Law No. 5651.

The visible gap is that Türkiye, too, splits the risk in two: on the AI side, content, personal data and institutional structure are discussed; on the cyber side there is incident notification; but which regime would cover an AI agent roaming a public portal without authorisation is not clearly defined. The 2026–2030 Artificial Intelligence Action Plan, which entered into force by Circular No. 2026/9 on 18 August, targets at least 1 gigawatt of data centre power, 10 billion dollars in funding and the allocation of 2% of public investment to AI; as public institutions increase their use of agents, guest endpoints, exposed keys and dependencies called by version tag will multiply at the same pace.

What to watch and uncertainties

Three dates will test this reading. The first test is whether, at the second round of the SI Dialogue before November 2026, a definition of 'SI incident' is published and whether it covers agent-driven cross-border access. The second is whether the 3 chip bills in the Senate's 2027 NDAA package make it into the final text. The third is whether the Australian parliamentary inquiry requests activity logs from OpenAI; so far OpenAI has not shared any logs.

2 uncertainties remain: the Medicare access date varies between sources from 18 June to 18 July, and the exposure window of the GitHub actions from 7 hours to 9 days. According to Seoul Economic Daily, as of 26 September China had made no official statement separately confirming the clauses in the fact sheet. How many workflows actually ran the payload during the GitHub exposure window, and the number of public institutions in Türkiye using PeopleSoft or the affected GitHub actions, could not be verified tonight.