"Advancing human control of military AI" is a two-part commentary published by the Brookings Institution on September 9, 2026. Its authors are Melanie W. Sisson, a senior fellow in the Brookings Foreign Policy program and its Strobe Talbott Center for Security, Strategy, and Technology, and Tianjiao Jiang, an associate professor at Fudan University's Development Institute. Both are members of the U.S. and Chinese delegations to the Track II Dialogue on Artificial Intelligence and National Security that the Brookings Foreign Policy program and Tsinghua University's Center for International Security and Strategy (CISS) have convened since 2019 with support from the Minderoo Foundation. The recommendations are presented as the authors' own views, "in anticipation of a forthcoming U.S.-China government-level dialogue on AI," and address how the two countries could build on their existing commitment to keep human control over nuclear weapons as AI is integrated into military operations.
Framing
The introduction describes the dialogue's aim as identifying "practical steps to manage risks relating to artificial intelligence (AI) and national security," and notes that it maintains a living glossary of AI and national-security terms "to ensure precision in communication." The two pieces are offered as a U.S. and a Chinese perspective on "steps the United States and China could take to build boundaries around acceptable uses of AI in national security," covering human control over AI-enabled cyberattacks and mechanisms that could turn shared principles into practice.
Sisson: a leader-level commitment on AI-enabled cyberattacks
Sisson's piece, "Trump and Xi can lead on governing military AI," begins from the observation that the United States and China "have not developed a common approach to governing AI in the military domain" but share an interest in limiting military AI applications that could harm civilians or undermine global stability. She cites the late-2024 agreement between the two countries' presidents that humans, not AI, should control the decision to use nuclear weapons, and calls it "only the starting point," since the integration of agentic AI into military operations and rapid model improvement are opening "new pathways to catastrophic outcomes."
Her proposal is that Donald Trump and Xi Jinping agree "that only humans, not AI, should make the decision to initiate a cyberattack against each other's nuclear command, control, and communications systems (NC3) or critical infrastructure."
The argument rests on the functions NC3 performs: detecting threats, supporting decisions about nuclear use, and transmitting launch orders. Sisson states that nuclear doctrine, whether no-first-use or launch-on-warning, does not remove the risk that failures in these functions could break leaders' ability to communicate, prevent accurate threat assessment, create misperceptions that incentivize a first strike, or lead to mistaken or unauthorized launch. An intentional AI-powered cyberattack on NC3 would start a military crisis, and she identifies two unintended routes to the same outcome: an unplanned attack arising while a state is only pre-positioning an offensive cyber capability, through "human error, technical limitations in the AI models, or AI agents that act in ways that humans did not anticipate"; and an unauthorized attack by a bad actor using the capability. In either case she expects the attacked state to raise alert levels and ready nuclear forces, leaving leaders to decide on nuclear employment "under conditions of extreme time pressure and deep uncertainty." She applies the same reasoning to critical infrastructure, which she defines as "the economic, financial, health, transportation, and safety systems that support civic life," where an attack could cause destruction, contamination, "social chaos," and widespread illness, injury, or death, and would be "highly likely" to draw military retaliation.
Sisson describes the principle as narrow. Extending the nuclear rule, "that attacks with strategic effects should express human intent and must be subject to human accountability," does not require the two governments to share other cybersecurity or infrastructure-protection principles; it is "confined to agreement on the narrow point" of minimizing the likelihood that strategic attacks are caused by "chance, error, advanced AI capable of exceeding human-defined constraints, or unauthorized actors." She presents planned government-to-government dialogues as preparation for a Trump–Xi agreement, and leader-level statements as "the necessary precondition for bilateral dialogue on verifiable protocols and safeguards" and as a public signal that the two governments recognize "the special responsibilities that come with leading in AI."
Jiang: institutional mechanisms and their limits
Jiang's piece, "China and the U.S. should accelerate the implementation of 'human control,'" cites the 2024 consensus on nuclear weapons and the proposal by the two heads of state in May 2026 to build a "constructive strategic stability relationship," of which it argues military AI governance should be part. Jiang writes that these declarations "still fall short of preventing AI from spiraling out of control, being misused, or triggering escalations in conflict," and endorses Sisson's point that authority to launch cyberattacks on nuclear command systems and critical infrastructure must stay in human hands. To keep such declarations from "becoming mere formalities," the piece proposes cooperation in three areas.
- Red lines. A list of prohibitions for military AI barring AI from autonomously launching attacks on NC3 systems or autonomously deciding to use nuclear weapons, together with an agreed list of critical-infrastructure sectors, "such as finance, health care, energy," with defined boundaries.
- Definitions of human control. Jiang traces "human-in-the-loop" and "human control" discussions to Colonel John Boyd's OODA loop of the 1970s, and states that Premier Zhou Enlai's earlier instruction demanding "absolute certainty" (万无一失) in China's nuclear testing is regarded by Chinese experts and practitioners as embodying the same principle. Because the two sides' institutional frameworks and strategic cultures differ, they "may employ different terminology and adopt divergent approaches" even on the same issue. The proposal is that China and the United States "ensure mutual acceptance of each other's definitions of 'meaningful human control' and related safeguard mechanisms through regular dialogue or by establishing a terminology working group."
- A military hotline for AI. A dedicated channel built on the existing defense-minister hotline and the Maritime Military Security Consultation Mechanism, "for reporting emergency incidents triggered by AI errors or AI cyberattacks," intended to reduce the risk of cascading crises from AI malfunctions "that could mislead humans or even override human judgment." Jiang cites the 2023 balloon incident as a warning and states that without a hotline, "AI-driven drones and unmanned vessels are highly likely to trigger more accidental escalations."
Jiang then names three practical challenges that would remain even with such mechanisms. The first is speed: AI-enabled cyberattacks can unfold "within milliseconds," defensive AI could trigger automatic countermeasures that the other side reads as intrusion, pushing both into "automatic confrontation," and in such exchanges the "final human decision" may "exceed physiological limits." The second is attribution: an attack on critical infrastructure could come from a state, a hacker group, terrorists, or AI agents, or be staged to frame a state, and without reliable attribution "human accountability cannot be effectively established." The third is the security dilemma: the opacity of AI makes it impossible to assess an adversary's capabilities or distinguish offensive from defensive systems, so each side plans against a worst case and "the spiral of hostility continues to escalate." Jiang judges these challenges manageable only through continued dialogue and safeguards.
The piece widens the agenda beyond cyberattacks, which it calls "merely the tip of the iceberg." It states that the widespread use of autonomous weapons systems in the Russia-Ukraine theater and the Middle East "has already led to severe civilian casualties and even heightened the risk of nuclear escalation." Given the difficulty of progress on lethal autonomous weapons systems (LAWS) within the UN Convention on Certain Conventional Weapons, Jiang proposes that China and the United States seek "a minimum common ground on 'prohibiting fully autonomous lethal attacks' and 'ensuring human oversight,'" cooperate to prevent LAWS proliferation and misuse by nonstate actors, and prepare crisis-management and response plans for autonomous weapon systems. It closes by describing military AI governance as "a race against time" and expressing the hope that the two leaders will build on their AI dialogue during their September meeting.
Coverage and differences from it
Reuters reported the recommendations on September 17, 2026, describing them as published the previous week and the dialogue as one whose work helps inform official discussions. It reported that neither government had publicly endorsed the proposals, which preceded a September 24 Trump–Xi meeting in Washington, and dated the nuclear-control principle to November 2024, attributing it to then-President Joe Biden and Xi (Source: reuters.com).
The commentary differs from that account on three points:
| Point | Reuters account | Commentary text |
|---|---|---|
| Purpose of the definitional work | A shared definition to prevent both countries "from using identical language to justify different levels of machine autonomy" | The two sides "may employ different terminology and adopt divergent approaches"; the ask is "mutual acceptance of each other's definitions" |
| Scope of Sisson's proposal | "Strategically important infrastructure" | NC3 "or critical infrastructure," defined as economic, financial, health, transportation, and safety systems |
| Hotline trigger | Incidents involving autonomous AI | "Emergency incidents triggered by AI errors or AI cyberattacks" |
The same Reuters account places the proposals among official and expert positions. Shen Jian, China's ambassador for disarmament affairs, told a UN meeting in Geneva in June 2026 that military AI could affect strategic stability and that weapons should remain under human control, while China argues that AI safety should not become a pretext for technological barriers; in China, AI sits within the Foreign Ministry's Department of Arms Control. Carla Freeman of the Johns Hopkins School of Advanced International Studies has questioned the existing military hotline's utility, citing Chinese officials' refusal to take U.S. calls during the February 2023 balloon incident (Source: reuters.com).
Provenance
The commentary is published on brookings.edu under the Foreign Policy program, the John L. Thornton China Center, and the Strobe Talbott Center for Security, Strategy, and Technology; page metadata gives a publication time of 17:28 UTC on September 9, 2026. The sentence "In late 2024, the presidents of the United States and China that humans, not AI, should have control over the decision to use nuclear weapons" lacks a verb in the publisher's text and is reproduced as published in the raw capture. The glossary the dialogue maintains is published separately by Brookings (brookings.edu) and is not held.
Relationships
- supports: Autonomous Weapons — proposals for human control over AI-enabled attacks on NC3 and for minimum common ground on lethal autonomous weapons
- related: US-China AI Competition: Different Races, Different Metrics — the Track II proposals within US–China AI diplomacy ahead of the September 2026 talks and Trump–Xi meeting
- related: Brookings Institution AI Initiative — convenes the Track II dialogue with Tsinghua CISS
- related: Melanie W. Sisson, Tianjiao Jiang — authors
- related: Xi Jinping — addressee, with Trump, of the proposed leader-level commitment
- related: AI and Cybersecurity, Autonomous cyber-agents — the AI-enabled cyber capabilities the proposals address
- related: Meaningful Human Review — the parallel standard in automated-decision law
- supports: AI and nuclear command and control — proposals to extend the human-decision principle to AI-enabled cyberattacks on NC3