How nuclear security can help bring the US and China together on AI

In March 2016, the Chinese government opened the doors to a nuclear security training center in Beijing with assistance from American experts. Sandia National Laboratories had worked with their counterparts in China to stand up the center and a physical protection system for a mock nuclear material processing facility. “It’s in our national interest that everybody’s nuclear materials are secure,” Sandia civil engineer Nick Winowich explained in a statement about the opening. A decade later, that same concern can provide a window of opportunity for cooperation on artificial intelligence, even as the United States and China compete to master this emerging technology.

Currently, government and nongovernment nuclear analysts are mainly focused on whether AI could help additional states acquire nuclear arms or make nuclear crises harder to control through its use in military command-and-control and decision-support systems. But a nuclear disaster doesn’t necessarily begin with a government’s pursuit of the bomb or decision to use it.

AI could create risks in other ways. For example, just as AI is used in military operations, it could also help terrorists identify weaknesses in nuclear facilities and plan attacks. Bad actors could leverage AI to sift through commercial and public imagery and reporting about nuclear facilities, reducing the effort needed for reconnaissance. They might also use AI-generated voice recordings to impersonate trusted colleagues and deceive facility personnel into disclosing sensitive information.

But that same technology could aid security personnel in uncovering those vulnerabilities and strengthening protection long before an attack occurs. This may help to give Washington and Beijing a rare, shared purpose amid their disagreements over military AI: to use artificial intelligence to prevent theft of nuclear materials and sabotage of nuclear facilities.

Cooperation between the rivals doesn’t need to begin with restrictions on AI systems. Washington and Beijing could pursue a six-month pilot agreement to jointly test AI applications for physical protection of civilian nuclear materials and facilities. This renewed lab-to-lab engagement could expand to include AI firms and nuclear operators. Together, they could evaluate whether AI workflows can improve threat detection by combining different types of security information that are usually examined separately. The experts could use simulated data from a fictional facility to protect sensitive facility data and commercial information.

Through these exercises, both countries could gain stronger defenses against nuclear theft and sabotage while building confidence for thornier discussions about AI-assisted proliferation and integration into nuclear arsenals.

Shared stakes. Nuclear security cooperation would serve the very economic ambitions that are driving the AI race. China is currently leading the world in new power reactor construction, with more than three dozen units underway as Beijing banks on the peaceful atom to meet its growing electricity needs.

While the United States remains the world’s largest producer of nuclear energy, its new reactor construction has been limited. But demand from new data centers is now fueling massive private sector interest in new reactor projects. For instance, Google is backing Kairos Power’s planned small modular reactors, and Amazon is supporting a planned facility using X-energy reactors in Washington state to help power AI and cloud services. Such investments are already giving major AI industry players a direct stake in nuclear infrastructure. Better physical protection could help safeguard the energy supplies that both governments and firms depend on.

Neither country can insulate itself from a serious nuclear security failure. AI could help terrorists develop malware intended to disrupt plant operations or weaken security systems during an attempted intrusion. A radiological release would require overcoming additional protections, but even a disruption could impose substantial costs.

Past accidents show that the consequences aren’t confined to national borders. Chornobyl’s radioactive releases reached Finland, Sweden, and beyond in 1986. Fukushima’s political repercussions helped spur Germany’s decision to accelerate its nuclear phaseout in 2011. A successful act of sabotage could likewise threaten neighboring populations and undermine support for reactor projects worldwide.

Operators from the United States and China could explore AI’s defensive value by connecting four types of facility data. Live security information includes video feeds and perimeter alarms. People and access information includes electronic records of when identification badges are used to enter a facility or restricted area, alongside visitor records. Equipment and operating information covers maintenance histories and outages. Security analysis includes exercise findings, red teaming, and facility simulations.

These records are often examined separately. Viewed together, an apparently routine badge swipe might warrant scrutiny if it coincided with an equipment outage in an area flagged during a previous security exercise. AI could help bring that combination to an analyst’s attention. Human specialists would then determine its significance. Digital twins, or computer models that reproduce a facility’s layout and operations, could be used to test whether AI recognizes such sequences during simulated security events.

A first agreement. The 2016 partnership that gave rise to the nuclear security center in Beijing cannot simply be revived. Indeed, strategic competition has since stalled official dialogue on U.S.–Chinese nuclear security issues. But experts could develop a pilot proposal through track-1.5 dialogues, involving officials acting in their personal capacity alongside nongovernmental specialists, or track-2 exchanges among nongovernmental experts. The U.S. Department of Energy and the China Atomic Energy Authority could then take the proposal to their political leaders.

An initial agreement could authorize six months of reciprocal testing for civilian nuclear security, ending with a joint assessment and a decision on whether to continue. This would be a joint effort to combat nuclear terrorism that protects sensitive information and requires neither country to accept military AI restrictions.

Following their late September summit, Trump and Xi agreed to dialogue on artificial intelligence and a communication channel for AI-related incidents. The next exchange is planned for November, offering an opportunity to put nuclear security on the table.

A pilot project would not require either side to provide access to an operating nuclear facility. Experts could develop common scenarios through approved online exchanges, run tests on their own systems, and reconvene to compare findings. The work could begin with a fictional civilian nuclear facility, thereby allowing both sides to test AI systems without exposing actual security protocols. A simulation might include an event like an unauthorized entry. This would let American and Chinese teams compare AI-assisted detection with existing procedures to assess detection speed, accuracy, and false alarm rates. A digital twin could then be used to determine if changes in sensor deployment and construction activities at a site caused a model to make errors. As human specialists assessed these judgments, real facility records and proprietary model details would remain gated. Each side could commit to completing the exercises and discussing the results at a later technical meeting.

Critically, nuclear operators and AI developers would both need to be involved. Operators could explain how scheduled maintenance changes activities at a facility, helping developers train models to distinguish routine operations from potential security threats. A precedent for combining nuclear and AI expertise comes from Anthropic’s work with the U.S. Department of Energy’s National Nuclear Security Administration. In August 2025, the company described working with the department and its national labs to develop a classifier to flag users’ concerning nuclear-related conversations with AI models. It used risk indicators cleared for sharing with its staff, tested the classifier on synthetic prompts, and refined its approach through government feedback. Although that project addressed proliferation risks, its iterative approach could provide a template for cooperation on physical protection.

Rules at home, cooperation abroad. The pilot’s findings could inform subsequent American and Chinese commitments on testing AI for nuclear security. The September 29 White House accord with leading AI companies endorses voluntary internal controls and independent external audits. Bilateral nuclear security cooperation with China could offer one way to translate those commitments into practical tests in a high-consequence domain.

Both countries already have nuclear security requirements that could provide a basis for this work. The U.S. Nuclear Regulatory Commission mandates reviews of reactor security programs by personnel independent of those responsible for managing and implementing the programs, including after changes that could weaken physical protection. The China Atomic Energy Authority publishes technical standards on sensor and video monitoring and access control. Officials could compare how these requirements should apply to AI, including updates that change which warnings reach security personnel.

Of course, overseeing rapidly changing frontier models would necessitate a different, much faster approach than licensing nuclear reactors. Promising simulation results would still require validation under actual domestic operating conditions. Each government would retain responsibility for its deployment decisions and enforcement.

Another possibility for frontier AI oversight is a standards body modeled on the Financial Industry Regulatory Authority, as Nobel laureate and Google DeepMind co-founder Demis Hassabis proposed in July. Interestingly, the Financial Industry Regulatory Authority is funded by the industry it supervises. But it enforces rules under the oversight of the Securities and Exchange Commission rather than relying on voluntary corporate promises. Findings from the bilateral exercises discussed above could help an AI analog of the Financial Industry Regulatory Authority to develop testing standards for nuclear applications.

Securing political approval for this initiative would require a clear agreement outlining information protection provisions. US rules already restrict the unauthorized disclosure of certain types of unclassified nuclear facility security information. China’s Atomic Energy Law mandates confidentiality for nuclear activities that involve state secrets. Trade secrets would add another layer of complexity to the equation. Before expert exchanges began, Washington and Beijing would need to approve the participants and the material involved in discussions.

Data exchange could proceed as follows. An American team might share an approved account of errors on their side in the context of the fictional exercise, allowing their Chinese counterparts to investigate if their systems exhibited the same failure mode. But actual facility records and developers’ proprietary model details would remain protected. Even then, officials might still worry that shared methods would strengthen a competitor’s capabilities. Both governments would have to weigh the benefits of preventing nuclear terrorism against any potential strategic gains to a rival. Information protection protocols would make that bargain easier to achieve, but they could not resolve the underlying politics.

Sustaining this work would require the right participants. A 2025 Sandia study identified limited industry and technical participation as a weakness in bilateral United States–China AI dialogues. The Asilomar Process for frontier AI dialogue, led by the Center for Nonproliferation Studies, may offer one pathway forward, as it brings together the AI industry, nuclear specialists, and government representatives.

From security to confidence. These technical exercises could be instrumental in building confidence in ways that go far beyond diplomatic assurances alone. Exchanging best practices and respecting information protections would give both governments a stronger case for authorizing further exchanges. Just as important, frontier developers and nuclear specialists would gain experience together in AI-enabled risk assessment across national lines. Those relationships could support pressing discussions of AI-assisted proliferation and the technology’s integration into nuclear arsenals. While reaching agreement would remain difficult, participants would at least have a record of cooperation in addressing global catastrophic risk to draw on when confronting disagreements.

Yet, common interests must contend with powerful incentives to race. The Trump administration’s 2025 AI Action Plan advocates removing regulatory barriers to secure Washington’s AI dominance. Meanwhile, China’s military–civil fusion strategy aims to translate AI advances in the civilian economy into tangible military capabilities. With private AI investment in the United States reaching $286 billion in 2025, frontier firms such as Anthropic and OpenAI are competing with one another, as well as with Chinese developers like DeepSeek. Such competitive pressures can discourage firms from adopting precautions that their rivals may neglect. This could also make governments and firms reluctant to share their expertise or devote staff time to joint security tests, even when cooperation entails no new AI development limits.

A breakthrough in this area would be a positive step, as finding agreement on AI with national security implications has been immensely challenging. For instance, neither the United States nor China endorsed the nonbinding declaration on military AI at this February’s Responsible AI in the Military Domain Summit in A Coruña, Spain. Verifying more ambitious AI commitments could also expose state secrets and trade secrets that governments and firms are reluctant to share, something the pilot program explicitly seeks to avoid.

If these efforts improved physical protection, they could also help secure the energy supplies that fuel American and Chinese AI ambitions. In this respect, cooperation could ironically empower the competition that has complicated restraint. But the economic interests that might draw governments and firms into this initiative could also give them real reasons to stay engaged. There may be an opportunity here to turn shared nuclear security risks into a broader discussion of AI’s wider consequences for nuclear arms. And Washington and Beijing ought to begin building such confidence where their interests meet, rather than waiting for agreement in areas where they collide.

Author’s note: An earlier version of this article was prepared for a Perry World House conference supported by the Consortium to Reduce Nuclear Dangers.