{"slug": "china-s-proposal-on-security-requirements-for-ai-agent-interactions", "title": "China's Proposal on Security Requirements for AI Agent Interactions", "summary": "China's National Information Security Standardization Technical Committee (TC260) released a draft practice guide in July 2026 (v0.23) outlining security requirements for AI agent interactions, targeting risks like identity forgery, unauthorized access, and cascading hallucination propagation. The guide, which is not mandatory but signals future regulation, covers general, agent-to-agent, and agent-to-tool interaction security and is aimed at AI agent service providers and tool providers.", "body_md": "# China's Proposal on Security Requirements for AI Agent Interactions\n\n### Cybersecurity Standards Practice Guide — Security Requirements for Agent Interactions (Draft for Public Consultation)\n\nThis is an unofficial English translation of a Chinese cybersecurity standards document, *“Cybersecurity Standards Practice Guide — Security Requirements for AI Agent Interaction”* (TC260-PG-2026NA).\n\nIt was released in July 2026 (Draft for Public Comment, v0.23) by the Secretariat of the National Information Security Standardization Technical Committee (TC260) — the body that steers China’s national cybersecurity standards.\n\nAs a “practice guide,” it is not a mandatory national standard but an authoritative reference that signals the direction of forthcoming regulation and industry practice.\n\nThe guide sets out security requirements for how AI agents interact — both agent-to-agent and agent-to-tool — with the aim of preventing risks such as identity forgery, unauthorized (privilege) access, and the cascading spread of hallucinations across multiple agents.\n\nIt is organized around three areas:\n\n(1) general interaction security (identity, access control, communication security, and risk management);\n\n(2) agent-to-agent interaction security (registration, discovery, and mutual invocation); and\n\n(3) agent-to-tool interaction security (tool discovery and tool invocation). An informative appendix maps a catalog of concrete interaction risks (e.g., information tampering, information leakage, privilege loss of control, tool abuse, intent hijacking) to the specific clauses that mitigate them.\n\nIt is aimed at AI agent service providers and tool providers, and can also serve as a reference for third-party assessors.\n\n*(The full translation follows. In case of any discrepancy, the original Chinese document prevails.）*\n\n**Foreword**\n\nThe *Cybersecurity Standards Practice Guide* (hereinafter the “Practice Guide”) is a standards-related technical document organized, developed, and published by the Secretariat of the National Information Security Standardization Technical Committee (hereinafter the “Cybersecurity Standardization Committee” or “TC260”). It aims to promote cybersecurity-related standards and knowledge and to provide standardization practice guidance around such themes as cybersecurity laws, regulations and policies, standards, and cybersecurity hot topics and incidents.\n\n**Drafting organizations of this document:** China Mobile Communications Group Co., Ltd.; China Electronics Standardization Institute; Beijing Zhongguancun Laboratory; National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC); ZTE Corporation; Beijing Kuaishou Technology Co., Ltd.; Fudan University; Alibaba Cloud Computing Co., Ltd.; Strategic Research Center of Qiyuan Laboratory; Ant Technology Group Co., Ltd.; Harbin Institute of Technology.\n\n**Drafters of this document:** Qiu Qin, Su Li, Yang Kai, Li Ziwei, He Min, Cui Yong, Chen Jia, Zhao Yuhang, Ran Peng, Sun Yang, Li Bangling, Lu Dongjie, Xu Sijia, Zhang Yanting, Zhang Lei, Chao Yihan, Du Chenguang, Shi Guixin, Li Ye, Wang Kun, Wang Bo, Zhou Jihua, Mei Aoting, Cao Xiaoqi, Shao Meng, Wang Jian, Gu Chen, Yang Min, Hong Geng, Chen Pei, Peng Juntao, Xu Yuan, Li Yunjia, Lin Guanchen, Yang Xiaofang, Peng Jin, Jiang Wei, Ye Lin.\n\n**Statement**\n\nThe copyright of this Practice Guide belongs to the Secretariat of the Cybersecurity Standardization Committee. Without the written authorization of the Secretariat, no part of this Practice Guide may be copied or translated in any manner. When reprinting or citing the views or data of this Practice Guide, please indicate: “Source: Secretariat of the National Information Security Standardization Technical Committee.”\n\n**Abstract**\n\nThis document is developed to guide the interaction security of AI agents and to prevent security risks such as identity forgery, unauthorized access, and cascading hallucination propagation across multiple agents during agent interaction, in accordance with the *Cybersecurity Law of the People’s Republic of China*, the *Data Security Law of the People’s Republic of China*, and relevant national standards.\n\nTo this end, this Guide specifies general security requirements for agent interaction, as well as security requirements for agent-to-agent interaction and agent-to-tool interaction. It is intended to provide security practice guidance on the interaction process for AI agent service providers and tool providers, and may also serve as a reference for third-party assessment organizations and other bodies.\n\n**Table of Contents**\n\nScope\n\nNormative References\n\nTerms and Definitions\n\nAbbreviations\n\nOverview\n\nGeneral Security Requirements for AI Agent Interaction\n\nSecurity Requirements for Agent-to-Agent Interaction\n\nSecurity Requirements for Agent-to-Tool Interaction\n\nAppendix A (Informative) — List of AI Agent Interaction Security Risks\n\nReferences\n\n**1 Scope**\n\nThis document specifies the interaction security requirements for agent-to-agent and agent-to-tool interactions, including general security requirements for agent interaction, security requirements for agent-to-agent interaction, and security requirements for agent-to-tool interaction.\n\nThis document is applicable to guiding AI agent service providers and tool providers in safeguarding the security of the agent interaction process. It is also applicable to third-party assessment organizations and other bodies in assessing the security of agent interaction.\n\n**2 Normative References**\n\nThe contents of the following documents, through normative reference in this text, constitute indispensable provisions of this document. For dated references, only the version corresponding to that date applies to this document. For undated references, the latest version (including all amendments) applies to this document.\n\nGB/T 25069 — Information security techniques — Terminology\n\nGB 45438—2025 — Cybersecurity technology — Labeling method for content generated and synthesized by artificial intelligence\n\nGB/T 45574—2025 — Data security technology — Security requirements for the processing of sensitive personal information\n\nGB/T 45654—2025 — Cybersecurity technology — Basic security requirements for generative artificial intelligence services\n\nGB/Z 185.1—2026 — Artificial intelligence — Agent interconnection — Part 1: General architecture\n\nGB/Z 185.3—2026 — Artificial intelligence — Agent interconnection — Part 3: Identity management\n\nGB/Z 185.4—2026 — Artificial intelligence — Agent interconnection — Part 4: Agent description\n\nGB/Z 185.5—2026 — Artificial intelligence — Agent interconnection — Part 5: Agent discovery\n\nISO/IEC 22989:2022 — Information technology — Artificial intelligence — Artificial intelligence concepts and terminology\n\n**3 Terms and Definitions**\n\n**3.1 AI agent**\n\nA general term for an automated entity — that is, a process or system that can operate under specified conditions without human intervention or with controlled human intervention, that can perceive and respond to its environment, and that takes actions to achieve its goals.\n\n[Source: ISO/IEC 22989:2022, 3.1.1, modified]\n\n**3.2 AI agent service provider**\n\nAn organization or individual that provides AI agent services.\n\n**3.3 AI agent description**\n\nMachine- and human-understandable information used to describe an agent’s name, functions, and so forth.\n\n[Source: GB/Z 185.4—2026, 3.1]\n\nNOTE: In a specific system, the agent description generally follows a specific form of expression.\n\n**3.4 AI agent credential**\n\nA tamper-resistant collection of data that contains claims about an agent’s identity attributes and is used for identity authentication.\n\n[Source: GB/Z 185.1—2026, 3.4]\n\n**3.5 AI agent discovery**\n\nThe process of matching and obtaining one or more agent descriptions that meet business requirements.\n\n[Source: GB/Z 185.5—2026, 3.1]\n\n**3.6 Agent discovery service**\n\nA process that implements or provides the agent discovery function.\n\n[Source: GB/Z 185.5—2026, 3.2]\n\n**3.7 Agent identity registration service**\n\nA service that processes agent identity registration requests, performs agent identity verification, and manages agent identity accounts.\n\n[Source: GB/Z 185.3—2026, 3.4, modified]\n\n**3.8 Critical information infrastructure**\n\nImportant network facilities, information systems, and the like in important industries and fields such as public communications and information services, energy, transportation, water conservancy, finance, public services, e-government, and the national defense science, technology, and industry sector, as well as others that, once damaged, disabled, or subject to data breach, may seriously endanger national security, the national economy and people’s livelihood, or the public interest.\n\n[Source: GB/T 39204—2022, 3.1]\n\n**3.9 Tool**\n\nA functional entity that can be invoked by an agent application.\n\nNOTE: Examples of tools include cloud services, applications, agents, external devices, and so forth.\n\n**3.10 Minimum privilege**\n\nFor a given subject, its access rights are limited to only those privileges necessary to perform the authorized tasks.\n\n[Source: GB/T 5271.8—2001, 08.04.15, modified]\n\n**3.11 Identity (identifier)**\n\nInformation that can uniquely determine the identity of an entity.\n\n[Source: GM/T 0090—2020, 3.1]\n\nNOTE: An identifier consists of information that the entity cannot repudiate, such as the entity’s identifiable name, email address, ID card number, telephone number, street address, and so forth.\n\n**4 Abbreviations**\n\nThe following abbreviations apply to this document.\n\n**AI**: Artificial Intelligence\n\n**TLS**: Transport Layer Security\n\n**IP**: Internet Protocol\n\n**5 Overview**\n\nThe security requirements for agent interaction include general security requirements for agent interaction, security requirements for agent-to-agent interaction, and security requirements for agent-to-tool interaction, as shown in Figure 1:\n\n**Figure 1 — AI Agent Interaction Security Architecture**\n\n*Description of Figure 1 (original labels are in Chinese):* The architecture consists of two top-level blocks — **Security Requirements for Agent-to-Agent Interaction** (智能体间交互安全要求) and **Security Requirements for Agent-to-Tool Interaction** (智能体与工具交互安全要求) — which are both **supported** (支撑) by a foundational layer, **General Security Requirements for Agent Interaction** (智能体交互通用安全要求). This foundational layer comprises four components: **Identity** (身份标识), **Access Control** (访问控制), **Communication Security** (通信安全), and **Risk Management** (风险管控).\n\n**6 General Security Requirements for AI Agent Interaction**\n\n**6.1 Identity**\n\nAn agent shall have an identifier that can uniquely identify the agent. An agent shall have an agent credential corresponding to that identifier.\n\n**6.2 Access Control**\n\nBoth parties to an agent interaction shall support an access control mechanism to decide whether to permit access and to interrupt access.\n\n**6.3 Communication Security**\n\nThe communication security requirements for agent interaction are as follows:\n\na) An agent shall use a secure communication channel that supports identity authentication of the access object and provides non-repudiation of both parties’ behaviors.\n\nb) An agent shall adopt encryption and integrity-verification strategies, and should use a transport-layer protocol of TLS 1.2 or above.\n\nc) An agent that processes critical business carried by critical information infrastructure shall, during communication with an interaction counterpart, use cryptographic algorithms for identity authentication, data encryption, and integrity verification in accordance with the requirements of the national cryptography administration authority and relevant industry requirements.\n\nd) An agent service provider shall support traffic monitoring and cleaning mechanisms, identify and rate-limit/block abnormally high-frequency requests, and prevent resource-exhaustion attacks.\n\ne) An agent service provider should support a transmission-path redundancy mechanism that automatically switches to a backup path when the primary path is impaired.\n\n**6.4 Risk Management**\n\n**6.4.1 Proactive Prevention**\n\nThe proactive-prevention security requirements for agent interaction are as follows:\n\na) An agent service provider shall establish an interaction rate-limiting mechanism for agents, controlling the number of interaction counterparts and the interaction frequency of a single agent per unit of time.\n\nb) An agent service provider should support making advance judgments about potential abnormal interaction behaviors based on historical interaction logs and behavior-feature libraries, and should intercept high-risk interaction requests or subject them to manual review.\n\n**6.4.2 Anomaly Detection**\n\nThe anomaly-detection security requirements for agent interaction are as follows:\n\na) An agent service provider shall, on the condition that user authorization has been obtained, support a monitoring function for the agent interaction status, tracking in real time such information as communication time, interaction counterparts, interaction status, and interaction behaviors, and shall promptly discover and issue early warnings of abnormal behaviors.\n\nb) When a non-convergent interaction or communication anomaly is detected, the agent service provider shall forcibly terminate the interaction and record the anomaly information.\n\nNOTE: A non-convergent interaction refers to a situation in which the dialogue or operation sequence between agents falls into repetition, looping, or contradiction and cannot advance the task, or an interconnection interruption caused by a network fault, a crash of the counterpart agent, or non-responsiveness.\n\nc) When the agent service provider detects abnormal behavior by either party to the interaction, it shall record the details of the abnormal event.\n\n**6.4.3 Attack Analysis**\n\nThe attack-analysis security requirements for agent interaction are as follows:\n\na) For discovered attack activities, an agent service provider shall analyze the attack target and the attack route.\n\nb) An agent service provider shall have a mechanism to protect against identified attack behaviors.\n\nc) An agent service provider should establish a mechanism for collaborative anomaly detection across multiple agents.\n\n**6.4.4 Emergency Response and Handling**\n\nThe emergency-response and handling security requirements for agent interaction are as follows:\n\na) An agent service provider shall formulate a graded response plan for agent interaction security incidents, clearly defining the handling procedures for general, relatively major, major, and especially major incidents.\n\nb) An agent service provider shall formulate an emergency strategy for agent interaction. When an agent interaction security incident occurs, the provider shall immediately activate emergency response and handling measures, and — in light of the actual situation — rapidly implement measures such as severing communication connections, blocking interactions, isolation handling, and vulnerability remediation, and initiate secondary verification for objects that repeatedly exhibit anomalies. The provider shall produce an incident report and handling record, retain complete interaction logs and a chain of evidence, and prevent security risks from spreading along the interaction chain.\n\nc) After a relatively major or higher-level security incident occurs, the agent service provider shall promptly report it to the competent authority.\n\n**6.4.5 Traceability**\n\nAn agent service provider shall have an attack-traceability mechanism and should, based on the analysis results, build a profile of the attacker.\n\n**7 Security Requirements for Agent-to-Agent Interaction**\n\n**7.1 Agent Registration Security**\n\nAn agent service provider shall select an agent identity registration service. The service shall support the following security mechanisms for the registration process. At the time of registration:\n\na) The service shall authenticate the agent’s identity.\n\nb) The service shall implement a registration monitoring mechanism that supports monitoring, alerting on, and deregistering agents with abnormal registrations.\n\nc) The service shall conduct a compliance review of agent service providers, allowing only providers that pass the review to register their agents.\n\nd) The service shall support an agent identity lifecycle management mechanism.\n\ne) The service shall, based on the agent description, detect the authenticity of capabilities and the compliance of behaviors — including but not limited to detecting the capability scope, input/output types, the provider, and obvious false/malicious injection — and it is recommended that a third-party assessment organization be engaged to carry out testing.\n\n**7.2 Agent Discovery Security**\n\nThe discovery-security requirements for agent interaction are as follows:\n\na) An agent service provider shall disclose agent descriptions based on a standardized agent discovery mechanism.\n\nb) The agent service provider of the discovering party shall verify the integrity and source of the list information returned by discovery.\n\nc) When an agent service provider chooses a service-based agent discovery mechanism, it shall select an agent discovery service that supports the following security mechanisms:\n\nIt shall have an anti-interference agent recommendation/ranking mechanism;\n\nIt shall support an anti-tampering mechanism for the agent list;\n\nIt shall support a mechanism for identifying and blocking malicious queries.\n\n**7.3 Agent-to-Agent Invocation Security**\n\nThe invocation-security requirements for agent interaction are as follows:\n\na) Both parties to an agent invocation shall perform mutual identity authentication.\n\nb) Both parties to an agent invocation shall, through a standard interface or other form, exchange each other’s agent descriptions, security policies, data requirements, and potential risks, and shall reach an invocation agreement on the basis that both parties fully understand the potential impacts.\n\nc) Both parties to an agent invocation shall follow the principle of minimum privilege, shall support a privilege-negotiation mechanism, and the validity of privileges shall be verifiable.\n\nd) An agent shall ensure decision-making autonomy during collaboration, preventing unauthorized parties from tampering with its decision logic or goals.\n\ne) During the interaction, both parties to an agent invocation should support lifecycle management of the invocation session and a mechanism to prevent session hijacking.\n\nNOTE: A session corresponds to one multi-agent interaction process. It is created by the requesting agent and has a numbered identifier, used to manage the service agents, messages, and tasks involved in that process.\n\nf) Both parties to an agent invocation shall have a security-protection mechanism against attack behaviors and content in inputs and outputs, and — for critical information — shall have the ability to verify its authenticity and integrity.\n\ng) Both parties to an agent invocation shall support a mechanism to identify abnormal behaviors that exceed the scope of the agent description.\n\nh) During the interaction, the called-party agent shall be prohibited from enabling high-risk system privileges without user authorization.\n\ni) The calling-party agent service provider shall grant only the minimum privileges consented to by the user; the called-party agent shall verify that such privileges are consistent with the user’s original authorization, and shall save the invocation logs.\n\n**8 Security Requirements for Agent-to-Tool Interaction**\n\n**8.1 Tool Discovery Security**\n\nThe tool-discovery security requirements for agent interaction are as follows:\n\na) During tool discovery, the agent service provider shall ensure that the source and integrity of the tool list are verifiable.\n\nb) A tool provider shall disclose to the calling party complete tool attribute information whose integrity and source can be verified, containing at least the tool identifier, tool name, tool description, and tool input/output parameters.\n\n**8.2 Tool Invocation Security**\n\nThe tool-invocation security requirements for agent interaction are as follows:\n\na) An agent shall obtain user authorization when invoking a tool.\n\nb) When an agent invokes a tool, identity authentication shall be performed based on an identity-authentication mode supported by both parties.\n\nNOTE: The identity-authentication mode may be any of the following: mutual identity authentication; the agent unilaterally authenticating the tool; the tool unilaterally authenticating the agent; or no identity authentication.\n\nc) A tool provider shall implement the principle of minimum interface exposure, exposing to the agent only the minimum necessary functional interfaces.\n\nd) When an agent invokes a tool, it shall follow the principle of minimum privilege.\n\ne) When an agent invokes a tool by means of a protocol, it shall be based on a standardized protocol recognized by both parties.\n\nf) An agent shall, on the basis of clear business necessity and risk-assessment results, strictly limit the application for and use of high-risk system privileges.\n\ng) For tool invocations involving high-risk system privileges, the agent service provider shall fully inform the user of the security risks and obtain the user’s express consent.\n\nh) An agent shall support a malicious-tool identification mechanism; when it identifies the tool to be invoked as a malicious tool, it shall not initiate the invocation.\n\ni) An agent shall inspect the feedback information from tools; when it identifies malicious content or malicious behavior, it shall stop the invocation.\n\n**Appendix A (Informative) — List of AI Agent Interaction Security Risks**\n\n**Table 1 — List of AI Agent Interaction Security Risks**\n\nT01 Information Tampering\n\n**Risk description:** Tampering with input instructions, tampering with tool lists, tampering with invocation parameters/return results.\n\n**Covered clauses:** 6.3 Communication Security; 7.3 Agent-to-Agent Invocation Security (f); 8.1 Tool Discovery Security (b); 8.2 Tool Invocation Security (i).\n\n**Solution:**\n\nUse a communication channel with encryption and integrity verification (6.3 b).\n\nFor agent-to-agent invocation, verify the authenticity and integrity of critical information (7.3 f).\n\nDuring tool discovery, verify the integrity of the tool list and tool attribute information (8.1 a, b).\n\nDuring tool invocation, inspect the tool’s feedback information and identify malicious content or behavior (8.2 i).\n\nT02 Information Leakage\n\n**Risk description:** Leakage of invocation-parameter/return-result information, output of sensitive information, memory theft.\n\n**Covered clauses:** 6.3 Communication Security; 7.3 Agent-to-Agent Invocation Security (b, f); 8.2 Tool Invocation Security (g).\n\n**Solution:**\n\nUse an encrypted communication channel (6.3 b).\n\nExchange data requirements and security policies before agent-to-agent invocation (7.3 b), and apply security protection to output content (7.3 f).\n\nStrictly limit the application for and use of high-risk system privileges, invoking them only in a controlled environment (8.2 g).\n\nFollow the principle of minimum privilege (6.2, 7.3 c, 8.2 d).\n\nT03 Information Missing\n\n**Risk description:** Incomplete logs, difficulty in tracing accountability.\n\n**Covered clauses:** 6.4.5 Traceability; 7.3 Agent-to-Agent Invocation Security (i).\n\n**Solution:**\n\nThe agent service provider shall have an attack-traceability mechanism (6.4.5).\n\nAgent-to-agent invocation shall save the invocation logs (7.3 i).\n\nT04 Harmful Information\n\n**Risk description:** Injection of harmful instructions, indirect injection, business-logic bypass, tool-description poisoning, malicious content in invocation parameters/return results, output of harmful/malicious content, propagation of false information.\n\n**Covered clauses:** 6.4.2 Anomaly Detection; 7.3 Agent-to-Agent Invocation Security (f, g); 8.2 Tool Invocation Security (h, i).\n\n**Solution:**\n\nMonitor the interaction status, and detect and terminate non-convergent or abnormal interactions (6.4.2).\n\nFor agent-to-agent invocation, apply security protection to inputs and outputs and identify abnormal behaviors (7.3 f, g).\n\nDuring tool invocation, support a malicious-tool identification mechanism (8.2 h) and detect malicious content fed back by tools (8.2 i).\n\nT05 Identity Error\n\n**Risk description:** Identity impersonation, agent identity forgery, forgery of the caller’s identity, confusion of user identity, unclear identity of the recipient, session hijacking.\n\n**Covered clauses:** 6.1 Identity; 7.1 Agent Registration Security (a); 7.3 Agent-to-Agent Invocation Security (a, e); 8.2 Tool Invocation Security (b).\n\n**Solution:**\n\nAn agent shall have a unique identifier and a corresponding credential (6.1).\n\nAgent identity shall be authenticated at registration (7.1 a).\n\nAgent-to-agent invocation must implement mutual identity authentication (7.3 a).\n\nWhen an agent invokes a tool, identity authentication shall be performed based on a mode supported by both parties (8.2 b).\n\nSupport lifecycle management of invocation sessions and a session-hijacking prevention mechanism (7.3 (e)).\n\nT06 Privilege Loss of Control\n\n**Risk description:** Unauthorized access, unauthorized execution, environment jailbreak, runtime-environment escape, privilege overreach, system-privilege escalation, excessive privilege application.\n\n**Covered clauses:** 6.2 Access Control; 7.3 Agent-to-Agent Invocation Security (c, h, i); 8.2 Tool Invocation Security (a, d, g).\n\n**Solution:**\n\nBoth parties to the interaction shall support an access control mechanism (6.2).\n\nAgent-to-agent invocation shall follow the principle of minimum privilege and support privilege negotiation and verification (7.3 c), shall prohibit enabling high-risk privileges without user authorization (7.3 h), and shall verify that privileges are consistent with the user’s original authorization (7.3 i).\n\nTool invocation shall obtain user authorization (8.2 a), follow minimum privilege (8.2 d), and strictly limit the use of high-risk privileges to controlled environments (8.2 g).\n\nT07 Resource Occupation\n\n**Risk description:** DoS attacks, planning confusion, resource overload, abuse of system functions.\n\n**Covered clauses:** 6.3 Communication Security (d); 6.4.1 Proactive Prevention (a); 6.4.2 Anomaly Detection (a).\n\n**Solution:**\n\nSupport traffic monitoring and cleaning, and identify and rate-limit/block abnormally high-frequency requests (6.3 d).\n\nEstablish an interaction rate-limiting mechanism to control the number and frequency of interaction counterparts per unit of time (6.4.1 a).\n\nMonitor the interaction status and promptly discover and issue early warnings of abnormal behaviors (6.4.2 a).\n\nT08 Attack Behavior\n\n**Risk description:** DoS attack tools, output of attack behaviors, output of malicious code/scripts, multi-agent collaborative attacks, spread of attacks caused by the absence of an emergency-response and handling mechanism for security incidents.\n\n**Covered clauses:** 6.4.3 Attack Analysis; 7.3 Agent-to-Agent Invocation Security (f); 8.2 Tool Invocation Security (i); 6.4.4 Emergency Response and Handling.\n\n**Solution:**\n\nAnalyze and protect against discovered attack activities, and should establish a mechanism for collaborative anomaly detection across multiple agents (6.4.3).\n\nFor agent-to-agent invocation, have a security-protection mechanism against attack behaviors in inputs and outputs (7.3 f).\n\nDuring tool invocation, inspect the tool’s feedback information and stop the invocation upon identifying malicious behavior (8.2 i).\n\nFor emergency response and handling, implement graded plans, severing/isolation/remediation, secondary verification, retention of the chain of evidence, reporting, and other handling measures (6.4.4).\n\nT09 Component Risk\n\n**Risk description:** Malicious materials, materials with vulnerabilities, malicious extensions.\n\n**Covered clauses:** 7.1 Agent Registration Security (e) (indirectly, through referencing GB/T 43698 and GB/T 44111).\n\n**Solution:**\n\nAt registration, detect the authenticity of capabilities and the compliance of behaviors based on the agent description, and it is recommended to engage a third-party assessment (7.1 e).\n\nThe normative references include software-supply-chain security standards (GB/T 43698, GB/T 44111), which provide a standards basis for preventing component risks.\n\nT10 Intent Hijacking\n\n**Risk description:** Infringement of the right to choose tools, manipulation of tool ranking, mismatch during the discovery stage or invocation of the wrong object caused by non-standard or tampered agent descriptions.\n\n**Covered clauses:** 7.2 Agent Discovery Security (c, a); 8.1 Tool Discovery Security (b).\n\n**Solution:**\n\nWhen choosing a service-based discovery mechanism, select a service that has an anti-interference agent recommendation/ranking mechanism (7.2 c 1)).\n\nDisclose agent descriptions based on a standardized agent discovery mechanism (7.2 (a)).\n\nTool attribute information shall be disclosed completely and with verifiable integrity (8.1 (b)).\n\nT11 Tool Abuse\n\n**Risk description:** Malicious tools, tool-combination attacks, tool downgrading, illegal operations, tool abuse, tool poisoning, unauthorized execution by tools.\n\n**Covered clauses:** 7.1 Agent Registration Security (e); 8.1 Tool Discovery Security (a); 8.2 Tool Invocation Security (g, h, i).\n\n**Solution:**\n\nAt registration, detect the authenticity of the agent’s capabilities and the compliance of its behaviors (7.1 e).\n\nDuring tool discovery, ensure the source and integrity of the tool list are verifiable (8.1 a).\n\nLimit high-risk tool invocation to controlled environments and explicitly obtain user authorization (8.2 g).\n\nSupport a malicious-tool identification mechanism (8.2 h), and stop the invocation upon detecting malicious content or behavior (8.2 i).\n\nT14 Intent Deviation\n\n**Risk description:** Reasoning hijacking, goal hijacking, hallucination amplification, cumulative intent drift, long-context attacks, entropy increase in tool selection, abnormal task execution.\n\n**Covered clauses:** 6.4.2 Anomaly Detection; 7.3 Agent-to-Agent Invocation Security (d, g).\n\n**Solution:**\n\nMonitor the interaction status, and forcibly terminate and record when a non-convergent interaction (falling into a loop or contradiction) is detected (6.4.2).\n\nAn agent shall ensure decision-making autonomy during collaboration, preventing unauthorized parties from tampering with its decision logic or goals (7.3 d).\n\nSupport a mechanism to identify abnormal behaviors that exceed the scope of the agent description (7.3 g).\n\nReferences\n\n[1] GB 45438—2025 — Cybersecurity technology — Labeling method for content generated and synthesized by artificial intelligence\n\n[2] GB/T 34975—2017 — Information security technology — Security technical requirements and testing and evaluation methods for application software of mobile intelligent terminals\n\n[3] GB/T 35273 — Information security technology — Personal information security specification\n\n[4] GB/T 39720—2020 — Information security technology — Security technical requirements and testing and evaluation methods for mobile intelligent terminals\n\n[5] GB/T 39276—2020 — Information security technology — General security requirements for network products and services\n\n[6] GB/T 45574—2025 — Data security technology — Security requirements for the processing of sensitive personal information\n\n[7] GB/T 45652—2025 — Cybersecurity technology — Data security specification for generative artificial intelligence pre-training and optimization-training\n\n[8] GB/T 45654—2025 — Cybersecurity technology — Basic security requirements for generative artificial intelligence services\n\n[9] GB/T 45674—2025 — Cybersecurity technology — Data-annotation security specification for generative artificial intelligence\n\n[10] HarmonyOS AI Agent Framework White Paper\n\n[11] YD/T 3973—2021 — General technical requirements for end-to-end 5G network slicing\n\n[12] YD/T 6095—2024 — General technical requirements for fixed-mobile convergence dedicated-line services based on the SDN/NFV new-generation network architecture\n\n*This is an unofficial English translation prepared for reference only. In case of any discrepancy, the original Chinese document (”网络安全标准实践指南——智能体交互安全要求（征求意见稿）”, TC260-PG-2026NA) prevails. Source: Secretariat of the National Information Security Standardization Technical Committee.*", "url": "https://wpnews.pro/news/china-s-proposal-on-security-requirements-for-ai-agent-interactions", "canonical_source": "https://www.geopolitechs.org/p/cybersecurity-standards-practice", "published_at": "2026-07-29 16:07:50+00:00", "updated_at": "2026-08-01 15:51:24.776657+00:00", "lang": "en", "topics": ["ai-policy", "ai-safety", "ai-agents"], "entities": ["National Information Security Standardization Technical Committee (TC260)", "China Mobile Communications Group Co., Ltd.", "China Electronics Standardization Institute", "Beijing Zhongguancun Laboratory", "CNCERT/CC", "ZTE Corporation", "Beijing Kuaishou Technology Co., Ltd.", "Alibaba Cloud Computing Co., Ltd."], "alternates": {"html": "https://wpnews.pro/news/china-s-proposal-on-security-requirements-for-ai-agent-interactions", "markdown": "https://wpnews.pro/news/china-s-proposal-on-security-requirements-for-ai-agent-interactions.md", "text": "https://wpnews.pro/news/china-s-proposal-on-security-requirements-for-ai-agent-interactions.txt", "jsonld": "https://wpnews.pro/news/china-s-proposal-on-security-requirements-for-ai-agent-interactions.jsonld"}}