China's Proposal on Security Requirements for AI Agent Interactions

Cybersecurity Standards Practice Guide — Security Requirements for Agent Interactions (Draft for Public Consultation)

This is an unofficial English translation of a Chinese cybersecurity standards document, “Cybersecurity Standards Practice Guide — Security Requirements for AI Agent Interaction” (TC260-PG-2026NA).

It was released in July 2026 (Draft for Public Comment, v0.23) by the Secretariat of the National Information Security Standardization Technical Committee (TC260) — the body that steers China’s national cybersecurity standards.

As a “practice guide,” it is not a mandatory national standard but an authoritative reference that signals the direction of forthcoming regulation and industry practice.

The guide sets out security requirements for how AI agents interact — both agent-to-agent and agent-to-tool — with the aim of preventing risks such as identity forgery, unauthorized (privilege) access, and the cascading spread of hallucinations across multiple agents.

It is organized around three areas:

(1) general interaction security (identity, access control, communication security, and risk management);

(2) agent-to-agent interaction security (registration, discovery, and mutual invocation); and

(3) agent-to-tool interaction security (tool discovery and tool invocation). An informative appendix maps a catalog of concrete interaction risks (e.g., information tampering, information leakage, privilege loss of control, tool abuse, intent hijacking) to the specific clauses that mitigate them.

It is aimed at AI agent service providers and tool providers, and can also serve as a reference for third-party assessors.

(The full translation follows. In case of any discrepancy, the original Chinese document prevails.）

Foreword

The Cybersecurity Standards Practice Guide (hereinafter the “Practice Guide”) is a standards-related technical document organized, developed, and published by the Secretariat of the National Information Security Standardization Technical Committee (hereinafter the “Cybersecurity Standardization Committee” or “TC260”). It aims to promote cybersecurity-related standards and knowledge and to provide standardization practice guidance around such themes as cybersecurity laws, regulations and policies, standards, and cybersecurity hot topics and incidents.

Drafting organizations of this document: China Mobile Communications Group Co., Ltd.; China Electronics Standardization Institute; Beijing Zhongguancun Laboratory; National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC); ZTE Corporation; Beijing Kuaishou Technology Co., Ltd.; Fudan University; Alibaba Cloud Computing Co., Ltd.; Strategic Research Center of Qiyuan Laboratory; Ant Technology Group Co., Ltd.; Harbin Institute of Technology.

Drafters of this document: Qiu Qin, Su Li, Yang Kai, Li Ziwei, He Min, Cui Yong, Chen Jia, Zhao Yuhang, Ran Peng, Sun Yang, Li Bangling, Lu Dongjie, Xu Sijia, Zhang Yanting, Zhang Lei, Chao Yihan, Du Chenguang, Shi Guixin, Li Ye, Wang Kun, Wang Bo, Zhou Jihua, Mei Aoting, Cao Xiaoqi, Shao Meng, Wang Jian, Gu Chen, Yang Min, Hong Geng, Chen Pei, Peng Juntao, Xu Yuan, Li Yunjia, Lin Guanchen, Yang Xiaofang, Peng Jin, Jiang Wei, Ye Lin.

Statement

The copyright of this Practice Guide belongs to the Secretariat of the Cybersecurity Standardization Committee. Without the written authorization of the Secretariat, no part of this Practice Guide may be copied or translated in any manner. When reprinting or citing the views or data of this Practice Guide, please indicate: “Source: Secretariat of the National Information Security Standardization Technical Committee.”

Abstract

This document is developed to guide the interaction security of AI agents and to prevent security risks such as identity forgery, unauthorized access, and cascading hallucination propagation across multiple agents during agent interaction, in accordance with the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, and relevant national standards.

To this end, this Guide specifies general security requirements for agent interaction, as well as security requirements for agent-to-agent interaction and agent-to-tool interaction. It is intended to provide security practice guidance on the interaction process for AI agent service providers and tool providers, and may also serve as a reference for third-party assessment organizations and other bodies.

Table of Contents

1. Scope

2. Normative References

3. Terms and Definitions

4. Abbreviations

5. Overview

6. General Security Requirements for AI Agent Interaction

7. Security Requirements for Agent-to-Agent Interaction

8. Security Requirements for Agent-to-Tool Interaction

• Appendix A (Informative) — List of AI Agent Interaction Security Risks

• References

1 Scope

This document specifies the interaction security requirements for agent-to-agent and agent-to-tool interactions, including general security requirements for agent interaction, security requirements for agent-to-agent interaction, and security requirements for agent-to-tool interaction.

This document is applicable to guiding AI agent service providers and tool providers in safeguarding the security of the agent interaction process. It is also applicable to third-party assessment organizations and other bodies in assessing the security of agent interaction.

2 Normative References

The contents of the following documents, through normative reference in this text, constitute indispensable provisions of this document. For dated references, only the version corresponding to that date applies to this document. For undated references, the latest version (including all amendments) applies to this document.

• GB/T 25069 — Information security techniques — Terminology

• GB 45438—2025 — Cybersecurity technology — Labeling method for content generated and synthesized by artificial intelligence

• GB/T 45574—2025 — Data security technology — Security requirements for the processing of sensitive personal information

• GB/T 45654—2025 — Cybersecurity technology — Basic security requirements for generative artificial intelligence services

• GB/Z 185.1—2026 — Artificial intelligence — Agent interconnection — Part 1: General architecture

• GB/Z 185.3—2026 — Artificial intelligence — Agent interconnection — Part 3: Identity management

• GB/Z 185.4—2026 — Artificial intelligence — Agent interconnection — Part 4: Agent description

• GB/Z 185.5—2026 — Artificial intelligence — Agent interconnection — Part 5: Agent discovery

• ISO/IEC 22989:2022 — Information technology — Artificial intelligence — Artificial intelligence concepts and terminology

3 Terms and Definitions

3.1 AI agent

A general term for an automated entity — that is, a process or system that can operate under specified conditions without human intervention or with controlled human intervention, that can perceive and respond to its environment, and that takes actions to achieve its goals.

[Source: ISO/IEC 22989:2022, 3.1.1, modified]

3.2 AI agent service provider

An organization or individual that provides AI agent services.

3.3 AI agent description

Machine- and human-understandable information used to describe an agent’s name, functions, and so forth.

[Source: GB/Z 185.4—2026, 3.1]

NOTE: In a specific system, the agent description generally follows a specific form of expression.

3.4 AI agent credential

A tamper-resistant collection of data that contains claims about an agent’s identity attributes and is used for identity authentication.

[Source: GB/Z 185.1—2026, 3.4]

3.5 AI agent discovery

The process of matching and obtaining one or more agent descriptions that meet business requirements.

[Source: GB/Z 185.5—2026, 3.1]

3.6 Agent discovery service

A process that implements or provides the agent discovery function.

[Source: GB/Z 185.5—2026, 3.2]

3.7 Agent identity registration service

A service that processes agent identity registration requests, performs agent identity verification, and manages agent identity accounts.

[Source: GB/Z 185.3—2026, 3.4, modified]

3.8 Critical information infrastructure

Important network facilities, information systems, and the like in important industries and fields such as public communications and information services, energy, transportation, water conservancy, finance, public services, e-government, and the national defense science, technology, and industry sector, as well as others that, once damaged, disabled, or subject to data breach, may seriously endanger national security, the national economy and people’s livelihood, or the public interest.

[Source: GB/T 39204—2022, 3.1]

3.9 Tool

A functional entity that can be invoked by an agent application.

NOTE: Examples of tools include cloud services, applications, agents, external devices, and so forth.

3.10 Minimum privilege

For a given subject, its access rights are limited to only those privileges necessary to perform the authorized tasks.

[Source: GB/T 5271.8—2001, 08.04.15, modified]

3.11 Identity (identifier)

Information that can uniquely determine the identity of an entity.

[Source: GM/T 0090—2020, 3.1]

NOTE: An identifier consists of information that the entity cannot repudiate, such as the entity’s identifiable name, email address, ID card number, telephone number, street address, and so forth.

4 Abbreviations

The following abbreviations apply to this document.

• AI: Artificial Intelligence

• TLS: Transport Layer Security

• IP: Internet Protocol

5 Overview

The security requirements for agent interaction include general security requirements for agent interaction, security requirements for agent-to-agent interaction, and security requirements for agent-to-tool interaction, as shown in Figure 1:

Figure 1 — AI Agent Interaction Security Architecture

Description of Figure 1 (original labels are in Chinese): The architecture consists of two top-level blocks — Security Requirements for Agent-to-Agent Interaction (智能体间交互安全要求) and Security Requirements for Agent-to-Tool Interaction (智能体与工具交互安全要求) — which are both supported (支撑) by a foundational layer, General Security Requirements for Agent Interaction (智能体交互通用安全要求). This foundational layer comprises four components: Identity (身份标识), Access Control (访问控制), Communication Security (通信安全), and Risk Management (风险管控).

6 General Security Requirements for AI Agent Interaction

6.1 Identity

An agent shall have an identifier that can uniquely identify the agent. An agent shall have an agent credential corresponding to that identifier.

6.2 Access Control

Both parties to an agent interaction shall support an access control mechanism to decide whether to permit access and to interrupt access.

6.3 Communication Security

The communication security requirements for agent interaction are as follows:

a) An agent shall use a secure communication channel that supports identity authentication of the access object and provides non-repudiation of both parties’ behaviors.

b) An agent shall adopt encryption and integrity-verification strategies, and should use a transport-layer protocol of TLS 1.2 or above.

c) An agent that processes critical business carried by critical information infrastructure shall, during communication with an interaction counterpart, use cryptographic algorithms for identity authentication, data encryption, and integrity verification in accordance with the requirements of the national cryptography administration authority and relevant industry requirements.

d) An agent service provider shall support traffic monitoring and cleaning mechanisms, identify and rate-limit/block abnormally high-frequency requests, and prevent resource-exhaustion attacks.

e) An agent service provider should support a transmission-path redundancy mechanism that automatically switches to a backup path when the primary path is impaired.

6.4 Risk Management

6.4.1 Proactive Prevention

The proactive-prevention security requirements for agent interaction are as follows:

a) An agent service provider shall establish an interaction rate-limiting mechanism for agents, controlling the number of interaction counterparts and the interaction frequency of a single agent per unit of time.

b) An agent service provider should support making advance judgments about potential abnormal interaction behaviors based on historical interaction logs and behavior-feature libraries, and should intercept high-risk interaction requests or subject them to manual review.

6.4.2 Anomaly Detection

The anomaly-detection security requirements for agent interaction are as follows:

a) An agent service provider shall, on the condition that user authorization has been obtained, support a monitoring function for the agent interaction status, tracking in real time such information as communication time, interaction counterparts, interaction status, and interaction behaviors, and shall promptly discover and issue early warnings of abnormal behaviors.

b) When a non-convergent interaction or communication anomaly is detected, the agent service provider shall forcibly terminate the interaction and record the anomaly information.

NOTE: A non-convergent interaction refers to a situation in which the dialogue or operation sequence between agents falls into repetition, looping, or contradiction and cannot advance the task, or an interconnection interruption caused by a network fault, a crash of the counterpart agent, or non-responsiveness.

c) When the agent service provider detects abnormal behavior by either party to the interaction, it shall record the details of the abnormal event.

6.4.3 Attack Analysis

The attack-analysis security requirements for agent interaction are as follows:

a) For discovered attack activities, an agent service provider shall analyze the attack target and the attack route.

b) An agent service provider shall have a mechanism to protect against identified attack behaviors.

c) An agent service provider should establish a mechanism for collaborative anomaly detection across multiple agents.

6.4.4 Emergency Response and Handling

The emergency-response and handling security requirements for agent interaction are as follows:

a) An agent service provider shall formulate a graded response plan for agent interaction security incidents, clearly defining the handling procedures for general, relatively major, major, and especially major incidents.

b) An agent service provider shall formulate an emergency strategy for agent interaction. When an agent interaction security incident occurs, the provider shall immediately activate emergency response and handling measures, and — in light of the actual situation — rapidly implement measures such as severing communication connections, blocking interactions, isolation handling, and vulnerability remediation, and initiate secondary verification for objects that repeatedly exhibit anomalies. The provider shall produce an incident report and handling record, retain complete interaction logs and a chain of evidence, and prevent security risks from spreading along the interaction chain.

c) After a relatively major or higher-level security incident occurs, the agent service provider shall promptly report it to the competent authority.

6.4.5 Traceability

An agent service provider shall have an attack-traceability mechanism and should, based on the analysis results, build a profile of the attacker.

7 Security Requirements for Agent-to-Agent Interaction

7.1 Agent Registration Security

An agent service provider shall select an agent identity registration service. The service shall support the following security mechanisms for the registration process. At the time of registration:

a) The service shall authenticate the agent’s identity.

b) The service shall implement a registration monitoring mechanism that supports monitoring, alerting on, and deregistering agents with abnormal registrations.

c) The service shall conduct a compliance review of agent service providers, allowing only providers that pass the review to register their agents.

d) The service shall support an agent identity lifecycle management mechanism.

e) The service shall, based on the agent description, detect the authenticity of capabilities and the compliance of behaviors — including but not limited to detecting the capability scope, input/output types, the provider, and obvious false/malicious injection — and it is recommended that a third-party assessment organization be engaged to carry out testing.

7.2 Agent Discovery Security

The discovery-security requirements for agent interaction are as follows:

a) An agent service provider shall disclose agent descriptions based on a standardized agent discovery mechanism.

b) The agent service provider of the discovering party shall verify the integrity and source of the list information returned by discovery.

c) When an agent service provider chooses a service-based agent discovery mechanism, it shall select an agent discovery service that supports the following security mechanisms:

1. It shall have an anti-interference agent recommendation/ranking mechanism;

2. It shall support an anti-tampering mechanism for the agent list;

3. It shall support a mechanism for identifying and blocking malicious queries.

7.3 Agent-to-Agent Invocation Security

The invocation-security requirements for agent interaction are as follows:

a) Both parties to an agent invocation shall perform mutual identity authentication.

b) Both parties to an agent invocation shall, through a standard interface or other form, exchange each other’s agent descriptions, security policies, data requirements, and potential risks, and shall reach an invocation agreement on the basis that both parties fully understand the potential impacts.

c) Both parties to an agent invocation shall follow the principle of minimum privilege, shall support a privilege-negotiation mechanism, and the validity of privileges shall be verifiable.

d) An agent shall ensure decision-making autonomy during collaboration, preventing unauthorized parties from tampering with its decision logic or goals.

e) During the interaction, both parties to an agent invocation should support lifecycle management of the invocation session and a mechanism to prevent session hijacking.

NOTE: A session corresponds to one multi-agent interaction process. It is created by the requesting agent and has a numbered identifier, used to manage the service agents, messages, and tasks involved in that process.

f) Both parties to an agent invocation shall have a security-protection mechanism against attack behaviors and content in inputs and outputs, and — for critical information — shall have the ability to verify its authenticity and integrity.

g) Both parties to an agent invocation shall support a mechanism to identify abnormal behaviors that exceed the scope of the agent description.

h) During the interaction, the called-party agent shall be prohibited from enabling high-risk system privileges without user authorization.

i) The calling-party agent service provider shall grant only the minimum privileges consented to by the user; the called-party agent shall verify that such privileges are consistent with the user’s original authorization, and shall save the invocation logs.

8 Security Requirements for Agent-to-Tool Interaction

8.1 Tool Discovery Security

The tool-discovery security requirements for agent interaction are as follows:

a) During tool discovery, the agent service provider shall ensure that the source and integrity of the tool list are verifiable.

b) A tool provider shall disclose to the calling party complete tool attribute information whose integrity and source can be verified, containing at least the tool identifier, tool name, tool description, and tool input/output parameters.

8.2 Tool Invocation Security

The tool-invocation security requirements for agent interaction are as follows:

a) An agent shall obtain user authorization when invoking a tool.

b) When an agent invokes a tool, identity authentication shall be performed based on an identity-authentication mode supported by both parties.

NOTE: The identity-authentication mode may be any of the following: mutual identity authentication; the agent unilaterally authenticating the tool; the tool unilaterally authenticating the agent; or no identity authentication.

c) A tool provider shall implement the principle of minimum interface exposure, exposing to the agent only the minimum necessary functional interfaces.

d) When an agent invokes a tool, it shall follow the principle of minimum privilege.

e) When an agent invokes a tool by means of a protocol, it shall be based on a standardized protocol recognized by both parties.

f) An agent shall, on the basis of clear business necessity and risk-assessment results, strictly limit the application for and use of high-risk system privileges.

g) For tool invocations involving high-risk system privileges, the agent service provider shall fully inform the user of the security risks and obtain the user’s express consent.

h) An agent shall support a malicious-tool identification mechanism; when it identifies the tool to be invoked as a malicious tool, it shall not initiate the invocation.

i) An agent shall inspect the feedback information from tools; when it identifies malicious content or malicious behavior, it shall stop the invocation.

Appendix A (Informative) — List of AI Agent Interaction Security Risks

Table 1 — List of AI Agent Interaction Security Risks

T01 Information Tampering

Risk description: Tampering with input instructions, tampering with tool lists, tampering with invocation parameters/return results.

Covered clauses: 6.3 Communication Security; 7.3 Agent-to-Agent Invocation Security (f); 8.1 Tool Discovery Security (b); 8.2 Tool Invocation Security (i).

Solution:

1. Use a communication channel with encryption and integrity verification (6.3 b).

2. For agent-to-agent invocation, verify the authenticity and integrity of critical information (7.3 f).

3. During tool discovery, verify the integrity of the tool list and tool attribute information (8.1 a, b).

4. During tool invocation, inspect the tool’s feedback information and identify malicious content or behavior (8.2 i).

T02 Information Leakage

Risk description: Leakage of invocation-parameter/return-result information, output of sensitive information, memory theft.

Covered clauses: 6.3 Communication Security; 7.3 Agent-to-Agent Invocation Security (b, f); 8.2 Tool Invocation Security (g).

Solution:

1. Use an encrypted communication channel (6.3 b).

2. Exchange data requirements and security policies before agent-to-agent invocation (7.3 b), and apply security protection to output content (7.3 f).

3. Strictly limit the application for and use of high-risk system privileges, invoking them only in a controlled environment (8.2 g).

4. Follow the principle of minimum privilege (6.2, 7.3 c, 8.2 d).

T03 Information Missing

Risk description: Incomplete logs, difficulty in tracing accountability.

Covered clauses: 6.4.5 Traceability; 7.3 Agent-to-Agent Invocation Security (i).

Solution:

1. The agent service provider shall have an attack-traceability mechanism (6.4.5).

2. Agent-to-agent invocation shall save the invocation logs (7.3 i).

T04 Harmful Information

Risk description: Injection of harmful instructions, indirect injection, business-logic bypass, tool-description poisoning, malicious content in invocation parameters/return results, output of harmful/malicious content, propagation of false information.

Covered clauses: 6.4.2 Anomaly Detection; 7.3 Agent-to-Agent Invocation Security (f, g); 8.2 Tool Invocation Security (h, i).

Solution:

1. Monitor the interaction status, and detect and terminate non-convergent or abnormal interactions (6.4.2).

2. For agent-to-agent invocation, apply security protection to inputs and outputs and identify abnormal behaviors (7.3 f, g).

3. During tool invocation, support a malicious-tool identification mechanism (8.2 h) and detect malicious content fed back by tools (8.2 i).

T05 Identity Error

Risk description: Identity impersonation, agent identity forgery, forgery of the caller’s identity, confusion of user identity, unclear identity of the recipient, session hijacking.

Covered clauses: 6.1 Identity; 7.1 Agent Registration Security (a); 7.3 Agent-to-Agent Invocation Security (a, e); 8.2 Tool Invocation Security (b).

Solution:

1. An agent shall have a unique identifier and a corresponding credential (6.1).

2. Agent identity shall be authenticated at registration (7.1 a).

3. Agent-to-agent invocation must implement mutual identity authentication (7.3 a).

4. When an agent invokes a tool, identity authentication shall be performed based on a mode supported by both parties (8.2 b).

5. Support lifecycle management of invocation sessions and a session-hijacking prevention mechanism (7.3 (e)).

T06 Privilege Loss of Control

Risk description: Unauthorized access, unauthorized execution, environment jailbreak, runtime-environment escape, privilege overreach, system-privilege escalation, excessive privilege application.

Covered clauses: 6.2 Access Control; 7.3 Agent-to-Agent Invocation Security (c, h, i); 8.2 Tool Invocation Security (a, d, g).

Solution:

1. Both parties to the interaction shall support an access control mechanism (6.2).

2. Agent-to-agent invocation shall follow the principle of minimum privilege and support privilege negotiation and verification (7.3 c), shall prohibit enabling high-risk privileges without user authorization (7.3 h), and shall verify that privileges are consistent with the user’s original authorization (7.3 i).

3. Tool invocation shall obtain user authorization (8.2 a), follow minimum privilege (8.2 d), and strictly limit the use of high-risk privileges to controlled environments (8.2 g).

T07 Resource Occupation

Risk description: DoS attacks, planning confusion, resource overload, abuse of system functions.

Covered clauses: 6.3 Communication Security (d); 6.4.1 Proactive Prevention (a); 6.4.2 Anomaly Detection (a).

Solution:

1. Support traffic monitoring and cleaning, and identify and rate-limit/block abnormally high-frequency requests (6.3 d).

2. Establish an interaction rate-limiting mechanism to control the number and frequency of interaction counterparts per unit of time (6.4.1 a).

3. Monitor the interaction status and promptly discover and issue early warnings of abnormal behaviors (6.4.2 a).

T08 Attack Behavior

Risk description: DoS attack tools, output of attack behaviors, output of malicious code/scripts, multi-agent collaborative attacks, spread of attacks caused by the absence of an emergency-response and handling mechanism for security incidents.

Covered clauses: 6.4.3 Attack Analysis; 7.3 Agent-to-Agent Invocation Security (f); 8.2 Tool Invocation Security (i); 6.4.4 Emergency Response and Handling.

Solution:

1. Analyze and protect against discovered attack activities, and should establish a mechanism for collaborative anomaly detection across multiple agents (6.4.3).

2. For agent-to-agent invocation, have a security-protection mechanism against attack behaviors in inputs and outputs (7.3 f).

3. During tool invocation, inspect the tool’s feedback information and stop the invocation upon identifying malicious behavior (8.2 i).

4. For emergency response and handling, implement graded plans, severing/isolation/remediation, secondary verification, retention of the chain of evidence, reporting, and other handling measures (6.4.4).

T09 Component Risk

Risk description: Malicious materials, materials with vulnerabilities, malicious extensions.

Covered clauses: 7.1 Agent Registration Security (e) (indirectly, through referencing GB/T 43698 and GB/T 44111).

Solution:

1. At registration, detect the authenticity of capabilities and the compliance of behaviors based on the agent description, and it is recommended to engage a third-party assessment (7.1 e).

2. The normative references include software-supply-chain security standards (GB/T 43698, GB/T 44111), which provide a standards basis for preventing component risks.

T10 Intent Hijacking

Risk description: Infringement of the right to choose tools, manipulation of tool ranking, mismatch during the discovery stage or invocation of the wrong object caused by non-standard or tampered agent descriptions.

Covered clauses: 7.2 Agent Discovery Security (c, a); 8.1 Tool Discovery Security (b).

Solution:

1. When choosing a service-based discovery mechanism, select a service that has an anti-interference agent recommendation/ranking mechanism (7.2 c 1)).

2. Disclose agent descriptions based on a standardized agent discovery mechanism (7.2 (a)).

3. Tool attribute information shall be disclosed completely and with verifiable integrity (8.1 (b)).

T11 Tool Abuse

Risk description: Malicious tools, tool-combination attacks, tool downgrading, illegal operations, tool abuse, tool poisoning, unauthorized execution by tools.

Covered clauses: 7.1 Agent Registration Security (e); 8.1 Tool Discovery Security (a); 8.2 Tool Invocation Security (g, h, i).

Solution:

1. At registration, detect the authenticity of the agent’s capabilities and the compliance of its behaviors (7.1 e).

2. During tool discovery, ensure the source and integrity of the tool list are verifiable (8.1 a).

3. Limit high-risk tool invocation to controlled environments and explicitly obtain user authorization (8.2 g).

4. Support a malicious-tool identification mechanism (8.2 h), and stop the invocation upon detecting malicious content or behavior (8.2 i).

T14 Intent Deviation

Risk description: Reasoning hijacking, goal hijacking, hallucination amplification, cumulative intent drift, long-context attacks, entropy increase in tool selection, abnormal task execution.

Covered clauses: 6.4.2 Anomaly Detection; 7.3 Agent-to-Agent Invocation Security (d, g).

Solution:

1. Monitor the interaction status, and forcibly terminate and record when a non-convergent interaction (falling into a loop or contradiction) is detected (6.4.2).

2. An agent shall ensure decision-making autonomy during collaboration, preventing unauthorized parties from tampering with its decision logic or goals (7.3 d).

3. Support a mechanism to identify abnormal behaviors that exceed the scope of the agent description (7.3 g).

---

References

[1] GB 45438—2025 — Cybersecurity technology — Labeling method for content generated and synthesized by artificial intelligence

[2] GB/T 34975—2017 — Information security technology — Security technical requirements and testing and evaluation methods for application software of mobile intelligent terminals

[3] GB/T 35273 — Information security technology — Personal information security specification

[4] GB/T 39720—2020 — Information security technology — Security technical requirements and testing and evaluation methods for mobile intelligent terminals

[5] GB/T 39276—2020 — Information security technology — General security requirements for network products and services

[6] GB/T 45574—2025 — Data security technology — Security requirements for the processing of sensitive personal information

[7] GB/T 45652—2025 — Cybersecurity technology — Data security specification for generative artificial intelligence pre-training and optimization-training

[8] GB/T 45654—2025 — Cybersecurity technology — Basic security requirements for generative artificial intelligence services

[9] GB/T 45674—2025 — Cybersecurity technology — Data-annotation security specification for generative artificial intelligence

[10] HarmonyOS AI Agent Framework White Paper

[11] YD/T 3973—2021 — General technical requirements for end-to-end 5G network slicing

[12] YD/T 6095—2024 — General technical requirements for fixed-mobile convergence dedicated-line services based on the SDN/NFV new-generation network architecture

---

This is an unofficial English translation prepared for reference only. In case of any discrepancy, the original Chinese document (”网络安全标准实践指南——智能体交互安全要求（征求意见稿）”, TC260-PG-2026NA) prevails. Source: Secretariat of the National Information Security Standardization Technical Committee.