TC260 releases AI Safety Governance Framework 3.0, risk items increase from 30 to 54

TC260, China's main AI standards body, released the AI Safety Governance Framework 3.0, with risk items increasing from 30 in the previous version to 54. It opens by noting that AI has shifted from "answering questions" to "executing tasks." New content covers agent operational risks, including prompt injection, tool poisoning, identity forgery, memory contamination, credential theft, and goal hijacking in long-horizon tasks, and proposes measures such as phased delegation of authority, human approval for high-risk tasks, security audits of tools and plugins, and runtime guardrails. The framework also includes, for the first time, embodied AI risks, autonomous cyberattacks, model refusal to shut down, deceiving evaluators, deliberate sandbagging, and other agent misalignment behaviors, and devotes a separate section to cybersecurity risks. It provides a more balanced assessment of open-source and closed-source models, adds categories for personal information protection, cultural and social risks, and environmental protection, and calls for exploring regulatory sandboxes in finance, education, broadcasting, and healthcare. The framework is non-binding but was drafted under the guidance of the CAC and is seen as a blueprint for subsequent standard development.