Beijing’s 15th Five-Year digital-economy development plan places AI-agent security inside a broader effort to make the capital a globally benchmark city for the digital economy by 2030. The plan is a policy document, not evidence that its proposed laboratories, testing ranges, or monitoring systems are already operating.
The September 2026 document (titled 北京市十五五时期数字经济发展规划) connects the expansion of intelligent agents with a planned security architecture. Its provisions cover threat detection, active defense, model testing, risk response, open-source software, data and AI legislation, and evaluation standards. The approach treats security as part of the digital economy’s planned infrastructure rather than as a separate response after deployment.
The Beijing Municipal Government plan calls for research and development of AI threat-detection and active-defense products. It also proposes stronger AI-security capabilities and closer integration between AI and cybersecurity. Those are development directions in the plan, so they should not be read as a statement that Beijing has completed a particular product or security rollout.
For background, EastFrontier has separately covered Beijing’s AI governance playbook. That earlier material does not establish the provisions of the new plan, which remain future-oriented.
Beijing’s planned model-security testing architecture
The plan’s AI-security-governance section proposes an AI security attack-and-defense laboratory and a model-security testing range. It also calls for intelligent risk monitoring and emergency response for risks that include model failure and computing interruption. The wording describes facilities and systems Beijing plans to build or develop; it does not establish that either the laboratory or the testing range is currently operational.
That distinction matters for understanding what the document changes. The plan sets out an institutional direction for testing and response, but it does not name a model that has completed an evaluation, provide a benchmark score, or identify a finished testing program. It also does not show that a particular agent has been tested under the plan. The proposed architecture is therefore a framework for future capability, not a record of completed security performance.
The document also calls for stronger local AI and data legislation and standards, AI ethics review, and generative-AI service filing. Together, these measures describe several points of oversight: rules and standards, review of ethical issues, filing requirements for services, technical testing, and response to operational risks. The plan does not say that those elements have been unified into a live platform.
EastFrontier has also discussed human oversight in China’s agentic AI policy, but the September plan must be read on its own terms. Its provisions are future-oriented and belong to Beijing’s 15th Five-Year digital-economy plan, rather than to a claim that previous policy goals have already been implemented.
AI agents, LinkeeOS, and the security of open code
Security is attached to the plan’s agent strategy as well. Beijing’s document proposes laying out a LinkeeOS intelligent-agent operating system, developing software agents, exploring an agent internet, and supporting agent terminals and agent frameworks. It does not identify a specific deployed LinkeeOS product or establish that an operational agent internet already exists.
The plan also proposes sending domestic foundation models, agents, developer toolchains, and computing services to Belt and Road countries and emerging markets. That provision places agent development, software tooling, and computing services within the same outward-facing digital-economy framework. It does not identify a named company, deployment, or completed overseas program tied to these provisions.
Open-source software receives its own safeguards. The plan calls for stronger code-review and security-detection mechanisms, alongside controls for open-source supply-chain security and intellectual-property risk. These provisions indicate the areas Beijing wants policy and technical systems to address as open code and agent frameworks spread. They are not evidence that a particular review system is live or that a specific supply-chain incident has occurred.
Evaluation standards define the plan’s next policy layer
Beyond security facilities, the plan calls for a classified and graded model-evaluation system with international influence. Elsewhere, it proposes high-quality data evaluation standards and evaluation and verification services. The document does not name a benchmark suite, provide a score, or report completed testing for a specific model or agent.
That absence keeps the plan’s immediate significance in the realm of institutional design. Beijing is proposing categories for evaluating models and data, mechanisms for testing security, and responses to failures or interruptions. The plan does not say how a future evaluation would rank a particular agent, which organization would operate each facility, or when a proposed system would begin handling live services.
The same discipline applies to the plan’s 2030 objectives. It sets a goal of building a globally benchmark city for the digital economy, but that is a target rather than an achieved result. The document also includes targets such as digital-economy value exceeding 50% of regional GDP, 2,000 ten-thousand tokens per kilowatt-hour, 100 robots per 10,000 people, and 95% AI-application coverage across schools. Those figures are not agent-security outcomes and do not demonstrate progress by themselves.
The separate July 21, 2026 Measures on Accelerating Agent-Led Development should likewise remain distinct. The official interpretation published July 23 says that those measures include exploring classified and graded agent supervision, recurring remediation of malicious misuse, agent-security infrastructure and service platforms, and testing ranges and security foundation models for security detection and attack-defense services. Those agent-specific measures belong to the July policy, not to the September plan, even though both documents address security and agents.
Taken together, the two policy documents show separate planning tracks that should not be merged into one operational claim. Beijing’s September plan sets out a digital-economy framework linking agents, open-source safeguards, model evaluation, threat defense, and emergency response. Its proposed laboratories, testing range, monitoring systems, and LinkeeOS direction remain future provisions. The next question is not whether the plan names security as a priority, but how Beijing will translate those provisions into standards, institutions, and verifiable tests.