Beijing Alliance Issues First Financial AI Agent Security Standard; Ant Misec Open-Sources HOP 3.0

The standard, led by the Beijing National FinTech Certification Center, was developed with Postal Savings Bank of China, ICBC, UnionPay, Bank of China, Bank of Communications, Huaxia Bank, Huawei, Ant Technology Group, Volcano Engine and Tencent Cloud, among others. It applies to financial institutions and technology companies developing and building security for financial-scenario agents, and covers initialization and input, model inference and decision-making, identity authentication and operation, data security and privacy protection, and risk prevention and compliance, according to Leiphone.

Under the standard, third-party mobile agents may not use system permissions to automatically read or operate the GUI of financial applications without authorization from the financial institution. When obtaining data through microphone, screenshot, screen recording or screen sharing, they must comply with the security policy of the app being called. The industry summarizes this as dual authorization: an agent must obtain both user and institutional authorization to operate a financial app.

The rule addresses a gap highlighted in December 2025, when a phone model with an AI assistant drew user complaints of login failures and blocked payments at multiple banking apps; on Dec. 6, the assistant removed financial app operation features. At the time, there were no targeted rules. Some agents read screens, simulate clicks or use OCR to identify interface text rather than calling official application programming interfaces. That approach covers more apps but bypasses the app provider's control over permission scope, risk controls and responsibility allocation; in licensed payment and wealth-management services, it is directly tied to user accounts and funds.

China has been building rules around the technology. In May 2026, the Cyberspace Administration of China, National Development and Reform Commission and Ministry of Industry and Information Technology jointly issued implementation opinions on standardized application and innovative development of agents, calling for permission management and behavior control. In July 2026, the GB/Z 185.1–185.7—2026 series of national standardization guiding technical documents on AI agent interconnection was released, and the Standardization Administration issued a mandatory national standard plan for basic security requirements for agent applications. On July 15, the CAC published a new batch of seven on-device generative AI service filings.

Terminal vendors have adjusted their approaches. A new-generation Doubao phone changed cooperation with super apps including Alibaba and Tencent, no longer reading screens or simulating clicks after user authorization; access is allowed only when an app provides an MCP service and permits control. StepFun's STEPX Neo also moved to the GUI-MCP protocol, with the app deciding the scope of access. In June 2026, WeChat and phone makers such as Honor launched an A2A assistant capability that lets users initiate WeChat calls or send messages through a voice assistant; WeChat actively opens the interface and connects it to manufacturer agents, forming a second permission beyond user authorization. Overseas, Google and Samsung's Galaxy S26 series also use a model in which the system opens permissions and apps cooperate.

Ant Misec Chairman Wei Tao announced the HOP 3.0 open-source release at the 2026 Inclusion·Bund Conference. The framework, first released as HOP 1.0 during the 2025 World AI Conference, was upgraded to 3.0 during the 2026 World AI Conference with a proposed agent native language and a goal of building trusted native agents, according to Leiphone.

Ant Misec describes three types of loss of control as autonomous agents enter finance, healthcare and government affairs: humans cannot review and intervene fast enough; agents may skip steps, cross boundaries or execute wrong actions, trapping long tasks in logical loops; and unbounded context can lead to sensitive data leaks. The company says current agent ecosystems split task knowledge, written in natural-language skills, from control and scheduling, handled by code harnesses. Natural-language skills are easy to read and write but struggle to carry complex multi-step, multi-branch, multi-condition and multi-role workflows, while code harnesses are hard for industry experts to join and difficult to audit across code, prompts and runtime states.

HOP 3.0 introduces an agent native language that combines explicit structured logic with the model's fuzzy reasoning in one expression and execution system. Structured logic defines task goals, boundary conditions, data dependencies, key processes and verification requirements, while the model makes judgments, plans and explorations within those boundaries. The framework borrows from SQL transaction commit mechanisms, separating exploration, verification and commit. Agents first explore in a reversible space and must pass independent verification before entering the commit gate; irreversible operations such as deleting emails, code or databases are isolated in the explicit commit stage. Successful exploration paths can be turned into reusable execution processes.

According to Ant Misec, in complex specification-driven R&D workflows, HOP 3.0 achieved 100% product completeness, generation success rate and requirement-code consistency, while average token consumption per execution cycle fell about 13%. The failure rate of ordinary models dropped about 91.7%, and with HOP 3.0 the results reached or exceeded those of strong models without HOP. Wei said a Qwen3.0 27B model with about 27 billion parameters could effectively handle complex tasks that previously required models with hundreds of billions or even trillions of parameters, because the language and execution engine carry much of the long-task control burden.

HOP 3.0 is available on GitHub. Ant Misec says the framework works with confidential computing: confidential computing protects data, models and knowledge, while HOP ensures trusted agent actions, linking data, models, agents and business results. The company says the open-source release is intended to bring developers together with experts in risk control, compliance, healthcare and auditing, allowing non-programmer experts to embed business rules and professional judgment into agent workflows and reducing intelligence islands trapped in individual experience.

Editor's Summary The Beijing FinTech Industry Alliance's new standard makes dual authorization the baseline for agents operating financial apps, as China's regulators and terminal vendors move toward permission-based agent access. Ant Misec's open-source HOP 3.0 offers a parallel technical route that separates exploration from irreversible commits and aims to make long, complex agent tasks more auditable and cheaper to run.