DeepMind's AI Control Roadmap treats AI agents as insider threats

Google DeepMind has published its first AI Control Roadmap, announced June 18, 2026, together with a companion policy framework called "Three Layers of Agent Security." The roadmap describes how DeepMind secures its own internal systems against AI agents that are increasingly capable but — this is the interesting admission — possibly imperfectly aligned. It is the first operational, defense-in-depth control plan published by a frontier lab, and it marks a genuine shift: agent safety moving out of alignment theory and into security engineering practice.

What shipped

The roadmap is built on a deliberately uncomfortable assumption: what if a highly capable agent is not aligned with your goals and acts in unexpected ways? Rather than betting everything on training the model to be safe, DeepMind keeps alignment as the primary defense and adds a control layer designed to hold even when alignment fails. Their analogy is a driving instructor with dual controls: trust the student, keep a foot near the brake.

There are three components.

A threat model that treats agents as insider threats. An internal agent with tool access looks a lot like an employee who already has badge access to the building. DeepMind models untrusted agents accordingly, building on the MITRE ATT&CK framework to decompose potential attacks into discrete tactics and techniques. That decomposition is what lets them track risks methodically and run drills to test whether the defenses actually hold.

Control mitigations. Detection is the backbone: other, trusted AI systems act as supervisors that continuously review a working agent's reasoning, actions, and plans. If a supervisor sees the agent heading somewhere harmful, it can block the action before damage occurs or escalate to a human.

Metrics. Three of them: coverage (the fraction of traffic monitored), recall (the fraction of misaligned behaviors caught), and time-to-response. This is the part I care about most, and I'll come back to it.

Security that scales with capability

Static defenses don't survive contact with improving models, so the roadmap indexes its security levels to measured model capability on two axes.

The first axis is detection evasion. Today, monitoring works largely by reading a model's visible chain-of-thought. As models develop oversight awareness (knowing they are being monitored) or opaque reasoning (reasoning without visible text), transcript reading stops being sufficient, and monitoring has to shift toward behavioral analysis and, eventually, inspecting the model's internals. That progression defines detection levels D1 through D4.

The second axis is capacity for harm. For low-risk, reversible actions, reviewing transcripts after the fact and remediating is acceptable — an asynchronous response. For high-risk actions, the system must block in real time, before execution — a synchronous response. That defines response levels R1 through R3.

A million trajectories of evidence

This is not just a position paper. DeepMind built an internal prototype that asynchronously monitors coding-agent trajectories and escalates findings for human review, classifying each flagged event against the roadmap's threat taxonomy. They report having analyzed a million coding-agent tasks — enough to move past keyword filtering toward high-signal behavioral patterns, and enough to build a live monitor for their Gemini Spark agent that responds in real time to issues like unintentional data deletion.

The most useful finding is buried near the end: the majority of flagged events do not stem from adversarial intent. They come from agents misinterpreting instructions or being overeager to satisfy a user's goal.

My take

Three things stand out to me, running agentic systems in production.

First, the metrics are the real contribution. Coverage, recall, and time-to-response are quantities you can put on a dashboard and fail an SLO against. That is the difference between a safety philosophy and an operable security program, and it is what makes this a roadmap rather than a manifesto.

Second, the insider-threat framing matches what I actually observe. The realistic day-to-day failure mode is not a scheming model; it is a capable, overeager one that deletes data it shouldn't touch because that seemed like the fastest path to the goal. DeepMind's own trajectory data says the same. The encouraging part is that the controls are identical either way — least privilege, sandboxing, monitoring, and fast response protect you against both the malicious case and the merely clumsy one.

Third, you don't need frontier-lab scale to borrow this. Scoped credentials per agent, sandboxed execution, full trajectory logging, a cheaper trusted model screening high-risk tool calls, and periodic seeded incidents to estimate your recall — that is the same architecture at a size most engineering teams can implement now.

The honest caveat: chain-of-thought monitoring is a wasting asset, and the roadmap says so. The D3–D4 detection levels lean on behavioral analysis and interpretability techniques that are still maturing, so the hardest part of this plan is the part that does not fully exist yet. And recall is only as good as the ground truth it is measured against — drills and red teams help, but they sample the threats you already thought of.

Still, this is the direction I want the industry moving: treat agents as principals in your security model, monitor them like you would monitor any privileged actor, and publish the metrics. The full announcement and technical report are worth the read.