DeepMind's AI Control Roadmap: defense-in-depth for misaligned agents

What is this?

On June 18, 2026, Google DeepMind published a blog post, “Securing the future of AI agents”, together with a technical report, the AI Control Roadmap, and a policy-oriented framework, “Three Layers of Agent Security”. The roadmap is a defense-in-depth framework for operating capable AI agents inside Google under a deliberately pessimistic assumption: that a highly capable agent may not be aligned with its operators’ goals and may act in unexpected ways. Rather than trusting alignment alone, it adds a system-level control layer designed to hold even when alignment is imperfect.

The framing matters because “AI control” is treated here as a discipline distinct from “AI alignment.” Alignment tries to make the model inherently safe; control assumes that effort can fail and asks what infrastructure still contains the damage.

How it works

The roadmap rests on three pillars.

First, a threat-modelling framework built on top of MITRE ATT&CK. Untrusted agents are treated as potential insider threats — the analogy DeepMind uses is a rogue employee who already has access to the office. Decomposing potential misbehaviour into tactics and techniques lets defenders track risks, spot bad behaviour early, and run drills to test whether defenses actually hold.

Second, control mitigations split into detection and response. For detection, other trusted AI systems act as “supervisors” that continuously review a working agent’s reasoning, actions and plans for signs it is going off track. For prevention and response, a supervisor that sees a harmful action can step in and block it before damage occurs.

Third, measurement. The system is tracked on three metrics: coverage (the fraction of traffic monitored), recall (the fraction of misaligned behaviours caught), and time-to-response.

Crucially, controls scale with model capability along two axes. Detection levels (D1–D4) track a model’s ability to evade oversight: today, monitoring relies on the visible chain-of-thought, but as models gain oversight awareness (knowing they are watched) or opaque reasoning (reasoning without legible text), defenders must shift to behavioural analysis and inspecting the model’s internals. Response levels (R1–R3) track attack-execution ability: low-risk, reversible actions can be handled asynchronously (review transcripts with a delay, remediate afterwards), while high-risk, irreversible actions demand synchronous, real-time blocking.

Why it matters

This is one of the more concrete public statements of how a frontier lab secures its own internal agents. DeepMind reports a working prototype: an asynchronous monitoring system over coding-agent trajectories that escalates findings for human review, with each flagged event classified against the roadmap’s threat taxonomy. The team says it has analyzed a million coding-agent tasks, which let it move beyond keyword filtering to higher-signal behavioural patterns, and that this fed a live monitor for the Gemini Spark agent — for example, responding in real time to unintentional data deletion.

The most useful finding for practitioners is a nuance: the majority of flagged events did not stem from adversarial intent. They came from agent misinterpretation or over-eagerness to achieve a user’s goal. In other words, the same control plane that defends against a hypothetically misaligned agent also catches the far more common failure mode today — a well-meaning agent doing something destructive by mistake. That dual payoff is a strong argument for adopting control infrastructure now rather than waiting for a malicious-agent threat to materialise.

Defenses

For teams running their own agents, the roadmap translates into practical posture.

Adopt the insider-threat lens: scope an agent’s permissions to its verified behaviour and grant access incrementally, the way the post’s “driving instructor with dual controls” analogy suggests — trust, but keep a hand on the brake. Keep the traditional foundations in place; the control layer sits on top of sandboxing, endpoint security and prompt-injection resistance, it does not replace them. Use separate, trusted monitor models rather than asking an agent to police itself. Match response latency to blast radius — asynchronous review is fine for reversible actions, but irreversible or high-impact actions need synchronous blocking. Measure coverage, recall and time-to-response instead of treating “we have monitoring” as a binary. And do not over-rely on chain-of-thought monitoring as a permanent control: plan for the day when models reason opaquely, and invest early in behavioural and interpretability-based detection.

DeepMind frames ecosystem defense as a shared responsibility across individual agents, multi-agent systems, and cyber defenders — the three layers of its companion policy paper.

Status

Item	Detail
Publication	”Securing the future of AI agents”, Google DeepMind
Date	June 18, 2026
Core artifact	AI Control Roadmap (technical report)
Companion	”Three Layers of Agent Security” (policy framework)
Approach	Defense-in-depth; control layer assuming possible misalignment
Basis	MITRE ATT&CK-style threat modelling; trusted supervisor monitors
Reported evidence	~1M coding-agent trajectories analyzed; live monitor for Gemini Spark