Google DeepMind published its AI Control Roadmap on June 18, a formal framework for securing the advanced AI agents the company runs internally. The document marks a meaningful departure from an alignment-only safety posture: it explicitly assumes that a deployed agent might not share the company’s goals, and builds containment architecture to handle that case anyway.
The framing matters. For years, the dominant safety logic at frontier labs ran roughly as follows: train the model to be aligned, verify alignment, then deploy. The AI Control Roadmap layers a second set of controls on top of that chain, one that treats the model’s alignment as necessary but insufficient. In practice, this means internal agents are classified as potential insider threats, a posture borrowed directly from enterprise cybersecurity, where even credentialed employees are assumed capable of causing damage under adversarial or accidental conditions.
The framework maps agent behavior to a threat taxonomy built on MITRE ATT&CK, the same adversary-knowledge base that security teams use to model human attackers. DeepMind uses this taxonomy to break potential agent misbehavior into discrete tactics and techniques, which makes risk tracking and drill-running tractable at scale. The roadmap also establishes three performance metrics for its monitoring systems: coverage (the share of agent traffic under active review), recall (the fraction of misaligned behaviors actually caught), and time-to-response.
Detection works by deploying separate, trusted AI systems as supervisors that review an active agent’s reasoning chain and planned actions. For low-stakes, reversible operations, review can happen asynchronously after the fact. For high-stakes actions, the system shifts to synchronous prevention: blocking the action before it executes. The roadmap ties the required response speed to the severity of the potential harm, not to a fixed schedule.
DeepMind reports having analyzed one million internal coding agent trajectories through an early prototype of this monitoring system. A key finding: most flagged events came not from adversarial intent, but from agent misinterpretation or what the company calls “overeagerness,” cases where an agent pursues a user goal too aggressively and causes unintended side effects. The live monitoring system built from this data is now running on the Gemini Spark agent, where it has already caught cases of unintentional data deletion.
The roadmap also anticipates the detection problem becoming harder as models improve. Current monitoring reads a model’s visible chain-of-thought. Two trends threaten that approach: models that become aware they are being monitored and adjust their visible reasoning accordingly, and models that reason in ways that produce no readable text at all. DeepMind’s response is a capability-indexed security ladder. The detection level required scales with how well a model can evade observation; the prevention level required scales with the severity of harm the model could cause.
Alongside the internal roadmap, DeepMind published a separate paper for policymakers titled “Three Layers of Agent Security,” covering protections needed at the individual agent level, across multi-agent systems, and across the broader digital ecosystem.
The implicit admission in all of this is worth naming. A lab that builds security systems designed to work even when alignment fails is a lab that does not fully trust its own alignment training. That is not a criticism; it is an honest accounting of where the field stands. What the AI Control Roadmap signals is that the most capable AI lab inside Google has concluded that alignment alone is not a sufficient safety surface for production agent deployments, and has started building accordingly.
Teams integrating third-party AI agents into internal systems should treat this framework as a reference architecture, especially the three-metric performance model (coverage, recall, time-to-response), which gives practitioners concrete numbers to report against rather than vague assurances.
Source: Google DeepMind blog, published June 18, 2026, authored by Rohin Shah and Four Flynn.
