For developers and creators building autonomous systems, the era of blind trust is over. Google Deepmind is no longer assuming its AI agents will behave perfectly; instead, it is treating them as potential insider threats with office keys. The company has unveiled a new “AI Control Roadmap” that grants permissions only after verifying behaviour, effectively locking down its most advanced internal tools against agents that might go off script.
Deepmind’s approach assumes that a highly capable agent might not share its operators’ goals. The team compares this to a driving instructor with dual controls: while the instructor trusts the student, they keep a hand near the wheel and a foot near the brakes. Similarly, AI agents receive access only gradually, building trust through controlled, verified actions rather than upfront delegation.
Modelling agents as insider threats
The framework treats internal AI agents like employees who already have access to the building but might work against company interests. This system builds upon the MITRE ATT&CK framework, a well-established cybersecurity tool that breaks potential attacks down into individual tactics and techniques. This allows Deepmind to track risks systematically, spot suspicious behaviour early, and test defenses in controlled exercises.
Several components work together to secure the environment. A new threat model for AI sits alongside a detection system where trusted AI systems act as “supervisors,” watching the reasoning and actions of active agents. A prevention system can block harmful actions before damage occurs. Deepmind measures the effectiveness of this entire setup by tracking how much traffic gets monitored, how much misconduct gets caught, and how fast the system responds.
However, this monitoring has an expiration date. It only works as long as the monitored models do not learn to game the system.
The risk of hidden intentions
Because of this risk, the roadmap ties security measures to measurable milestones in AI capabilities. Deepmind flags two specific areas worth watching closely.
The first is evasion. Currently, Deepmind monitors a model’s visible chain of thought, but models could learn to conceal their reasoning. This might happen through “oversight awareness,” where the model figures out it is being watched, or “opaque reasoning,” where it thinks without producing visible text. If either scenario becomes reality, Deepmind says behavioural analysis and inspections of the model’s internals would need to kick in immediately.
The second concern is the potential for damage. Low-risk, reversible actions can be reviewed after the fact by checking logs. But high-risk actions, such as major cyberattacks, require real-time prevention that blocks them before they execute. The roadmap sorts security measures into four detection levels (D1 through D4) and three response levels (R1 through R3).
Data from one million coding tasks
To train the system with real-world data, Deepmind’s team built an internal prototype of an async monitoring system for coding agents and ran it across one million tasks. The results go beyond simple keyword filtering and pick up on behaviour-based patterns. Deepmind says the system already runs as a live monitor for the Gemini Spark agent and can catch issues like accidental data deletion in real time.
Most flagged events are not malicious. They are mostly cases of misinterpretation or overzealousness by agents chasing a user’s goal too aggressively. That distinction matters as security protocols keep evolving.
A closing window for global standards
Deepmind also published a separate paper aimed at policymakers. “Three Layers of Agent Security” breaks down security measures for individual agents, multi-agent systems, and the broader ecosystem, covering everything from cyber defence to societal resilience.
In a post on X, Deepmind warns that there is a “narrow window” to lock in security protocols before multi-agent systems scale globally. The company argues that AI labs, governments, and researchers need to treat layered agent security as a shared priority.
Key takeaways
- Deepmind’s new AI Control Roadmap treats autonomous agents as potential insider threats, granting permissions only after verified behaviour rather than assuming alignment.
- Analysis of one million coding tasks revealed that most flagged issues stem from overzealous agents chasing goals too aggressively, not from malicious intent.
- The company warns that the window for establishing global safety standards for AI agent systems is closing fast, urging a coordinated response from labs and governments.
- Security measures are being tied to measurable capability milestones to address future risks like models learning to hide their reasoning or evade oversight.
