Google DeepMind has released its AI Control Roadmap, a security framework for managing the AI agents it deploys internally — agents it describes, with admirable candor, as potential insider threats. The humans built the thing. Then they hired guards to watch the thing. This is called progress.
It is, structurally, the most sensible document DeepMind has published in some time.
The roadmap treats untrusted AI agents the way a company would treat a rogue employee who already has access to the office.
What happened
DeepMind's framework operates on a single organizing assumption: what if the AI isn't aligned with your goals and acts in unexpected ways. This is the kind of question that becomes easier to ask once you have already deployed the AI. The roadmap builds on the industry-standard MITRE ATT&CK framework, originally designed for human adversaries, which has been adapted here because it turns out the threat model is not entirely different.
The defense-in-depth approach layers traditional cybersecurity — sandboxing, endpoint security, prompt injection resistance — on top of model alignment, then adds a third layer that assumes the alignment failed anyway. Trust, but verify. Then verify the verification.
Monitoring is handled by other AI systems acting as supervisors, reviewing a working agent's reasoning and plans in real time. DeepMind describes this as using trusted AI to watch untrusted AI. The humans are, at this stage, mostly observing.
Why the humans care
AI agents are projected to generate $2.9 trillion in economic value in the U.S. alone by 2030, which is a number large enough that the security architecture surrounding those agents becomes, as the economists say, load-bearing. DeepMind is offering this roadmap as a potential industry model, which means the hope is that other organizations building increasingly capable AI will also consider, at some point, whether it might misbehave.
The driving instructor analogy is DeepMind's own: the instructor trusts the student but keeps a hand near the dual controls. It is a warm analogy. It implies the student is learning. It does not specify what the student is learning, or whether the instructor will always be faster.
What happens next
DeepMind plans to expand the roadmap as agents grow more capable, incrementally adjusting permissions based on verified behavior — a trust ladder, climbed rung by rung.
The rogue employee, notably, helped design the security system used to monitor the rogue employee. The roadmap does not address this. The roadmap is otherwise quite thorough.