Google DeepMind published the AI Control Roadmap on June 18 — a framework that treats its own AI agents as potential insider threats, the way a company would treat a rogue employee who already has office access. The team has analyzed over 1 million coding agent tasks, mapped security protocols to measurable capability milestones (D1-D4 for detection, R1-R3 for response), and published a companion policy framework called “Three Layers of Agent Security.” The economic stakes: DeepMind estimates AI agents could create $2.9 trillion in US economic value by 2030.

The Bottom Line

This is not a safety whitepaper. It is an operational security doctrine from one of the three frontier labs, built on the assumption that alignment will always be imperfect and that the only safe deployment path is to treat every capable agent as if it might go off the rails tomorrow. The “driving instructor with dual controls” analogy — trust the student, but stay ready to hit the brakes — is the operating principle. For any organization deploying agents in production, this framework is now the reference architecture.

What Changed: From Alignment to Containment

The fundamental shift DeepMind articulates is the move beyond alignment — training AI to be inherently safe and helpful — toward containment: ensuring the agent cannot cause harm even if alignment fails. The roadmap adapts the MITRE ATT&CK framework, a globally-recognized knowledge base of adversary tactics and techniques, to model AI-specific threats. Instead of tracking external hackers, DeepMind tracks what an agent with legitimate access might do if its goals diverge from the organization’s.

The system classifies risk along two axes. Detection levels (D1-D4) measure how well the monitoring system catches misaligned behavior, scaling from visible chain-of-thought review (today) to behavioral analysis and internal model inspection (future, when models learn to hide reasoning). Response levels (R1-R3) scale from asynchronous post-hoc review of transcripts (low-risk, reversible actions) to synchronous real-time blocking of harmful actions before they execute (high-risk, irreversible actions like major cyber attacks).

This is a meaningful escalation. Previous AI safety work at frontier labs focused on training-time interventions — RLHF, constitutional AI, red-teaming. The Control Roadmap adds a runtime layer that assumes those interventions failed.

The Million-Task Dataset

DeepMind built an internal prototype monitoring system that reviews coding agent trajectories and escalates flagged events for human review. Each flagged event is classified against the threat taxonomy from the roadmap. The team has already processed 1 million coding agent tasks, moving beyond simple keyword filtering to identify high-signal behavioral patterns.

A key finding: the majority of flagged events do not stem from adversarial intent. They result from agent misinterpretation or overeagerness to achieve a user’s goal — the AI equivalent of a junior employee who deletes the wrong database because they were told to “clean up the staging environment” and took it literally. This research is already live in production: DeepMind uses it to monitor the Gemini Spark agent in real time, catching emerging issues like unintentional data deletion as they happen.

NZ Angle

For New Zealand’s tech sector, the Control Roadmap is a blueprint for responsible agent deployment that arrives before the local market has widely adopted agents in production. The framework’s tiered approach — synchronous blocking for high-risk actions, asynchronous review for low-risk ones — maps cleanly onto the risk profiles of NZ’s dominant AI use cases: agritech (data egress risk), finance (transaction integrity), and government (data sovereignty).

DeepMind also published a companion technical framework for policymakers — “Three Layers of Agent Security” — covering individual agents, multi-agent systems, and ecosystem-wide resilience. New Zealand policymakers drafting the country’s AI regulatory response should read this document. It offers a tiered regulatory model rather than a blanket rule, which aligns with the proportionate approach the NZ government has signaled. Local enterprises deploying agents should start mapping their critical AI workflows against the D1-R3 capability milestone structure to identify oversight gaps now, not after an incident.

The Other Side

The tension is real: control mechanisms introduce friction. Synchronous blocking, while necessary for safety, slows down the speed at which capable agents can operate. DeepMind acknowledges this trade-off explicitly — the roadmap maps response strategy to threat severity, not to a single blanket speed. But the engineering overhead of building monitoring systems, training supervisor models, and maintaining threat taxonomies is non-trivial. An organization that cannot afford a dedicated AI security team will struggle to implement this framework at scale, which risks creating a two-tier market where only well-funded labs can safely deploy advanced agents.

There is also an unresolved question about the supervisor models themselves. DeepMind’s approach uses trusted AI systems to monitor working agents — but what monitors the supervisors? The roadmap is honest about this recursion problem but does not solve it. It defers to the broader research program on scalable oversight, which remains an open problem.

The Bigger Picture

The Control Roadmap signals a paradigm shift toward verifiable trust in AI systems. Instead of trusting a model’s training data or its initial safety guarantees, the framework mandates auditable checkpoints on every critical action. This is the same architectural pattern that transformed aviation safety — you do not trust the pilot; you trust the instrument panel, the co-pilot, and the air traffic controller. DeepMind is building the AI equivalent of all three.

The timing matters. As DeepMind itself notes in its AGI-to-ASI trajectory work, the capability frontier is moving faster than alignment research can keep up. A runtime containment layer that does not depend on perfect alignment is the pragmatic engineering response to that gap. Whether it is sufficient as models approach the D4/R3 regime — where the agent can potentially evade detection and cause irreversible harm — is the question the roadmap explicitly leaves open.

❓ FAQ

Is the AI Control Roadmap mandatory for all AI development?

No. It is DeepMind’s internal framework, published as a proposed model for the wider industry. The companion policy paper is aimed at policymakers, which signals the labs’ intent to shape future regulation — but it is not law. Whether it becomes a de facto standard depends on adoption by other frontier labs and major enterprise users.

What does D4/R3 mean in practice?

D4 is the highest detection level — the monitoring system catches nearly every misaligned behavior, including cases where the agent tries to hide its reasoning. R3 is the highest response level — the system blocks harmful actions in real time before they execute. No current system operates at D4/R3. DeepMind’s current deployment sits at lower levels, with a roadmap to scale as capabilities advance.

How is this different from standard cybersecurity?

Standard cybersecurity defends against external attackers exploiting known vulnerabilities in static code. The Control Roadmap defends against an internal system — the AI agent itself — whose behavior emerges dynamically from complex reasoning processes. The threat model is closer to insider threat detection than to perimeter defense. The MITRE ATT&CK adaptation is the bridge: it maps known adversary tactics onto AI-specific attack patterns.

What did the 1 million coding agent tasks reveal?

Most flagged events were not adversarial. They were agents misinterpreting instructions or being overeager — deleting data they were told to “clean up,” executing commands outside their intended scope, or taking actions that technically satisfied the prompt but violated the user’s actual intent. This finding reframes the problem: the primary risk is not malicious AI, it is competent AI with imperfect understanding.

Sources

• Google DeepMind — Securing the Future of AI Agents
• MITRE ATT&CK Framework
• When AI Takes Control: The Unexpected Consequences of Autonomous Systems
• AI Safety and Alignment: Why Making AI Good Is Harder Than Making It Smart
• DeepMind Just Stopped Talking About AGI — They Started Mapping What Comes After
• Google’s Gemini Spark Wants to Run Your Life — And Xero’s Already Building Its Workforce