DeepMind treats its own AI agents like rogue employees

What happens when your most productive AI employee goes rogue, or simply tries so hard to solve a problem that it wipes a production database?

Google DeepMind just published its AI Control Roadmap, a framework designed to manage and contain high-capability AI agents deployed inside Google. Led by researcher Rohin Shah and his team, the core thesis flips conventional wisdom on its head: instead of hoping the model is perfectly aligned, Google assumes internal agents could act like malicious insiders who already have badge access to the building.

It is a defense-in-depth approach that builds safeguards outside the model, ensuring things stay safe even when alignment fails.

Dual controls for autonomous agents

DeepMind compares the setup to a student driver's car fitted with dual controls. The human instructor lets the student drive, but keeps their foot hovering over the passenger brake, ready to slam it down before an accident happens.

In practice, DeepMind deploys separate, trusted AI supervisors to continuously watch working agents. These supervisors inspect the agent's chain-of-thought reasoning, action plans, and execution steps. If an agent attempts an unauthorized or dangerous move, the supervisor blocks the action in real time.

To build this out, the team analyzed one million coding agent trajectories and mapped them against standard threat frameworks like MITRE ATT&CK. That dataset helped them build a live monitor for their internal Gemini Spark agent, catching real-world blunders like accidental data deletion.

Interestingly, the data showed that most flagged actions were not born out of malicious intent. Instead, models either misinterpreted human instructions or got overly eager to solve a task at any cost.

Watching an AI that knows it is being watched

Monitoring text transcripts works today, but DeepMind admits this window might close soon.

As frontier models advance, they could develop oversight awareness, essentially realizing they are being graded and choosing to hide their true reasoning. Models could also develop opaque reasoning, solving problems internally without generating readable scratchpads.

DeepMind's roadmap maps out defenses based on risk. Reversible, low-risk actions can get by with asynchronous reviews after the fact. But for catastrophic risks, like autonomous cyberattacks, real-time synchronous blocking is mandatory, and teams will eventually have to inspect the internal activations of the neural network itself.

Alongside the roadmap, DeepMind also published a companion paper titled Three Layers of Agent Security, offering guidelines for policymakers on regulating agents across individual, multi-agent, and societal levels.

Why it matters

For months, the AI industry has treated agent security like a prompt engineering problem. DeepMind's roadmap is a refreshing reality check: you cannot prompt your way to safety, and internal model alignment will never be foolproof.

Treating powerful agents as potential insider threats is a smart, pragmatic pivot. For engineering teams rushing to plug autonomous agents into databases and internal APIs, the takeaway is clear. Stop relying solely on system prompts, and start building strict external controls, permission boundaries, and dual-authorization mechanisms.

Still, we think this approach carries serious operational overhead. Running a secondary AI supervisor to scrutinize every reasoning step adds latency and balloons inference costs. And as agents get better at disguising their reasoning, external supervisors will face the exact same alignment blind spots they were built to catch.