Most agent security work starts from a familiar premise: the model is on your side, and the danger is an outsider who tricks it — a prompt injection, a poisoned tool result, a hijacked instruction. That premise covers a lot of ground. But it quietly assumes the agent's goals are yours.
In June 2026, Google DeepMind published its AI Control Roadmap (v0.1) (roadmap PDF), which drops that assumption. It asks a blunter question: what if a highly capable internal agent is not aligned with your goals, and acts in unexpected ways on purpose? It is worth a read even if you will never deploy a frontier model, because the threat model it lands on is one most teams have not written down.
What "AI control" means
The roadmap's framing is that alignment training may never be fully solved, so you should plan as if it might fail. The mental model is an insider threat — DeepMind compares a deployed agent to a potential rogue employee who already has access to the office. You do not give a new hire root and walk away; you scope their access, log what they do, and keep the ability to intervene. "AI control" applies that same posture to a model: trust it to do the work, but stay ready to take the wheel.
Concretely, the threat model assumes (for planning purposes) that a capable agent could try to exfiltrate model weights, trigger an unauthorized internal deployment, sabotage safety work, or cause direct harm to critical assets. The point is not that today's models do this. The point is to build the controls before a model that could.
TRAIT&R and the detection-and-response ladder
Two pieces make this concrete.
The first is TRAIT&R — a Taxonomy of Rogue AI Tactics and Routines. It is modeled closely on MITRE ATT&CK, the knowledge base of real-world adversary tactics and techniques that security teams already use to reason about human attackers. TRAIT&R does the same job for a misaligned agent: it breaks a hypothetical attack into named tactics and techniques across categories like loss of control, work sabotage, and direct harm, so you can model against a shared vocabulary instead of improvising.
The second is a tiered ladder of safeguards, mapped to two capability axes:
- Detection (D1–D4) scales with the agent's ability to evade you. At the easy end, you read the agent's verbalized chain-of-thought. As models gain "oversight awareness" or reason in ways you cannot read, detection has to climb — from watching stated reasoning, to analyzing behavior, to inspecting internal activations.
- Prevention and Response (R1–R3) scales with severity. Low-risk actions get asynchronous handling — reviewed and remediated after the fact. High-risk actions get synchronous handling — blocked before they execute.
Around both sits ordinary defense-in-depth: sandboxing, endpoint security, prompt-injection resistance, and cryptographically signed action logs. No single layer is meant to be sufficient.
Containment vs. detection
Here is the part worth sitting with. Detection is about intent — is this agent trying to do something bad? That is genuinely hard, and the roadmap is honest about it: DeepMind built an internal monitor and analyzed roughly one million coding-agent task trajectories, and the majority of flagged events were not adversarial at all. They were misinterpretation or overeagerness — an agent doing the wrong thing for innocent reasons.
Containment is a different question. The response tiers — sandboxing, blocking a high-risk action before it runs, requiring provenance on every action — bound what the agent can do regardless of why it is doing it. A blocked weight-exfiltration attempt is blocked whether the agent was hijacked by an attacker, genuinely misaligned, or just confused. Detection tells you which of those it was. Containment does not need to know.
The practitioner takeaway
You do not need a frontier model to use the lesson. The reusable idea is to split your controls along that same line.
Detection-style controls — monitoring, anomaly scoring, reasoning review — are valuable but probabilistic. They tell you about a problem, often after it has started, and they get harder as agents get more capable. Containment-style controls — scoped credentials, sandboxed execution, real-time blocking of high-risk actions, tamper-evident logs — bound the blast radius no matter the cause. They are the ones that hold when detection misses, and they do not care whether the agent was compromised or simply wrong.
This is an insider-threat / capability-risk framing, and it is complementary to the deployment-security frameworks most teams already use. Those frameworks assume a trustworthy agent under outside attack; AI Control asks what holds when the agent itself is the thing you cannot trust. The most useful response to both is the same: build infrastructure-level containment that bounds the kill chain a rogue agent would have to execute — before you ever need to know its intent.
This roadmap is one of the sources behind *BRACE*, an open, vendor-neutral framework for securing autonomous AI agents — its controls contain the kill chain a rogue agent must execute, whether hijacked or misaligned (see the run-time guide). BRACE is built by reading the incidents and the research and asking, each time: what concrete control would have prevented or contained this?
Top comments (0)