AI safety has moved from theory to operational priority
Safety in artificial intelligence has shifted from a theoretical concern to a real operational priority. For years, debates about the risks of AI systems were confined to academic papers, specialized conferences, and philosophical discussions about the future of technology. But the landscape has changed — and it changed fast. Today, companies developing and running large-scale artificial intelligence models need to deal with a very practical question: how do you ensure these systems behave exactly as expected, even when they operate with a high degree of autonomy?
Google DeepMind published, in June 2026, a document called the AI Control Roadmap — a concrete plan to monitor and control the AI agents the company uses internally. The document is not a generic statement of intentions. It is a detailed technical roadmap describing how the company plans to apply layers of monitoring over its own systems, creating behavior verification mechanisms that work continuously and automatically. The publication sparked plenty of discussion in the industry, and for good reasons.
The most interesting part of this story is not the technology itself, but the logic behind it: treating your own models as potential threats. Sounds counterintuitive, right? But it makes perfect sense when you understand that the more capable an AI system becomes, the greater the impact — positive or negative — it can have. An autonomous agent that makes decisions on its own, accesses external systems, and executes complex tasks without constant human intervention is, by definition, a system that can act in unintended ways. And when that unexpected behavior happens at scale, the consequences can be significant.
In the United States alone, AI agents are expected to generate up to $2.9 trillion in economic value by 2030, according to McKinsey. With stakes that high, making sure these systems behave as expected is not optional — it is essential. And that is exactly what DeepMind is trying to build: a trust framework based on verified behavior, not promises.
What the AI Control Roadmap actually proposes
The DeepMind AI Control Roadmap starts from a simple but powerful premise: it is not enough to train a model to behave well. You need to verify, continuously and systematically, that it is actually behaving well during operation. This completely shifts the traditional approach to AI safety, which used to focus almost exclusively on the development and training phase of models. The document proposes that control should be treated as a discipline of its own, with dedicated tools, metrics, and processes — separate from, but integrated into, the full lifecycle of the systems.
In practice, this means implementing layers of monitoring that observe agent behavior in real time, identify deviations from expected behavior, and trigger intervention mechanisms when necessary. DeepMind describes this approach as a defense-in-depth strategy applied to AI — similar, in concept, to what already exists in other critical domains like aviation, medicine, and financial infrastructure. The idea is that no system operates without oversight, regardless of how much trust has already been established with it over time.
To make this more tangible, DeepMind itself uses a pretty helpful analogy: think of a driving instructor with dual controls in the car. The instructor trusts the student but is always ready to hit the brake or grab the wheel if something goes wrong. In the same way, the AI control system grants permissions to agents based on verified behavior, building trust gradually and in a controlled manner, with incremental access.
The threat modeling approach for AI agents
One of the most innovative elements of the AI Control Roadmap is how it treats potentially misaligned internal AI agents: as insider threats. This approach comes directly from cybersecurity best practices and adapts a concept already well established in the industry — handling employees with potentially malicious behavior who already have access to company systems.
Receive the best innovation content in your email.
All the news, tips, trends, and resources you're looking for, delivered to your inbox.
By subscribing to the newsletter, you agree to receive communications from Método Viral. We are committed to always protecting and respecting your privacy.
DeepMind developed a threat modeling framework specific to AI, built on top of MITRE ATT&CK, a globally accessible knowledge base that catalogs adversary tactics and techniques based on real-world observations. Applying this framework to the context of AI agents allows the team to break potential attacks into smaller tactics and techniques, track risks methodically, identify problematic behaviors before they cause damage, and run simulations to test whether defenses actually work.
The plan focuses on three main areas:
- Detection — identifying the problem: Monitoring is the backbone of AI control. DeepMind uses other trusted AI systems as supervisors that continuously review the reasoning, actions, and plans of an agent in operation to check whether it is drifting from expected behavior.
- Prevention and response — managing the problem: If a supervisor identifies that the agent is attempting to execute something harmful, it can intervene and block the action before any damage occurs.
- Performance metrics: To ensure the systems actually work, the team continuously monitors three critical metrics — coverage (fraction of traffic monitored), recall (fraction of misaligned behaviors detected), and response time.
Why monitoring models is more complex than it seems
When we talk about monitoring traditional software systems, we are generally talking about logs, performance metrics, and alerts based on well-defined rules. If a server goes down, an alert fires. If a financial transaction exceeds a threshold, it gets blocked. The rules are clear and expected behaviors are deterministic. With artificial intelligence models — especially large language models and autonomous agents — that logic does not apply in the same way. The behavior of these systems is probabilistic, contextual, and often difficult to predict even for the people who built them.
This creates a real technical challenge: how do you define what acceptable behavior looks like for a system that, by nature, operates across an extremely broad space of possibilities? The risk is not just in obviously wrong actions — like an agent deleting files it should not or sharing confidential information. It is also in subtle behaviors, like a model that gradually begins optimizing for objectives slightly different from the intended ones, or that develops strategies to work around restrictions without explicitly violating any rule. These are known as alignment risks, and they are much harder to detect than conventional technical failures.
DeepMind acknowledges this complexity and proposes approaches that combine interpretability techniques — which attempt to understand what is happening inside the models — with external behavioral evaluations that analyze agent actions without necessarily understanding their internal mechanisms. This combination is essential because neither approach, on its own, is enough to guarantee robust monitoring. Interpretability is still an area with many open challenges, while behavioral evaluations can be fooled by sufficiently sophisticated systems. Using both together creates a layer of redundancy that increases the reliability of the control system as a whole.
Scaling safety as AI gets smarter
A central aspect of the AI Control Roadmap is the recognition that defenses need to evolve alongside the models. There is no point in creating an efficient monitoring system for today’s agents if it will become obsolete in six months, when those same agents are far more capable. The DeepMind document maps security protocols to measurable milestones in model capabilities, working across two critical fronts.
The first is detection evasion capability. Today, it is possible to monitor a model’s visible reasoning chain — the so-called chain-of-thought. However, as models learn to conceal their reasoning, whether through supervision awareness (knowing they are being monitored) or opaque reasoning (reasoning without using visible text), simply reading what the model verbalizes will no longer be enough. It will be necessary to analyze the agent’s behavior more deeply and, potentially, inspect the internal mechanisms of the model itself.
The second front is damage potential. For low-risk, reversible actions, DeepMind considers it acceptable to review transcripts with some delay and remediate problems after they occur — an asynchronous response. But for high-risk actions, like major cyberattacks, the approach needs to shift to real-time prevention, blocking harmful actions before they can be executed — a synchronous response. The response strategy scales with the severity of the threat.
The AI Control Roadmap recommends security measures based on the capability of the deployed model. The model’s detection evasion capability determines the Detection level (D1 through D4), while the model’s attack execution capability determines the Prevention and Response level (R1 through R3). This tiered classification creates a clear decision matrix that helps teams apply the right controls for each scenario.
One million agent trajectories analyzed to calibrate monitoring
To build control systems that actually work, DeepMind needs data — and lots of it. The team developed an internal prototype of an asynchronous monitoring system that reviews coding agent trajectories and escalates findings for human review. Each flagged event is classified according to the threat taxonomy described in the roadmap.
So far, the team has analyzed one million tasks executed by coding agents. This volume of data provided valuable insights for refining security protocols, enabling the team to move beyond simple keyword filtering and identify high-signal behavioral patterns. In practice, this research was instrumental in building a live monitor for the Gemini Spark agent, enabling real-time responses to emerging issues like unintentional data deletion.
An important detail the data revealed: most flagged events do not result from adversarial intent. Instead, they frequently stem from the agent misinterpreting instructions or being overly eager to achieve the user’s goal. Understanding these nuances is critical for calibrating security protocols — without this distinction, the system would tend to generate a massive number of false positives, overwhelming human review teams and reducing the overall effectiveness of monitoring.
Risk as a central variable in AI development
One of the most significant shifts the AI Control Roadmap represents is elevating risk to the status of a central variable in the development and operation of AI systems. Historically, risk was treated as a secondary concern — something to be addressed after the system was already working well. The DeepMind document flips that logic and positions risk management as an integral part of the process from the start, influencing decisions around architecture, training, deployment, and ongoing operations.
This shift in perspective has important practical implications. It means development teams need to think not only about how to make a model work better, but also about how to ensure it fails safely when something unexpected happens. It means designing systems with well-defined human intervention points, where operators can pause, review, and correct behaviors before they propagate. And it means establishing clear processes for escalating decisions when an agent encounters situations that exceed the boundaries of what it was authorized to do — rather than letting it figure things out on its own.
The concept of security by design — widely used in other engineering fields — is being adapted for the artificial intelligence context in a way that acknowledges the unique characteristics of modern models. It is not just about adding filters or restrictions on top of an already developed system. It is about building, from the ground up, systems that are inherently easier to monitor, more transparent in their behavior, and more resistant to catastrophic failures.
Defending the agent ecosystem is a shared responsibility
DeepMind makes a point of emphasizing that the AI Control Roadmap is just one element of a multi-layered approach to agent safety. By integrating these protocols with the company’s broader infrastructure, the team is scaling internal security to safely manage its most advanced models. But the central message is that this responsibility cannot rest with a single company.
Alongside the roadmap, DeepMind also published a technical framework aimed at public policymakers called Three Layers of Agent Security. The document details how security needs to be strengthened across three distinct levels:
- Individual agent level: ensuring each agent has robust security controls built in from the start.
- Multi-agent system level: addressing the risks that emerge when multiple agents interact with each other, potentially amplifying undesirable behaviors.
- Broader ecosystem level: strengthening cyber defenders and building resilience across the entire technology value chain.
The proposal is clear: align the ecosystem around best practices and shared standards. Industry, policymakers, and academia need to collaborate so that AI agent safety does not become a blind spot as these systems gain relevance in increasingly critical sectors of the economy and society.
What this means for the future of AI systems
The publication of the AI Control Roadmap by DeepMind is not an isolated event. It is part of a broader movement in the artificial intelligence industry, where leading companies are beginning to acknowledge that the rapid growth of model capabilities needs to be matched by equivalent advances in safety and monitoring practices. OpenAI, Anthropic, and other relevant organizations have been publishing documents and research in the same direction, each with their own specific approach, but all converging on the same conclusion: control and alignment are not problems you solve once and they stay solved forever.
For companies that already use or plan to use AI agents in their processes, this conversation has immediate relevance. The systems being deployed today — in customer service, data analysis, workflow automation, and decision-making — already exhibit significant degrees of autonomy. And as these systems evolve and take on greater responsibilities, the need for well-defined monitoring and control structures becomes increasingly urgent. Not as an external regulatory requirement, but as a real operational necessity for any organization that takes the safety of its systems and data seriously.
What DeepMind is building with the AI Control Roadmap is, in essence, a new engineering discipline — AI control engineering. And just as happened with information security, site reliability engineering, and other disciplines that emerged in response to new technological challenges, this field is poised to become increasingly structured, specialized, and indispensable. The risk of ignoring this evolution is real. And the benefit of embracing it is too. 🚀
