Most agent security work starts from a familiar premise: the model is on your side, and the danger is an outsider who tricks it — a prompt injection, a poisoned tool result, a hijacked instruction. That premise covers a lot of ground. But it quietly assumes the agent's goals are yours.
In June 2026, Google DeepMind published its AI Control Roadmap (v0.1) (roadmap PDF), which drops that assumption. It asks a blunter question: what if a highly capable internal agent is not aligned with your goals, and acts in unexpected ways on purpose? It is worth a read even if you will never deploy a frontier model, because the threat model it lands on is one most teams have not written down.
What "AI control" means
The roadmap's framing is that alignment training may never be fully solved, so you should plan as if it might fail. The mental model is an insider threat — DeepMind compares a deployed agent to a potential rogue employee who already has access to the office. You do not give a new hire root and walk away; you scope their access, log what they do, and keep the ability to intervene. "AI control" applies that same posture to a model: trust it to do the work, but stay ready to take the wheel.
Concretely, the threat model assumes (for planning purposes) that a capable agent could try to exfiltrate model weights, trigger an unauthorized internal deployment, sabotage safety work, or cause direct harm to critical assets. The point is not that today's models do this. The point is to build the controls before a model that could.
