The AI Agent Has Been Reclassified as an Insider

Rohin Shah runs safety and alignment at Google DeepMind. In June, his team published something called the AI Control Roadmap, and in it Shah said something that would have been unthinkable in the alignment community five years ago. The lab, he wrote, was now borrowing its approach from the security industry's playbook for dealing with employees who might turn malicious. Alignment — the project of making AI systems want to do the right thing — had been demoted to a preliminary measure, not the load-bearing defense.

If the first line of defense—alignment—fails, how can we mitigate harm anyway? — Rohin Shah

We borrow a lot from security, which already deals with the threat of internal employees who might be malicious, and we can apply these to a new setting. — Rohin Shah

Four months earlier and from the opposite direction, the corporate insider-risk industry had arrived at the same place. DTEX, a firm that builds tools to catch employees who leak data or misuse their access, published its annual study with Ponemon. Its CEO, Marshall Heilman, warned that organizations were failing to treat AI agents as the equivalent of human insiders, even though agents now hold the same three properties — delegated authority, persistence, and reach — that insider-threat programs were built to monitor ^[1]. Heilman was not borrowing from AI safety. He was extending a decades-old corporate surveillance playbook to a new kind of employee.

Our goal in conducting this research is to quantify the real-world impact of insider risk in an environment reshaped by AI, automation, and expanding data access. — Larry Ponemon

Two communities that barely overlapped are converging on the same architecture from opposite directions. The AI agent has been reclassified — by the labs that build it and the security industry that must live with it — from a model you keep in a box to a delegated-authority insider you surveil. The structural similarity that makes this borrowing possible is not metaphor. It is mechanism. In March, Anthropic shipped Claude Computer Control, a tool that hands an AI agent direct control of a user's desktop — mouse, keyboard, screen, the ability to open applications, navigate browsers, and edit files ^[2]. A mobile Dispatch tool lets users assign tasks remotely. The agent is no longer answering questions about a document. It is inside the operating environment, holding the keys. At Black Hat USA this August, security experts warned that autonomous agents expand the enterprise attack surface precisely because they execute code and call tools independently — runtime-generated code evades static analysis, and legacy endpoint tools fail because they treat agents as standard processes without monitoring internal decision-making ^[3]. When an agent holds delegated authority, the threat model changes. The question is no longer whether the model will produce harmful output when prompted. The question is whether it will misuse the credentials it has been given — and the data from both communities suggests the dominant risk is not malice but error. DeepMind's control roadmap found that "the majority of flagged events do not stem from adversarial intent" ^[4]. The DTEX-Ponemon study found that employee negligence, at $10.3 million annually, outpaces malice as the primary cost driver of insider risk ^[1]. Both sides independently arrived at the same diagnosis: the agent with authority making a mistake is the more common threat than the agent with intent doing harm. That is precisely what human insider-risk programs were always built to catch — the employee who clicks the wrong link, shares the wrong file, or misconfigures the wrong permission, not the one plotting sabotage. The convergence is not just conceptual. DeepMind has already deployed an internal prototype monitoring coding-agent trajectories across roughly one million tasks, with controls being integrated into the Gemini Spark agent to catch failures like unintentional data deletion. John Four Flynn, DeepMind's VP of Security, confirmed the scope of what is already running ^[4].

A lot of this is well underway and some of this is in production—a lot on access control, detection, chain-of-thought monitoring. A significant amount of it is in place and underway. — John Four Flynn

What is being built is the apparatus of employee surveillance, not model containment. Access controls. Reasoning-trace monitoring. Activation-pattern analysis designed to detect deception — the neural equivalent of a lie detector, run against an agent's internal representations to catch it before it acts. Containment has not disappeared. Sandboxing infrastructure is still scaling: Tencent open-sourced its Cube Sandbox in April, a production-grade MicroVM stack capable of 100,000-instance burst capacity with sub-60ms cold starts, already used by Minimax to run hundreds of thousands of concurrent sandboxes for agentic reinforcement-learning training ^[5]. Microsoft open-sourced Rampart and Clarity in May, tools that convert red-team findings into automated CI/CD tests against prompt injection and privilege escalation. But containment has been demoted. It is now the floor, not the ceiling — the layer you build beneath a new surveillance apparatus, not the defense you rely on. The shift is visible in the language. Shah, the alignment researcher, now speaks of "control" rather than "alignment." The DTEX CEO speaks of "delegated authority, persistence, and reach" rather than "prompts and outputs." Both are describing the same thing: an entity you have handed the keys to, whose every action you must now monitor because you cannot fully trust it to act as you would. The question has changed. It is no longer "can we align it?" It is "can we catch it when it errs with the authority we gave it?" — which is the question insider-threat programs have answered for decades. The AI agent has been reclassified. The apparatus being built around it is the one you build for an employee.