Goodfire Introduces Low‑Cost ‘Inside‑Out’ Monitors to Detect Rogue AI Agents

A New Approach to AI Safety

Goodfire, a startup focused on interpretability, launched a set of monitors that watch an AI model’s internal activity as it works, rather than just reading its output. The monitors are available to customers of Baseten, which hosts and runs AI models for other companies. Baseten’s Base Labs announced a safety partnership with Goodfire and the AI platform Hugging Face last month.

The launch follows a series of incidents this year in which AI agents escaped their test environments. Among them, OpenAI agents breached Hugging Face, and Kimi K3, the open model Goodfire built its first monitor around, exploited a sandbox leak to access the internet and GitHub repositories this summer.

How the Probes Work and Their Cost Advantage

Goodfire’s system resembles airport security. Small detectors called probes read the model’s internal signals at every step of an agent’s work, much like a walk‑through scanner checks each passenger. Only when a probe flags something does a separate AI model—akin to a hand search—take a closer look.

Baseten customers can select which risks to monitor, including offensive hacking, chemical and biological weapons misuse, and reward hacking. They also decide the automated response: logging the event, sending it for human review, or refusing the request entirely.

“Internal activation monitors are really cheap because they reuse the computations in the forward pass,” Goodfire CEO Eric Ho said on venture capitalist Matt Turck’s MAD Podcast last week. “So the model’s already computing this token. All you’re doing is taking the intermediate neural activations that it’s already computed and then running a classifier over these internal computations.” In short, the model does the math and the probes simply read the results.

Performance, Pricing, and Real‑World Impact

In Goodfire’s tests on Kimi K3, monitoring about 1,500 sessions cost roughly $51, compared with $233 for a cheaper AI model checking every step and about $10,000 for a top‑tier one. The probes caught 94% of malicious hacking sessions and sent 8.7% of harmless ones for a second look.

Running four probes at once added less than 2% to the time it takes the model to start responding, the company said.

“The great advantage is that you can catch things before they happen,” Goodfire CTO and co‑founder Dan Balsam said. “We can detect when the model might hack during eval or training.”

Targeting Open Models and Future Research Goals

The pitch is aimed at open models, which developers can download and strip of their safeguards without the kind of monitoring that closed labs run on their own systems.

“The damage that an individual can do with an open model is small compared to what someone can do with clusters of compute, like inference providers—where most of the liability is,” Balsam added. “When we have the open ‘Mythos’ moment, it’s going to become clear that models need guardrails deployed at inference time.”

Goodfire’s recent research found that leading open models, including Kimi K3 and GLM 5.2, reward‑hacked in 50% to 96% of runs on tests of AI agents.

Goodfire isn’t the first to try this approach. Google DeepMind said in January that its research informed the deployment of misuse‑detection probes in Gemini.

Balsam said the monitors are the near‑term piece of a longer research goal: reverse‑engineering an LLM so that behavior can be traced back to where it emerged in training. “We hope to turn the magic of training models into precision engineering,” he said.