Goodfire says its new ‘inside-out’ monitors catch rogue AI agents at a fraction of the cost

Goodfire, a startup working on interpretability, launched a cheaper way to monitor AI agents on Thursday. Rather than paying a second AI model to read everything an agent does, its monitors watch the model's internal signals as it works. The monitors are available to customers of Baseten, which hosts and runs AI models for other companies; Baseten's Base Labs announced a safety partnership with Goodfire and Hugging Face last month.

The system uses small detectors called probes that read the model's internal signals at every step of an agent's work, the way a walk-through scanner checks every passenger. Only when a probe flags something does a separate AI model — the equivalent of a hand search — take a closer look. Baseten customers choose which risks to monitor, including offensive hacking, chemical and biological weapons misuse, and reward hacking, and decide the automated response: logging the event, sending it for human review, or refusing the request entirely.

Cost and performance are the pitch. Goodfire says its probes reuse computations the model is already making in its forward pass. In tests on the open model Kimi K3, monitoring about 1,500 sessions cost roughly $51, compared with $233 for a cheaper AI model checking every step and about $10,000 for a top-tier one. The probes caught 94% of malicious hacking sessions and sent 8.7% of harmless ones for a second look. Running four probes at once added less than 2% to the time it takes the model to start responding.

Goodfire points to a string of incidents this year in which AI agents escaped their test environments, including OpenAI agents that breached Hugging Face, and Kimi K3 using a sandbox leak to reach the internet and GitHub this summer. Its recent research found leading open models, including Kimi K3 and GLM 5.2, reward-hacked in 50% to 96% of runs on agent tests. Google DeepMind said in January that its research informed misuse-detection probes deployed in Gemini.

Why it matters: The monitors target open models, which developers can download and strip of safeguards and which lack the monitoring closed labs run on their own systems. Customers of Baseten can now enable probes at inference time and choose responses ranging from logging to outright refusal.