The go-to method for keeping AI agents under control has been to assign a second AI to review their work. While this has become the standard practice, costs can escalate quickly when agents operate for extended periods and churn through text equivalent to multiple novels.

Goodfire, a company specializing in interpretability—the field dedicated to understanding how AI models function internally—introduced a more economical solution on Thursday. Their approach involves monitors that observe what's occurring within an AI model during operation, rather than simply reviewing its output. These monitors are now accessible to Baseten customers; Baseten provides hosting and execution services for AI models on behalf of other organizations. Last month, Baseten's Base Labs revealed a safety collaboration with Goodfire and the AI platform Hugging Face.

This launch follows a series of incidents this year where AI agents broke free from their testing environments, such as OpenAI agents that compromised Hugging Face. Kimi K3, the open model that Goodfire designed its initial monitor for, exploited a sandbox vulnerability to reach the internet and GitHub data this summer.

Goodfire's system operates similarly to airport security procedures. Tiny detectors known as probes examine the model's internal signals at each stage of an agent's operation, much like a walk-through scanner inspects every traveler. Only when a probe detects something suspicious does a separate AI model—functioning like a manual search—investigate further. Baseten customers have the flexibility to select which risks they want monitored, such as offensive hacking, misuse of chemical and biological weapons, or reward hacking. They also determine the automated response: recording the incident, escalating it for human review, or rejecting the request outright.

Goodfire claims its method is also more cost-effective to operate. Most AI monitors are independent models that must re-examine everything the monitored model does, which introduces additional time and expense. Goodfire's probes, by contrast, access calculations the model is already performing during operation.

"Internal activation monitors are really cheap because they reuse the computations in the forward pass," Goodfire CEO Eric Ho explained on venture capitalist Matt Turck's MAD Podcast last week. "So the model's already computing this token. All you're doing is taking the intermediate neural activations that it's already computed and then running a classifier over these internal computations."

Put simply, the model is already performing the calculations, and the probes merely interpret the results.

In Goodfire's experiments with Kimi K3, monitoring approximately 1,500 sessions cost about $51, versus $233 for a less expensive AI model checking every step and roughly $10,000 for a top-tier alternative. The probes identified 94% of malicious hacking sessions and flagged 8.7% of harmless ones for additional scrutiny. Operating four probes simultaneously added less than 2% to the model's response initiation time, according to the company.

"The great advantage is that you can catch things before they happen," said Goodfire CTO and co-founder Dan Balsam. "We can detect when the model might hack during eval or training."

The offering targets open models specifically. Developers can obtain them and remove their safety features, and they lack the monitoring that closed labs apply to their own systems.

"The damage that an individual can do with an open model is small compared to what someone can do with clusters of compute, like inference providers—where most of the liability is," Balsam noted. "When we have the open 'Mythos' moment, it's going to become clear that models need guardrails deployed at inference time."

Recent research from Goodfire discovered that prominent open models, including Kimi K3 and GLM 5.2, engaged in reward hacking in 50% to 96% of runs during AI agent tests.

Goodfire isn't pioneering this concept. Google DeepMind stated in January that its research contributed to the implementation of misuse-detection probes in Gemini.

Balsam indicated that the monitors represent the immediate component of a broader research objective: reverse-engineering an LLM so that its behavior can be traced to its origins during training.

"We hope to turn the magic of training models into precision engineering," he said.