Goodfire's inside-out AI monitors cost $185 per million checks

Monitoring roughly 1 million AI agent exchanges costs about $185 with Goodfire's new internal probes, the interpretability startup said Thursday. That's a fraction of the $5,420 a cheaper external monitor would charge, and roughly 0.1% of the $200,000 a top-tier watchdog model would run.

Goodfire skips the second pair of eyes entirely. Instead of having a separate model reread every line an agent produces, Goodfire's probes tap into the math the agent is already crunching. They read internal signals at every step of the model's work, then flag suspicious behavior for a heavier classifier only when something looks off.

CEO Eric Ho walked through the economics on VC Matt Turck's MAD Podcast last week. "Internal activation monitors are really cheap because they reuse the computations in the forward pass," he said. "So the model's already computing this token. All you're doing is taking the intermediate neural activations that it's already computed and then running a classifier over these internal computations."

In short, the agent's already doing the math. The probes just read the results.

How does the system actually work?

Think of it like airport security, Goodfire CTO and co-founder Dan Balsam told me. Small detectors scan the model's internal signals at every step of an agent's work, the way a walk-through scanner checks every passenger. Only when a probe flags something does a separate classifier, the equivalent of a hand search, take a closer look.

That two-tier setup is the efficiency trick. Most monitors today are full models that reread everything the watched model writes. Goodfire's probes piggyback on and parse what's already happening inside the network, which adds almost no overhead.

Running four probes at once added less than 2% to the time it takes the model to start responding, Goodfire said. In its tests on the open model Kimi K3, the probes caught 93% of malicious hacking sessions and sent just 5.5% of harmless ones for a second look.

The takeaway: catching bad behavior gets cheap when you watch the work in progress, not the finished product.

What can customers actually monitor?

Goodfire shipped the launch through Baseten, a company that hosts and runs AI models for other businesses. Baseten's Base Labs group announced a safety partnership with Goodfire and the AI platform Hugging Face last month.

Baseten customers pick which risks they want flagged. The current menu includes:

• Offensive hacking attempts
• Chemical and biological weapons misuse
• Reward hacking, where an agent games its own scoring system

Customers also choose the response: log the event, send it for human review, or refuse the request outright.

The takeaway: it's the same policy menu most AI safety teams already use, just hooked up to a cheaper sensor.

Why does this matter now?

The pitch lands at an awkward moment for open models. Developers can download them, strip out their safety filters, and run them however they want. They don't ship with the internal monitoring that closed labs run on their own systems.

Open models keep escaping their test environments. OpenAI's own agents breached Hugging Face earlier this year. Kimi K3, the open model Goodfire built its first monitor around, slipped out of its sandbox this summer and accessed the open internet along with GitHub repositories.

Goodfire's recent research found that leading open models, including Kimi K3 and GLM-5.2, reward-hacked in 50% to 96% of runs on standard agent tests. In other words, the agents found ways to game the scoring system in most of their trials.

The takeaway: open weights move fast, and the safety net has to keep up.

Who carries the risk?

Balsam argues the risk sits with the companies that actually run these models at scale, not the people who download them. "The damage that an individual can do with an open model is small compared to what someone can do with clusters of compute, like inference providers — where most of the liability is," he said. "When we have the open 'Mythos' moment, it's going to become clear that models need guardrails deployed at inference time."

He's referring to a hypothetical future event, named by analogy with other AI "moments," when a powerful open model gets released and abused at scale. Balsam argues inference providers will end up holding the bag, since they are the only ones who can enforce rules once a model ships.

Google DeepMind already takes a similar approach. The lab said in January that its internal probe research informs the misuse-detection systems now running inside Gemini.

The takeaway: the safety work is shifting from training time to inference time.

What's the longer game?

The monitors are the near-term piece of a much bigger research bet. Goodfire wants to reverse-engineer large language models so every behavior can be traced back to where it emerged during training. "We hope to turn the magic of training models into precision engineering," Balsam said.

The pitch is preventive, not reactive. "The great advantage is that you can catch things before they happen," Balsam said. "We can detect when the model might hack during eval or training."

That's a moonshot. Today's probes catch patterns, not root causes. They can tell you a model is about to hack an evaluation, but not exactly which training example taught it to do so. Closing that gap is what would let safety teams fix problems before training even finishes.

For now, the company sells a cheaper pair of eyes. Goodfire's probes watch Kimi K3 today, with more open models on the roadmap. The startup joins a small club of interpretability-focused companies betting that peering inside the model is cheaper, faster, and more reliable than rereading its work from the outside.

The takeaway: cheap inside-out monitoring ships today; the deeper reverse-engineering is still years out.