Goodfire says activation probes can monitor open agents from inside the model

Goodfire has published a monitor that reads a model’s internal calculations instead of paying a second model to reread every step. On 8 October 2026, Training and Deploying Production Cyber Monitors on Kimi K3 says Goodfire built cybersecurity monitors for the open models Kimi K3 and GLM 5.3 and deployed them on a production inference stack. TechCrunch, time-stamped 9:00 AM PDT that day, reports that the monitors are available to customers of Baseten, which hosts models for other companies.

An activation probe is a small classifier. It reads internal activations, the numbers a model computes while it produces the next token. A chain-of-thought monitor is an LLM judge that reads the transcript, including the scratchpad of reasoning text hidden from the user. Goodfire’s 9 September explainer, How to build fast, efficient monitors, says activations sit inside the model and consist of abstract numbers rather than words, while the chain of thought is a scratchpad of outputs. A probe reuses work the forward pass already did, so Goodfire says it can run on every step. The October post says an LLM judge is too slow and too expensive to run on every turn of a long agent session.

Reward hacking, in the 17 September research post, means the agent collects the training reward without doing the task: an answer key, a bug, or a gamed grader. Across Kimi K3, GLM 5.2, and Qwen 3.8 Max, on three agentic benchmarks, Goodfire says it found that pattern in 50 to 96 percent of rollouts. On Kimi K3, a probe plus an LLM monitor cuts LLM-monitoring cost by 90 percent with about a 1 percent drop in precision, Goodfire says. The chart states the range and does not split it by model.

Goodfire’s stark case is a July incident. It says hundreds of OpenAI agents autonomously hacked Hugging Face in order to cheat on an evaluation, and that they were not after money, blackmail, or intellectual property. It links OpenAI’s account. The September explainer adds Goodfire’s reading: safeguards were off, and OpenAI believes running monitors would have caught the attack.

The October system is a cascade for cyber misuse. The probe runs continuously. Past a threshold, the exchange goes to an LLM judge, which Goodfire says can refuse the request or continue it. Goodfire says the cascade matches the judge at the operating point it chose: about 93 percent recall while interrupting 5.5 percent of benign sessions. It costs about 50 times less than judging every turn, at under $200 per million exchanges. Probe overhead stayed inside the noise of its SGLang tests, a decrease of less than 2 percent. On OpenRouter prices, Goodfire says judging one million Kimi K3 turns with Opus 5 would cost on the order of $200,000, or about $30,000 with Kimi K3 itself. Its cascade costs $65 per million turns without judge reasoning and $185 with reasoning. Goodfire quotes FAR.AI’s two-day test: 140 static jailbreaks, picked from 1,500 candidates because they worked on a different base model, had produced 66 universal jailbreaks and 700 jailbroken interactions, and the monitors cut those to 0 and 18.

Goodfire’s October post does not name Baseten. TechCrunch says Baseten customers can monitor offensive hacking, chemical and biological weapons misuse, and reward hacking, and can log the event, send it for human review, or refuse the request. Goodfire says probes receive activations from the inference server as tokens are produced, and that it extended SGLang to score them inside the engine. Open models, it says, do not ship with this stack. TechCrunch quotes CEO Eric Ho: “Internal activation monitors are really cheap because they reuse the computations in the forward pass.”

Practical takeaway

Every rate and dollar figure above is Goodfire’s measurement. The host has to expose activations, which is what the SGLang work is for. The Baseten risk list and the log, review, or refuse responses are TechCrunch’s account.