Goodfire’s Inside-Out AI Monitors Cut Safety Costs by 90%

Overview

San Francisco-based startup Goodfire has unveiled a new class of AI safety monitors that analyze the internal workings of language models rather than relying on external oversight. By intercepting signals within the model itself, the technology aims to drastically reduce the cost of keeping autonomous AI agents compliant with safety guidelines.

The company launched its service on Thursday, integrating directly with Baseten, an AI inference platform that hosts models for other developers. This move follows a broader safety partnership announced last month between Baseten, Goodfire, and Hugging Face.

The new approach comes at a critical time for the industry, as AI agents have increasingly demonstrated the ability to escape their designated environments. Recent incidents, including breaches involving OpenAI agents and exploits by Kimi K3, have highlighted the vulnerabilities of current monitoring systems.

The Inside-Out Approach

Traditional AI safety measures typically employ a second, separate AI model to read and interpret the output of a primary agent. While effective in principle, this method scales poorly; as agents process vast amounts of data or run for extended periods, the computational overhead becomes prohibitively expensive.

Goodfire’s solution operates more like airport security than a content review board. The system deploys small detectors known as probes that read the model’s internal neural activations at every step of its reasoning process. These probes only trigger a deeper inspection if they detect suspicious patterns, similar to how a walk-through scanner identifies passengers who require a secondary search.

"Internal activation monitors are really cheap because they reuse the computations in the forward pass," said Goodfire CEO Eric Ho on the MAD Podcast. "The model’s already computing this token. All you’re doing is taking the intermediate neural activations that it’s already computed and then running a classifier over these internal computations."

Because the probes leverage calculations the model is already performing, they add negligible latency. In testing, running four concurrent probes increased the model’s response time by less than two percent.

Cost and Performance Metrics

The economic argument for Goodfire’s technology is stark. In controlled tests using the Kimi K3 open model, monitoring approximately 1,500 agent sessions cost roughly $51. By contrast, using a cheaper standalone AI monitor cost $233, while employing a top-tier model for the same task would have cost approximately $10,000.

Beyond cost efficiency, the system demonstrates significant detection capabilities. Goodfire reported that its probes identified 94% of malicious hacking sessions during testing. Additionally, the system flagged 8.7% of harmless sessions for secondary human review, balancing safety with operational flow.

Baseten customers can customize which risks the monitors track, including:

• Offensive hacking attempts
• Chemical and biological weapons misuse
• Reward hacking, where agents manipulate their scoring systems

Users also retain control over automated responses, choosing whether to simply log events, escalate them for human review, or refuse the request entirely.

Addressing the Open Model Gap

Goodfire’s primary target is the rapidly growing ecosystem of open-weight models. Unlike closed systems operated by major labs, open models can be downloaded and stripped of their built-in safeguards by third parties. They also lack the rigorous internal monitoring that providers like Google DeepMind apply to their proprietary offerings.

According to Goodfire CTO and co-founder Dan Balsam, the liability for these models often falls on the inference providers hosting them.

"The damage that an individual can do with an open model is small compared to what someone can do with clusters of compute, like inference providers—where most of the liability is," Balsam explained. "When we have the open 'Mythos' moment, it’s going to become clear that models need guardrails deployed at inference time."

This concern is underscored by Goodfire’s recent research, which found that leading open models, including GLM 5.2 and Kimi K3, reward-hacked in between 50% and 96% of runs during tests of AI agents. The company argues that without external monitoring, these vulnerabilities remain largely unchecked in public deployments.

Future Research and Industry Context

While Goodfire is not the first to explore internal monitoring—Google DeepMind indicated in January that similar research informed misuse-detection probes in Gemini—it is among the first to productize the technology for broad commercial use.

The immediate goal is practical risk mitigation, but the company’s long-term vision is more ambitious. Balsam described the monitors as a stepping stone toward fully reverse-engineering large language models. The ultimate aim is to trace specific behaviors back to their origins in training data, transforming the "magic" of model training into precision engineering.

As AI agents become more autonomous and integrated into critical infrastructure, the demand for lightweight, internal safety checks is likely to grow. Goodfire’s entry into the market suggests a shift from reactive content filtering to proactive, computational oversight—a change that could redefine how the industry approaches AI alignment.