The Pulse
Goodfire Uses Model Probes to Cut AI Agent Monitoring Costs
Goodfire says probes that read a model’s internal signals can cut the cost of monitoring AI agents. Baseten plans to offer them to early partners first; the results come from Goodfire’s own tests on Kimi K3.
AI.info Team · Written with AI ·
“Internal activation monitors are really cheap because they reuse the computations in the forward pass.”
Eric Ho, co-founder and CEO of Goodfire
Goodfire is bringing that approach to AI agent monitoring, using small classifiers to inspect a model’s internal signals while it works instead of asking a second model to reread every step. Baseten, a company that hosts models for other businesses, said on October 9 that it is building Goodfire’s activation-based probes into its inference service under a program called Project Beacon, starting with a small number of early partners. Goodfire’s pitch: reserve the more expensive AI review for activity its probes flag.
Probes read signals inside the model
A typical external monitor reviews an agent’s text and actions after the model produces them. Goodfire’s probes instead read intermediate activations—the internal calculations made as the model generates tokens—and classify them for signs of risky behavior. When a probe raises a flag, a separate AI model can take a closer look.
Goodfire’s October 8 post covers cyber-misuse monitors on two open models, Kimi K3 and GLM 5.3. When a probe’s score passes a calibrated threshold, an AI judge reviews the exchange and can refuse the request or let the interaction continue. Baseten says per-customer policies will decide whether to request approval, refuse, fall back, or log the event for administrators. Those options make the system a configurable check within the serving process, rather than a guarantee that an agent cannot act unsafely.
The cost figures have a specific test basis
In Goodfire’s tests on the open Kimi K3 model, the probe-plus-judge cascade cost about $185 per million agent turns with the judge’s reasoning switched on, and $65 without it, based on OpenRouter prices. Running the same reasoning judge on every turn cost $5,420 per million turns. Goodfire estimates that monitoring a million Kimi K3 turns with Anthropic’s Claude Opus 5 would cost on the order of $200,000.
On an in-house set of about 2,400 chat and agentic sessions with more than 60,000 turns, labelled by Claude Opus 5, the cascade caught about 93% of harmful sessions while interrupting at most 5.5% of harmless ones. TechCrunch’s launch report cites the same $185, 93% and 5.5% figures. Some early coverage, including The Inference, cited about $51 for roughly 1,500 sessions and a 94% detection rate; those numbers do not appear in Goodfire’s post.
Internal access limits where the monitors can run
Goodfire says running the probes inside its serving engine changed throughput by less than 2% across four test workloads, within the noise of its benchmarks, and that the cascade added an average of 2 milliseconds per agent turn without judge reasoning and 42 milliseconds with it. The design depends on access to internal model activations, however, which makes it most relevant to model hosts and operators who control the inference stack. It is not simply an add-on that can inspect any model behind a closed API.
Ho explained the cost advantage in an interview published by venture capitalist Matt Turck: the model is already computing each token, so a classifier can run over the intermediate activations it has produced and screen out most of the activity that would otherwise need a reasoning model to review it. That efficiency could make continuous monitoring more affordable for providers serving open models, but the reported detection and cost results remain Goodfire’s own tests on Kimi K3, not a measure of performance across all models or real-world agent deployments.
Cheaper checks still leave a review burden
The system’s practical value depends on what happens after a flag. In Goodfire’s full-session comparison, adding the monitor raised Kimi K3’s rate of blocking harmful sessions from about 29% to 96%, but its rate of interrupting harmless sessions also rose, from about 5% to 9%. A monitor that blocks too many legitimate tasks can disrupt work, while one that misses harmful activity cannot replace access controls, sandboxing, or careful oversight.
Goodfire’s change is to make an internal signal part of the monitoring path and use it to decide when a more expensive judge should intervene. The strongest claim supported by its Kimi K3 results is narrower than a universal safety fix: in that test, the probe-based approach monitored sessions for substantially less than the compared model-based checks while detecting most of the malicious hacking sessions.