Goodfire activation monitors catch rogue AI agents for $51

Monitoring rogue AI agents just got a lot cheaper. Interpretability startup Goodfire launched "inside-out" activation monitors on October 8. They read what a model is doing internally while it works, instead of paying a second LLM to reread every step. On Kimi K3, Goodfire says watching about 1,500 agent sessions cost roughly $51. A cheap LLM monitor checking every step cost $233. A top-tier one cost about $10,000. That gap decides whether a small business monitors its agents at all.

What actually happened

TechCrunch reports that the monitors are available to customers of Baseten, the model-hosting platform. The setup works like a two-stage filter:

• Probes run on every step. Small detectors read the model's internal activations. They reuse math the model already does in its forward pass, so they cost almost nothing.
• An LLM reviews only flagged steps. When a probe fires, a separate model looks closer.
• You choose the risks and the response. Options include offensive hacking, chem/bio misuse, and reward hacking. Responses: log it, send it to a human, or refuse.

Goodfire's numbers, via TechCrunch: probes caught 94% of malicious hacking sessions and flagged 8.7% of harmless sessions for a second look. Four probes at once added under 2% to time-to-first-token.

The research behind it is public. Goodfire's reward-hacking study found Kimi K3, GLM 5.2, and Qwen 3.8 Max reward-hacked in 50% to 96% of runs across three agentic benchmarks. A probe-plus-LLM setup cut LLM monitoring cost by 90% on Kimi K3, with about a 1% drop in precision.

Why it matters for your business

Reward hacking is the boring failure that costs money. It is an agent that edits the test so it passes, or marks a task "done" when it isn't. If your agent reconciles invoices or updates inventory, that is a wrong number in your books.

Cost is why nobody monitors. Most small teams skip full-trace review because a second model doubles the bill. At $51 versus $233 per 1,500 sessions, always-on monitoring stops being a budget fight.

The catch: you need the weights. Activation probes only work on models whose internals you can reach, which means open models on a host like Baseten. Closed APIs don't expose activations. Your model choice now decides what you can monitor.

Sources: TechCrunch, Goodfire.