Baseten and Goodfire AI launch Project Beacon for inline safety on open models

How Project Beacon works

Baseten says the idea behind Project Beacon is that safety should not be a static feature or something that happens after the fact. By reading a model's internal activations while it generates, teams can define policies that catch an unsafe event as it happens.

The architecture Baseten describes combines activation monitors and text monitors that classify each request. A frontier model weighs in only when the two disagree. Per-customer policies then decide whether to request approval, refuse, fall back, or log the event for admins. According to Baseten, monitoring runs in parallel with generation and does not block response generation.

The work is split between the two companies. Goodfire develops monitors for specific behaviors on supported models, while Baseten connects their signals to the systems that decide how an application responds.

The risks it targets

Baseten lists four kinds of safety risk at the inference layer:

• Prompt injection: instructions in a document or tool result try to redirect an agent.
• Actions outside policy: an agent proposes a change its user or organization did not authorize.
• Sensitive data exposure: customer or company information appears where it should not.
• Cyber misuse: a model's behavior raises concerns in a security-sensitive workflow.

Each, the company says, calls for a mixture of monitoring, text checks, tool controls, and review.

The announcement frames the problem against a fast-moving backdrop. Models and agents now read internal documents, call tools, push to production systems and run multi-step workflows autonomously, while new frontier models arrive weekly or even daily. Baseten says that risk has become one of the main blockers to enterprise AI adoption.

What it means for enterprises and developers

Baseten says it is building toward an out-of-the-box safety experience: a baseline of supported monitors and checks, policies for different workloads, alerts, and a record of what was flagged and how it was handled. Teams would be able to apply their own standards per model.

For enterprises, the pitch is central governance. As inference spend grows across teams, separate filters and review processes for every application become hard to manage. Baseten says it will offer a safety baseline that can be applied centrally, with adjustable policies by workload.

For developers, the company is working toward safety events and controls delivered through the same APIs and developer tools used for inference on Baseten. Its example is a payment-dispute agent that reads merchant messages and account records before proposing a refund. Untrusted content might redirect it, and a wrong action could expose data or move money. Reviewing every step with another large model adds cost and latency, Baseten notes, so developers need timely signals to choose whether to continue, investigate, request approval, or fall back.

Timeline and availability

Baseten says it plans to release safety capabilities tightly integrated with its inference over the next several months. They will start with selected models and monitored behaviors, then expand into enterprise controls and developer-facing experiences.

The company will bring the capabilities to market with a small number of early partners, and invites businesses that care about safety controls as their AI usage scales to get in touch about early access. No pricing or specific release dates were given.

Project Beacon follows earlier safety steps on the Baseten Platform, which the company lists as launching Base Labs for open safety research, partnering with Hugging Face and Goodfire AI on safety infrastructure, and working with NVIDIA on the Open Agent Safety Platform.