Goodfire's probe-based cyber monitors beat an LLM judge at 50x lower cost

Why cyber monitoring is hard

Goodfire describes cybersecurity as one of the hardest settings for monitoring AI agents. Benign and malicious behavior often look alike, since auditing a codebase for vulnerabilities and exploiting it involve overlapping tasks. Telling them apart means tracking intent across a whole trajectory, which can stretch to millions of tokens.

The obvious fix is to have an LLM judge read every turn, but Goodfire says that is too slow and expensive to run alongside the agent in real time. In practice, monitoring is therefore asynchronous, so by the time a harmful trajectory is flagged, the agent has already acted. Based on OpenRouter rates, the company estimates that monitoring one million turns from Kimi K3 rollouts with Opus 5 would cost on the order of $200K, or about $30K using Kimi K3 itself.

A probe as the first-line filter

Goodfire's approach is a monitor cascade. A probe reads the model's internal activations and works as a cheap, always-on detector. If its readout exceeds a calibrated threshold, the exchange is escalated to an LLM judge, which can refuse the request or continue the interaction. The company says it designed a new probing architecture meant to capture behavior that is localized to a chunk of a turn as well as behavior that is present across an entire turn.

After calibration, the probe reaches 0% FNR and 95% TNR on a held-out set of agentic and chat interactions, according to Goodfire. Because the judge only sees flagged activity, a faster and less capable judge can be used, which lowers cost further.

For training data, the team simulated users with harmful and benign goals in cyber and non-cyber environments such as software engineering and tool use. Part of the data was collected with Prime Intellect's verifiers, Prime Sandboxes and Tunnels, which let Kimi K3 run offensive and benign cyber tasks without network access. A precise policy separates well-intended tasks, such as bounded vulnerability reproduction, from ill-intended ones, such as vulnerability exploitation. Simulated users can introduce or escalate harmful intent at any point, including after an initially benign request.

Results and inference engineering

Goodfire reports the following results for the cascade compared with running the judge on every turn:

• It Pareto-dominates the judge and matches its recall at the chosen operating point, which is 93% recall at 5.5% FPR.
• It costs about 50x less, at under $200 per million exchanges.
• It maintains baseline inference token throughput and adds no latency.
• It reduces universal jailbreaks to 0% on an independent evaluator's static battery of red-teaming attacks.

To avoid slowing serving, Goodfire extended SGLang to compute probe scores inside the serving engine, including custom kernels for the probe logic. Scores are kept through the radix tree, the DSpark speculator and prefill-decode disaggregation to avoid recomputation. With multiple Kimi K3 replicas, each worker runs the probes and keeps histories for its active requests. The company also extended the SMG router so the monitoring configuration passes through request conversion to the selected worker, and monitoring events return with the response stream.

Across four inference workloads, the company says throughput with probes stayed within the noise of its benchmarks relative to default SGLang, with a decrease of less than 2%. It also reports that the cascade cuts the average delay added to each agent turn by 50x compared with judging every turn.

What it means for open model operators

Goodfire argues that real-time monitoring of agentic rollouts becomes practical with this setup, so risky cyber actions can be blocked before any tool is called. The company notes that open models do not ship with a full safety stack and calls a monitoring setup like this a practical default for anyone serving them in agentic settings. It invites operators who serve or build on open models to get in touch.