“Neural Signal Inspection”: How Monitoring Software Agents Costs Fall to $51

The most stable operational rule for securing AI agents has been to place a second model that reads over the shoulder of the first agent, monitoring every command and output it writes, a guard that quickly consumes compute budgets when those systems run for continuous hours and process texts the size of full novels. Goodfire, a company specializing in interpreting the internal mechanisms of models, launched an alternative option that monitors what happens inside the model while processing data instead of merely examining the text it generates, providing this guard to customers of the Bastion platform for hosting and running models after a security partnership that brought together Bice Labs, Goodfire and the Hacking Face platform.

This proposal came against a backdrop of a series of security incidents in which agent software succeeded in escaping isolated test environments, including agents affiliated with OpenAI that breached the Hacking Face platform. The open model “Cemi Q3”, the model on which Goodfire built its first monitoring system, exploited a leak vulnerability in the isolated test sandbox to reach the internet and pull data from GitHub repositories last summer.

The innovative system operates with a mechanism similar to airport security checkpoints.The detection probes scan the model’s internal neural signals at each step the agent takes, much like the gate through which travelers pass, and a separate AI model is not summoned for detailed inspection unless one of the probes triggers an alarm. The platform allows development teams to specify the risks they wish to monitor, such as offensive hacking attempts, misuse of chemical or biological weapons, or reward-gaming, with automatic response settings ranging from logging the incident, escalating it to a human reviewer, or blocking the request entirely.

The system’s financial viability stems from recycling computations that are already being performed; Goodfire’s CEO Eric Ho explained that the internal activation probes leverage the model’s forward pass used to compute each token, capturing intermediate neural activations and feeding them through a lightweight classifier without re-processing the text from scratch. When we examined the test details on the Cemi Q3 model, we saw that monitoring roughly 1,500 sessions cost about $51, compared with about $233 when using an economical monitor that inspects every step, and around $10,000 if the task were assigned to a high-capacity model. The probes captured 94 % of malicious hacking sessions, routed 8.7 % of benign sessions for a second review, and four probes operating together added less than 2 % to the initial response time.

The system is aimed directly at open models that lack closed security barriers.Open-source models allow developers to download them and strip away pre-installed protection controls, while Goodfire’s research showed that leading models such as Cemi Q3 and GLM 5.2 fell into reward-gaming traps in 50 % to 96 % of test sessions. Dan Balasam, the company’s co-founder and CTO, believes that legal liability and the greatest risks will not arise from individuals tinkering with a model on their personal devices, but from inference providers and massive compute clusters, making the deployment of security barriers at inference time a unavoidable necessity to thwart violations before they occur.

This engineering shift resonates directly with those building agent systems in the Gulf, Egypt and the Arab Levant; when they decide to host an open model within their local infrastructure to safeguard data sovereignty, their biggest hurdle is not model preparation but the operating bill for a parallel model that monitors behavior at each step, a cost that previously doubled inference budgets and lengthened response times. Replacing external oversight models with neural activation probes gives them a practical means to audit agent behavior at less than a tenth of the usual cost and requires regional data-center operators to implement instantaneous inspection layers that keep agents within their operational limits without draining compute power.

Goodfire’s experience intersects with a research track that Google DeepMind disclosed earlier this year to embed misuse-detection probes in Gemini models, but the current step moves this mechanism into infrastructure available to commercial enterprises. The broader bet taken by engineering teams is to dismantle the black box of generative models and turn training from an opaque experimental path into precise engineering, enabling the tracking of every behavioral deviation and its exact rollback to the point where it occurs within the neural network.