Goodfire deploys activation-probe cyber monitors on Kimi K3 and GLM 5.3: about 50x cheaper than an LLM judge on every turn, zero universal jailbreaks in third-party red-teaming

Why it matters

【Key points】

On Oct 8, interpretability company Goodfire described cyber-misuse monitors for open models Kimi K3 and GLM 5.3, running in an SGLang production stack. Probes read the model's internal activations at almost no extra compute; only flagged exchanges go to an LLM judge.

Goodfire reports about 93% recall on harmful sessions at a 5.5% benign-interruption rate on ~2,400 in-house sessions; $65 to $185 per million turns, about 29 to 49x less judge cost than reviewing every turn, with throughput within noise. With monitors, Kimi K3's harmful-session blocking rose from ~29% to 96% and GLM 5.3's from ~36% to 91%, with benign interruptions up about 5 points each. A monitor trained on Kimi K3 data transferred to GLM 5.3.

In a two-day FAR.AI red-team with 140 static jailbreaks, universal jailbreaks fell from 66 to 0 and jailbroken interactions from 700 to 18. X: ~59 posts in 24 hours.

【Verifiable】

Research post: https://www.goodfire.ai/research/production-cyber-monitors-on-kimi-k3

Earlier primer on probe monitors: https://www.goodfire.ai/blog/probe-monitors-101

【Our read】

1. Closed labs run a full safety layer on their own servers; open-weight models ship without one. This shows a monitor cheap enough to check every turn live and block a risky action before the agent calls a tool. The ARTEX Korean bank intrusion we covered (e/734) ran open models through a third-party API reseller, exactly where such monitors belong, yet nothing requires resellers to deploy them.

2. Discount the numbers: the main eval is Goodfire's own dataset labeled by Claude Opus 5, and FAR.AI tested for two days with a fixed jailbreak set, in chat only, with no adaptive attacker targeting the probes.

3. It only helps whoever controls the inference server; anyone running weights locally bypasses it. Watch whether OpenRouter-style platforms adopt it by default, whether Moonshot and Zhipu endorse it, and adaptive red-team results.