Inside-Out Monitors Cut Rogue-Agent Policing From $200,000 to $51 — Goodfire Just Repriced the Stack That CrowdStrike, Palo Alto and Akamai Are Counting On

Until this week, monitoring an autonomous agent for prompt-injection, jailbreaks or reward hacking meant paying a second large model to re-read everything the agent did. That's the architecture baked into every major vendor's \"agent security\" product: a cheap model checks every step for the basics, and an expensive model checks everything when risk is high. The problem is computational. Running Kimi K3 itself costs about $30,000 per million turns; running Opus 5 to judge every turn adds roughly $200,000 on top — a 7x overhead — and the LLM judge itself takes seconds per call, which is incompatible with sub-second agent latency budgets.

Independent red-team results published alongside the launch show the architecture matters more than the budget. In FAR.AI testing on the same Kimi K3 deployment, 66 universal jailbreaks and 700 jailbroken interactions showed up with no monitor; with the Goodfire cascade enabled, every one of 140 tested jailbreak strategies failed and only 18 non-universal interactions broke through — a reduction in attack success from 9–40% to 0.1–1.6% depending on reasoning effort. Crucially, latency stayed manageable: average added turn latency was 2 ms without reasoning and 42 ms with reasoning, against 160 ms and 2,750 ms for the equivalent LLM-judge baseline.

The activation-probe monitors are not a science project — they shipped into production on October 8 through Baseten, the $13B-valuation AI inference platform that quietly became the OpenAI-hostile neighbor in the model-serving market. Baseten's \"Base Labs\" research arm paired Goodfire with Hugging Face on September 17 to publish a safety-infrastructure standard for open-weight models, framed as a deliberate counterweight to a proliferation of \"abliterated\" open-weight checkpoints that Hugging Face's own catalog now numbers past 6,000. Goodfire's contribution is the interpretability layer; Hugging Face supplies the publishing pipeline; Baseten provides the inference substrate that connects the two.

Three of the four companies named in this thesis — CrowdStrike, Palo Alto Networks and Akamai — have been treating agent security as a tier-1 platform extension for the past 18 months, with research-and-development budgets that priced the per-agent monitoring line item assuming high marginal cost. That assumption now looks wrong. Inside-out monitoring pushes per-token safety spend down by roughly three orders of magnitude on a frontier open-weight model, which means the agent-safety workload can be priced into inference rather than sold as a standalone SOC module.

The threat isn't that the agent-security TAM shrinks — multiple private-market and analyst forecasts put it on a steep curve. Gartner's August 2026 forecast sized the market for securing AI at $4.8 billion in 2027, up 68.7% year over year, and MarketsandMarkets projects the agentic-AI-security slice alone from $1.65 billion in 2026 to $13.52 billion by 2032. A separate IGTPS forecast pegs the U.S. AI-agent-security market at $26 billion in 2026, growing to $115.1 billion by 2034. Deloitte's 2026 enterprise survey found only 21% of organizations report fully working guardrails around their deployed AI agents — the remaining 79% are the demand pool.

The risk for the incumbents is that the marginal customer now buys safety from the place where the agent already runs. Baseten-style inference providers can fold inside-out monitoring into the model's serving cost without selling a separate SKU; Cloudflare's Dynamic Workers already push agent code into an isolate per session; and NVIDIA's Open Agent Safety Platform, announced September 28, 2026 with the OpenShell runtime boundary and Sentry in-silicon watchdog on BlueField-4 DPUs and Vera CPUs, is the silico–level embodiment of the same idea. The pricing power the four listed SOC-and-edge vendors were building for agent security now has to be earned against a commodity-grade probe cost, not a frontier-judge cost.

Two near-term catalysts will signal whether the bundled security platforms can hold their pricing against the activation-probe alternative. First, Akamai reports Q3 2026 results on a normal cadence and will have the LayerX business inside the line for a full quarter — the dilution guidance of roughly $0.12 to FY2026 non-GAAP EPS, plus any disclosure of agent-security attach rates versus its $604 million security base, will set the read-through. Second, the CrowdStrike and Palo Alto Networks product teams will have to decide whether to license or build inside-out monitoring themselves; both already have native machine-learning detection capabilities, but neither has shipped a probe-cascade architecture into production on a frontier open-weight model.

Over a 1–3 year horizon, three camps are positioning to absorb the agent-safety spend that previously attached to SOC platforms. The first is the inference layer: Baseten, Modal and the hyperscalers will package inside-out monitoring as part of the model-serving bill, capturing dollar share at the cost-of-goods line. The second is silicon: NVIDIA's OpenShell + Sentry stack on Vera + BlueField-4 is the first credible attempt to push safety enforcement into the runtime, with a hardware-rooted trust domain that the SOC vendors cannot replicate without a similar DPU footprint. The third is the open-weight model itself: Goodfire's research shows reward-hacking evidence in 50–96% of rollouts across today's most capable open-weight models depending on environment — meaning the next round of model releases is likely to be evaluated, marketed and arguably priced on the strength of the safety stack shipped with it.

Speculation rather than data drives the longer-horizon call. If Baseten-style safety becomes a default line item on every open-weight model hosting bill, NVIDIA's role as both an investor in Baseten and the supplier of the runtime that interprets probe signals makes the data-center tailwind self-reinforcing. Conversely, if a SOC vendor ships an open-weight-integrated probe of its own into Falcon or Prisma before year-end, the activation-probe economics get competed down further and the threat to Baseten's distribution angle is just as real as the threat to the SOC vendors. What is not uncertain is the unit-cost result: from ~$200,000 per million exchanges to ~$185 is a 1,000x compression in the marginal cost of catching an agentic attack, and that is a permanent change to the inputs of the agent-security pricing problem.