Goodfire Deploys Probe-Based Cyber Monitors for Kimi K3 and GLM 5.3

Goodfire on October 8, 2026 published Training and Deploying Production Cyber Monitors on Kimi K3, a research post describing cybersecurity monitors for the Kimi K3 and GLM 5.3 open models that the company has deployed on a production inference stack. Goodfire reports that the monitors match an LLM judge’s recall at the company’s operating point while costing roughly 50 times less.

The post’s core contributors are Ekdeep Singh Lubana, Connor Watts, Siddharth Boppana, Dron Hazra, and Vasudev Shyam. Goodfire describes cybersecurity as one of the hardest settings for monitoring AI agents: auditing a codebase for vulnerabilities and exploiting it involve overlapping tasks, so distinguishing benign from malicious behavior requires tracking intent across a trajectory that can stretch to millions of tokens.

The obvious remedy, having a second LLM judge read every turn, is too slow and expensive to run alongside an agent in real time, so monitoring is usually asynchronous and harmful trajectories surface only after the agent has acted. Based on OpenRouter rates, the post estimates that judging one million turns of Kimi K3 rollouts with an every-turn judge…