Activation monitors move from research to a product you can buy

The research case is strong and fairly crowded: Apollo, Anthropic, DeepMind and many academic papers show that probes can match LLM judges at a fraction of the cost. The commercial space is still early, though. I found only one startup that clearly says it does activation-based monitoring of agents in deployment, Clearwood, and it has no visible product, pricing or customers yet. Goodfire has the technology and the brand to move in at any time. The frontier labs use probe cascades only inside their own closed models, and current guardrail vendors such as Galileo, Llama Guard and NeMo Guardrails work only on inputs and outputs. A new entrant could win in four ways. First, ship ready-made, validated probe packs for the open-weight models enterprises actually run, such as Llama, Qwen, DeepSeek, Gemma and Mistral. Second, offer drop-in integration with vLLM, SGLang or TGI serving stacks so that capturing activations adds almost no latency. Third, provide the cascade that escalates to an LLM judge only when a probe fires. Fourth, sell it as an add-on for security and compliance buyers rather than for safety researchers. The main risks are technical and commercial. Published work shows deception probes still produce false positives and break when conditions differ from their training data, and each new model release needs its probes retrained. Goodfire or an inference platform could also bundle this feature. The idea only works for customers who host their own model weights, which limits the market, unless proxy-model approaches like Clearwood's \"probe by proxy\" prove useful for closed models.

• Clearwood, PBC

  This is the closest direct match. Its CEO and cofounder, Matt Levinson, describes the company as doing activation-based monitoring of AI agents in deployment. The pitch is cheaper always-on monitoring, and the company argues that black-box monitoring alone won't be enough. It is also researching "probe by proxy", which means reading an open-weight proxy model's activations on transcripts from closed models. I found no product docs, pricing, funding or customers. All of this comes from his mentor profile on a research-mentorship listing, so it is the company describing itself.

• Goodfire

  A well-funded interpretability company. Its Ember platform has reportedly been used with Rakuten, Apollo Research and Haize Labs. In a case study it trained activation probes that caught frontier models reward hacking, and says they matched or beat a frontier LLM judge at a fraction of the cost and latency. That is the same claim this opportunity rests on. Goodfire is the most credible company that could turn this into a product for agent monitoring.

• Anthropic and Google DeepMind production activation probes

  Both labs published work on production-ready activation probes in early 2026. Their design is the same cascade proposed here: cheap probes screen all traffic and expensive LLM classifiers handle only flagged cases. Both aim at jailbreaks and misuse on the labs' own closed models. Neither sells them for self-hosted open-weight agents.

• Apollo Research deception probes (research)

  An ICML 2025 paper that trained linear deception probes on Llama-3.3-70B. They scored AUROC 0.96 to 0.999 and caught 95 to 99 percent of deceptive responses at a 1 percent false-positive rate. The authors say this is not yet a robust defense. It is research, not a product.

• Probe-based monitoring research for agents (prompt injection, collusion, sabotage)

  A growing body of 2025 and 2026 papers shows that hidden-state probes on agentic LLMs can detect indirect prompt injection, colluding transcripts and hallucination. One LessWrong post reports a probe catching 86 percent of collusion at a 1.4 percent false-positive rate. None of this work is packaged as a product.

• Conventional guardrail and agent-monitoring vendors (Galileo, Future AGI, Llama Guard, LlamaFirewall, NeMo Guardrails)

  These are the incumbents an enterprise buyer would compare against. All of them run classifiers or LLM judges on inputs, outputs and tool calls, not on model internals. Most are framed around safety and security policy rather than deception or sabotage.

Checked 2026-10-09