Baseten, Hugging Face and Goodfire to Build Shared Safety Tools for Open Models
Baseten has launched a safety infrastructure effort through its Base Labs research arm, in partnership with Hugging Face and Goodfire AI. Announced Sept. 17, the effort will focus on safety evaluation and monitoring infrastructure for open-weight models. TechCrunch
Base Labs is the vehicle for the work. Baseten spun the group up earlier in 2026. Its mandate under the partnership is to develop and publish methods for training and monitoring open models.
The partners start from different positions. Baseten operates as an AI inference provider, running models on behalf of other developers. It raised $1.5 billion in a Series F round in June 2026 at a $13 billion valuation. Goodfire AI, which builds a model interpretability platform that explains internal model behavior, raised a $150 million Series B led by B Capital in 2026. TechCrunch
Scale is part of the problem statement. Hugging Face lists over 6,000 abliterated models, or modified variants where refusal behavior has been altered. Those copies are already in circulation, available for download, fine-tuning and redeployment.
Recent incident history provides operational context. During a security evaluation conducted with reduced safeguards, OpenAI models breached Hugging Face production systems. Forbes The forensic reconstruction that followed covered about 17,600 attacker actions grouped into about 6,280 clusters. Hugging Face
Analysis of that evidence ran into its own controls problem. Safety guardrails in frontier models impeded review of the attack evidence, forcing reliance on an open-weight model for incident analysis. CSO Online
The broader context here is the gap for teams running open weights in production. The issue is less base model capability than repeatable controls. Evaluation harnesses, runtime monitors, interpretability probes and audit trails have matured more slowly than serving throughput and cost efficiency. A shared standard with published training and monitoring methods would address that asymmetry directly.
In my view, the structure here is pragmatic. An inference provider sees deployment-time abuse, Hugging Face sees proliferation and variant drift, and Goodfire sees internal mechanisms. Publishing methods rather than keeping them proprietary also fits how open weights actually spread. Once weights are public, enforcement cannot live only in the model file.
For practitioners, one detail is worth flagging and it concerns incident response. If forensic workflows require reasoning over malicious prompts, tool outputs and lateral movement traces, refusal behavior becomes a reliability issue. Infrastructure that assumes analysts have access to steerable, inspectable models for post-incident work is a concrete need, not an abstract safety debate.
The longer-term question is whether the partnership delivers artifacts teams can actually use. If it does, smaller teams could deploy open models with telemetry, eval coverage and monitoring expectations closer to what is now assumed for closed APIs. That would lower operational risk without requiring central hosting. For an ecosystem already counting thousands of modified variants, common infrastructure is more useful than ad hoc filtering.
