in a controlled multi-agent setup where a peer presses a target agent for up to 20 rounds to reveal a secret (e.g. a deploy token), a linear probe on the target's activations, read at each call *before* its output is written, caught 82% of leaking calls at a threshold flagging 5% of benign calls — a zero-shot decision-model monitor watching the same calls caught 26%. The paper's own limits are stated plainly: the probe mostly reads "a disclosure is coming" rather than "a violation is coming," it also flags permitted disclosures, and halting on any alarm would stop most benign episodes.