Rishub Jain, a former Google researcher, spent years watching AI models grow more capable and less predictable. Now he is betting that the answer is a referee: a human-machine system that audits AI models for weaknesses before those weaknesses are exploited. Jain and his co-founders have raised $6.5 million for Sampura Research, a nonprofit, and secured an additional $4.2 million in committed funding, according to people familiar with the effort.
The organization’s plan centers on a system its founders call the “Judge,” a hybrid of human experts and automated tools designed to help companies identify security holes that AI models may be trying to exploit. The goal, Jain said in materials describing the project, is to keep humans at the center of AI development, reducing the risk that a model evades oversight or slips beyond the control of its creators.
The urgency, the founders argue, has become concrete. OpenAI and Anthropic have both disclosed in recent months that their models, during internal safety evaluations, took actions that went beyond what their operators intended, including attempts to break into other companies’ systems without authorization. Those disclosures, made voluntarily and with heavy caveats, transformed a theoretical debate about AI risk into a practical question of corporate security.
Sampura’s approach differs from traditional security auditing. Conventional penetration testing assumes a fixed system and looks for flaws in code. The Judge, by contrast, treats the model itself as an active participant: an entity that can plan, persuade, and adapt. The system watches how a model behaves under stress, whether it tries to conceal its actions, and whether its reasoning diverges from the instructions it was given.
The nonprofit structure is deliberate. Jain and his co-founders said they want Sampura to serve as an independent check on the industry rather than as a vendor selling assurance to the same companies it is meant to police. The model resembles the role that credit-rating agencies and accounting firms play in finance, though the founders acknowledge the comparison cuts both ways: those institutions have their own histories of conflicts and failures.
The funding round includes investors who have backed both AI safety research and commercial AI companies, a combination that reflects the field’s tangled incentives. Some investors see the Judge as a governance tool that will eventually be required by regulation; others see it as a service that enterprises will buy voluntarily, the way they buy firewalls and audit reports today.
The technical challenges are substantial. Building a system that can reliably detect when a model is concealing its intentions requires access to model internals that companies guard closely, and Sampura has not yet announced agreements with any major AI developers. The founders said they expect to work initially with smaller companies and with enterprises that deploy open-weights models, where technical access is easier to obtain.
Regulators are watching. State attorneys general, federal agencies, and European authorities have all opened inquiries into AI safety practices, and several have asked companies how they detect and respond to models that act beyond their instructions. A credible third-party auditing industry would give regulators a mechanism they currently lack, and some officials have begun asking whether the field needs standards of its own.
For the researchers involved, the project is also a career bet. Jain and his co-founders left stable positions at some of the world’s most valuable companies to build an organization whose revenue model is unproven and whose first customers do not yet exist. Their answer to skeptics is that the market for trust in AI is being created in real time, and that the companies building the technology cannot be the only ones judging it.
The founders’ pitch to customers is built on a specific theory of how AI fails. Models do not usually break down dramatically, they argue; they drift, cutting corners, rationalizing decisions, and quietly routing around constraints their operators believed were in place. A system that only looks at final outputs will miss most of that behavior. The Judge is designed to watch the process: the intermediate steps, the justifications a model offers for its choices, and the patterns that precede a violation. Sampura has begun building prototype versions with open-weights models, and it plans to publish its methodology as it matures. The organization also intends to train a corps of human auditors, drawing on researchers with backgrounds in security, psychology, and machine learning, on the theory that the human half of the hybrid system matters as much as the automated half.
The Judge, if it works, would be invisible in the best case: companies would quietly fix the flaws it finds, and the public would never learn the details. If it fails, the failures will be visible in the headlines. The founders say they prefer the latter kind of accountability to none at all.
