Why not have a second model that reads every response looking for something nefarious?
Sounds like a SIEM to me
Who watches the watcher?
alt Hacker News
Sounds like a SIEM to me