“Current monitoring classifiers used by LLM companies primarily focus on detecting harmful use by users, not on identifying suspicious behavior originating from the model itself.”