You Didn’t Get the AI Model You Paid For

Call an API and ask for one model by name, and you might get a completion stamped with a different model's name in the response. That's not a bug. Anthropic built it on purpose: when it brought Claude Fable 5 back on July 1, it set things up so that requests classified as sensitive get quietly rerouted to Opus 4.8 before generation even starts. Nothing errors, nothing retries. The user is notified, and the response object names the model that actually ran. It's the rare case of a vendor telling you the truth in the same breath as the switch.

Two weeks later Cursor shipped Router, a classifier trained on more than 600,000 live requests that reads a query's context, complexity, and domain and sends it to whatever model it judges best for the job. Three early-access accounts reported savings of 30 to 50 percent compared with routing everything through Opus 4.8. Cursor published its routing rules. It did not publish which model handles which task type, and the system was evaluated in an online A/B test optimized for user satisfaction — a fine engineering metric, but not the same thing as proving you got what you paid for.

One layer down, OpenRouter is doing something quieter still. Some providers on its platform serve quantized versions of a model at lower prices, and OpenRouter's own documentation admits the output from those can differ from what full-precision weights would produce. Your logs won't show you when this happens. By default, requests get load-balanced across providers ordered by price, and checking or avoiding the cheap, degraded path is something you have to opt into.

Three products, three completely different relationships between the name you typed and the thing that actually computed your answer. And none of this fits cleanly into existing law. If an API call were a straightforward sale of goods, a model's name in your request would likely form part of the bargain, triggering warranty protections the way descriptions do under commercial sale statutes. But hosted inference generally gets treated as a service, which pushes the question into ordinary contract law — where everything hinges on what the documentation actually promised and how specifically the buyer locked in a model by name versus a general capability.

That ambiguity has teeth once you get to court. Evidence rules that let a record self-authenticate, or let a system's output be verified by describing the process that produced it, all assume you can actually name the system involved. Picture a filed document with a bad citation, and a firm's logs saying one model ran while the provider's logs say a classifier intervened and a different model answered — or a router selected something the firm can't even reconstruct anymore because that version has since been retired. The chain of custody doesn't survive that, in either direction: the party trying to prove its own output is legitimate can't, and the party attacking it gets an argument nobody can rebut.

The closest thing to a fix isn't a better contract clause, since contracts are static and the thing that needs proving is a runtime event. What's actually needed is a signed attestation returned with every response — tying the completion to the specific model, its weights, its precision, and the prompt it ran against, backed by a cryptographic guarantee the buyer can check without trusting the seller. Confidential-computing hardware already supports the underlying mechanism. Response objects already carry a model name. What's missing is the part that would make that name mean something once someone challenges it in a deposition.