You Didn’t Get The AI ​​Model You Paid For

A row in the response object

You are calling an API. Passing model: “claude-fable-5”. You get the completion, the number of tokens, and a field that reads “model”: “claude-opus-4-8”.

There is no mistake. Nothing is tried again. The application was classified before production started, aligned to a critical phase, and assigned a set of completely different weights. Anthropic wrote this while restoring Fable 5 on July 1: blocked requests are sent to Opus 4.8 instead, and the user is notified. The change happens at the API layer, and the response object refers to the model that actually worked.

That is the well behaved version. And, as far as I know, it’s the only version in wide use that tells the truth about the band.

Two weeks later, Cursor shipped Router: an editor trained on 600,000-plus live requests that reads each query’s context, complexity, and domain and sends it to whatever model it judges best with three early access accounts reporting 30–50% savings versus moving everything to Opus 4.8. Cursor published its routing rules but did not specify a specific model for each type of operation.

And under both, in the integration layer, OpenRouter warns that some providers offer limited weights at low prices, that the output may differ from what the absolute precision weights would produce, and that your logs will not tell you that this has happened.

Three products. Three different answers to the question what is the model. Zero cases tell us where the law will accept you.

There are three ways a word can determine the meaning of an object

The model’s identity breaks along three independent, and often undifferentiated, axes:

• Change – Different structure, different weights, different skill profile – submitted by the classifier. Legend 5 → Opus 4.8. Cursor Auto → whatever router chooses this option.
• Defamation – The same model, given with reduced accuracy. OpenRouter specifies the quantizations parameter precisely because quantized endpoints may perform worse in a given specification, and automatically requests are load balanced across all providers ordered by price. The same name in your application. Different arithmetic on the other hand.
• Drift – A synonym for silently updating weights. Every last alias in production is a static dependency that you can’t tolerate in the package manifest.

The engineering community treats all three as reliability issues. They are also issues of identity, and identity is what contracts, warranties, disclosures, and rules of evidence are built upon.

Did you really buy it?

Start with the oldest question in commercial law: was the definition a term of the agreement?

If the API call was a commodity transaction, this would be trivial. UCC §2-313(1)(b) makes any description of goods that form part of the basis of a transaction an express warranty that the goods will conform to it. India’s Sale of Goods Act, 1930, §15 does a similar job with the doctrine of sale by definition.

But the inference API is probably not a commodity. Courts often treat hosted software as a service, taking you out of warranty terms and into a common law contract – where the answer depends entirely on what the documentation says and how the buyer negotiated. This is where the mystery lies. Pricing for business deals per model. Special model cards. Versions of the compliance artifacts model. Then the routing layer treats the name as a to suggest.

A very clean way to detect stacks: if your code is pinning the model ID instead of specifying a skill requirement, the behavior can change dramatically without an error ever firing. A contract written in the same manner has the same characteristic. If you negotiated a name, changing it is a violation of the rules. If you’ve got the skill, the switch is fine – and now you need a definition of “borderline quality” that’s heavy on cross-examination.

No one wrote that description. Cursor’s is instructive: The router was tested in an online A/B test with user satisfaction as a reward signal. That’s a smart engineering choice and a weird contract. Contentment is not conformity. A user who has never seen a switch is evidence of a good router, not of the data posted.

Exposure gradient

Under the FTC’s deception doctrine, a representation is valid if it is material and likely to mislead a consumer to act accordingly; claims of objective performance require a reasonable basis before deployment. Both parts bite here.

On the lane side, the three products sit in very different places. Anthropic informs and returns the given model in response. Cursor publishes the rules but not the individual model of the assignment. The OpenRouter quantization variant is exposed in the documentation and is parameter controllable but it is output, and the default method is the cheapest.

The disclosure of information is hidden on the docs page, which is automatic against the user, the very fact that pattern administrators have been calling it a dark pattern for every other direct consumer.

On the validation side, the exposure is Claimnot the route. Analysts have already flagged that the claim “cheaper by 60%, no loss of quality” comes without a published method, and Anthropic’s disclosure is a model of what costs are cheap: it clearly stated that a retrained programmer flags incorrect requests more often during coding and debugging. That sentence is a shield of debt. Sellers who don’t write it are the ones who need to watch it.

There is also a tail of competition-law here. Working papers on direct closures in conceptual markets already propose an ethical framework built on route transparency, service quality parity, and FRAND-style non-discrimination. A router that is also a flagship model is a hobbyist engine dressed in cost-effectiveness clothing.

The part no one is looking at: authentication

This is where I think the real battle comes in, and it has nothing to do with charging. Federal Rule of Evidence 901(b)(9) validates the output by describing the process or system that produced it and demonstrating that the process produces an accurate result. FRE 902(13) and 902(14) go further, allowing records generated by an electronic system, or hash-verified data, to be self-verifying in certification. India’s Bharatiya Sakshya Adhiniyam, 2023, §63 does a similar job, conditioning the acceptance of an electronic record on a certificate identifying the record and the method of its production.

All of these provisions assume that you can name the program.

Now use this scenario – A lawyer sends a brief with a fictional quote. Sanctions procedures begin. The court asks which model produced it. The firm’s logs are legend-5. The provider logs say that the phase was fired and Opus 4.8 responded. Even if the request goes through an IDE router that has chosen a model that the company can rebuild, with an accuracy that has never been specified, from the base version.

The maintenance chain breaks on the router. Not in model the sender. And it breaks in both directions: the party trying to prove its output cannot, and the party trying to attack the output on the other side has a credible liberal argument that no expert can refute.

Add a detection problem. Routing decisions are now counterfactuals. That means routing measurement logs, model functions for each request, and accurate metadata are available to a vendor that is currently not responsible for maintaining them.

The amendment is a signature, not a clause

You can’t program your way out of this, because the representation you need is about a runtime event, and contracts are static.

What the law will end up asking is that proven model ownership: a signed guarantee, returned with each response, that commits to the completion of a copy of the given model identifier, weight hash, precision, and system information hash signed by a hardware proof-based key, supported by a private GPU platform.

The old one is half built. Response objects already have a given model name. What is missing is the structure that makes it legally enforceable: that it cannot be falsely asserted, and that the buyer can verify it without trusting the seller. The hash in the response header does for the model identity exactly what FRE 902(14) already does for the copied data, turning the disputed fact query into a certificate.

The route is good engineering. And, right now, it’s an unregistered, unsigned, unverified modification of what you proposed. The model ID has quietly become an official identifier. It’s time for someone to decide what it points to.

Sources:

• cursor, Introducing the Cursor Route (22 July 2026) — cursor.com/blog/router
• MarkTechPost, Cursor Releases Cursor Router: An Application-Level Classifier Delivers Frontier Code Quality at 30–50% Lower Cost (22 July 2026) – markettechpost.com
• Anthropic, It recycles Claude Fable 5 (30 June 2026) — anthropic.com/news/redeploying-fable-5
• Espressio, Claude Fable 5 Defenses: Opus 4.8 Fallback Explained (22 June 2026) – espressio.ai
• Digital is used, Why Claude Should Be More Careful About Your Code (2026) – digitalapplied.com
• OpenRouter, Provider Routing – Provider Selection (docs) — openrouter.ai/docs
• OpenRouter, Low cost LLM Description: The Complete Guide to OpenRouter (12 June 2026) — openrouter.ai/blog
• OpenRouter, How the OpenRouter Routing Model works (12 June 2026) — openrouter.ai/blog