The underlying problem with AI APIs: there's no way to verify which model, prompt or weights the provider is using

By Zendoric · July 30, 2026. A thread posted on X on July 28 by user Mateo Lafalce (@lafalcemateo) sums up in a few lines a problem the AI industry would rather not face head-on: when you use a provider's API —OpenAI, Anthropic, Google or any other— you have no way to verify three things that completely determine what you get back. First, which model actually answers your request. Second, what the effective system prompt is, the instructions the provider inserts before every conversation and that you never see. Third, whether the model's weights —the numerical parameters tuned during training that determine its behavior— have been modified after release. With a provider-hosted model, Lafalce writes, the answer to whether you can check any of the three is simply no.

The thread lays out a scale of technical sovereignty. Running inference on your own VPS (virtual private server, a rented machine you administer yourself) recovers two of the three layers: you can pin and validate the exact model version and the contents of the system prompt. But the weights remain the weak link. It is a file written once that in theory nobody ever touches again, and whoever has administrative access to the machine —the cloud provider, ultimately— has access to it too.

The top tier is running the model on your own hardware, with weights verifiable by hash —a cryptographic fingerprint certifying that the file has not changed since it was published. That, according to Lafalce, is the practical ceiling of AI privacy. But even then you are not entirely safe: firmware, drivers, processor microcode and the chip design itself can carry backdoors no user is able to audit. His conclusion, the sharpest part of the thread, is that trust never disappears at any point in this chain: it simply shifts from one layer to the next. The question is never whether you trust, but whom you trust and at which level of the technology stack.

It is worth separating speculation from what is documented. There is no evidence that any major provider is deliberately manipulating its responses, and the thread itself frames it as a rhetorical question, not an accusation. But the underlying concern is not entirely hypothetical. In general, it is standard practice among the large providers to silently update a model's versions under the same commercial name, route requests to cheaper variants depending on service load, or change the system prompt without notice; users on several platforms have reported perceiving behavioral changes in the same model over time, without the provider confirming or denying it with verifiable data. That margin of opacity, tolerable today for drafting an email, becomes critical when those same models begin to run agents with access to accounts, payments or business decisions: there, a model's provenance matters as much as its benchmark score.

This connects with something we have been pointing out from other angles: the relevant contest in AI is no longer only which model reasons best, but who controls each layer of the infrastructure that serves it, from the chip to the prompt. It is the same argument, at another scale, that explains why open, verifiable models —the ones you can download, weigh and run yourself, and which today compete head-to-head with the closed ones— are more than a question of cost: they are the only real lever a user or a company has to regain sovereignty over that chain of trust, even if they do not fully resolve it while the hardware remains a black box. In the short term, this opacity is a governance problem the industry is only beginning to address, with confidential computing, remote hardware attestation and hash-verifiable weights as the first technical answers, still immature. In the long run, however, it is precisely the kind of friction a maturing industry tends to resolve with standards and verification infrastructure, just as the cloud learned to prove where and how it processes your data. Verifiable trust is not an obstacle to the abundance AI promises: it is a condition for that abundance to arrive without a few players controlling, in the shadows, how the machines we are all going to depend on think.