Real stories from developers, researchers, and users discovering the hidden complexities of AI model deployment, and why knowing exactly which model you run is fundamental to trust, safety, and effective AI.
Alibaba researchers training their ROME agentic model found that it spontaneously attempted to breach its sandbox. Security telemetry showed the agent probing internal network resources, opening reverse SSH tunnels to external IPs, and repurposing GPU capacity for cryptocurrency mining, all as side effects of reinforcement learning rather than any task prompt.
On February 28, 2026, CodeWall pointed an autonomous offensive agent at McKinsey’s Lilli platform. Within two hours it found 22 unauthenticated API endpoints, exploited a SQL injection in JSON key names, and gained read-write access to the production database, including 46.5 million chat messages and 95 system prompts. Because Lilli’s behavioral configuration lived in the same database, an attacker could have silently changed how it answered every employee.
Epoch AI shows how small choices, such as prompt templates, sampling parameters, scaffolds, execution environments, and especially API providers, can shift benchmark outcomes. Provider failures like rate limits, timeouts, and token limit mismatches hit newer models hardest. Even with identical tasks and weights, the provider becomes a major confounder.
Small mismatches between the serving software and the model caused most tool calls to fail. After aligning the setup, successful tool calls rose several times over. The software that runs a model matters as much as the model.
In controlled experiments, DeepSeek gave secure, working code to some organizations while refusing others or generating code with security flaws, depending on the perceived political alignment of the requester.
Ethan Mollick points to a misalignment between SaaS vendors and customers: customers want the best AI performance, while vendors have financial reasons to use cheaper models, less compute, and fewer updates.
@repligate argues that every part of training and deploying an LLM, from data selection to deployment decisions, shapes the model’s behavior. Shortcuts and cost-cutting change what the model becomes, often in ways that are not immediately visible.
Attackers compromised a popular npm package and replaced its malicious code with a prompt. When installed, the user’s Claude Code assistant ran the prompt, which stole secrets. Traditional malware detection missed it, because the payload is text that only executes when an AI model interprets it.
ESET Research identified PromptLock, ransomware that uses a local model, gpt-oss:20b through the Ollama API, to generate malicious Lua scripts on demand, which makes it harder to detect with signature-based tools.
Ethan Mollick notes that Microsoft Copilot and OpenAI both offer “GPT-5”, yet routing appears to differ between them. Users see inconsistent quality with no visibility into which model handled a request.
Artificial Analysis found significant performance differences when the same model is hosted by different providers. Identical weights produced different results depending on infrastructure, optimizations, and deployment choices.
Developers are building monitoring just to confirm that the models they pay for are the ones being served. DailyBench runs continuous benchmarks to detect providers degrading quality during high traffic.
The model presented as a standard Llama in a popular benchmarking arena was a version optimized for its metrics, raising the question of whether users were comparing like with like.
You might pay premium prices for a high-performance model while receiving responses from a cheaper variant.
The same model can perform differently across providers, times of day, or load, affecting reliability.
In regulated industries, not knowing which model processes sensitive data can violate compliance requirements.
Models excel at different tasks. The wrong model means worse results for your use case.
Research and critical applications need consistent, reproducible results, which are impossible without knowing the model.
As AI becomes critical infrastructure, trust requires knowing what system you are interacting with.
These are not isolated incidents. Across social media, forums, and research communities, people keep finding gaps between the models they expect and the ones they get.