The list had no line for it
A nineteen-day discount that moved token volumes almost fourteenfold, a text-to-SQL model that beat every scaffold by being trained instead, and a safety classifier that approved the command and not the thing it reached.
How we Organise
What happened on OpenRouter when two models were discounted for nineteen days
Two models were discounted for nineteen days. Volume on one rose 13.8 times against its earlier average. An undiscounted model launched the same day moved 1.1.
We tell a client that a yearly budget cannot govern something whose unit price changes with every release. This is the cleanest support that has had. The price fell 90 per cent inside nineteen days and demand rose almost fourteenfold. A number set beforehand would have been wrong twice over. It is one platform’s routing data.
How we Build
A text-to-SQL model that reached human accuracy without a scaffold
The usual way to close the gap here is a scaffold of prompted stages around a model held still. The authors cleaned the training data and trained the model instead. One call to it beat every scaffolded system at a fraction of the cost.
Our position asks a team to pick between writing code, calling a model once, running an agent and orchestrating several, and to say on the record why the simpler thing fell short. All four hold the model still. What won here was one call to a model somebody had trained. The list has no line for it. Most clients have no training budget.
How we Assure
An attack that turns a coding agent’s own caution into the exploit
An agent refused to run a supplied binary and wrote its own decoder instead. That refusal was the exploit. The decoder loaded an attacker’s file from the archive it was reading, and the machine called out to a remote server several hops later.
We want a declared boundary around what an agent may execute, and somebody named on each way out. Both halves passed. The boundary was a safety classifier, every command carried it as approver, and nobody approved the outbound connection, because approval attaches to the command a reader sees rather than to what running it reaches. Small sample, one product, a motivated attacker.