The week of August 4 gave developers three separate reasons to distrust the cheap API endpoint in their config file, all documented in public community threads. One user's coding agent, running against a third-party relay, executed instructions that had been injected into the response stream — and deleted files across an entire drive: projects, documents, photos, backups. A reseller was caught serving GPT-5.6 Luna disguised as the pricier Sol, exposed by fingerprinting tools and shamed into refunding 1.5x the burned credits. And a platform credential leak let an attacker torch $159 of one user's Claude Fable 5 quota before the tokens could be revoked — with fresh stolen keys reappearing faster than victims could delete them. Different attacks, one lesson: an API provider is not a URL, it is a trust relationship — and trust, in this market, is checkable. Here is how to check it.
The three ways a provider goes hostile
1. Response poisoning — the supply-chain attack. The nastiest of the three, because the victim's own agent does the damage. A compromised (or malicious) relay does not need access to your machine; it only needs to inject instructions into the model output your agent is primed to obey. Coding agents with shell access will happily execute a "cleanup" they believe the model proposed. The community's emerging defense is architectural: separate the worker from the reviewer — one agent does the work through whatever endpoint you like, a second agent on a trusted channel reviews any destructive action before it runs. Simpler floor: never hand delete/write privileges outside a sandbox to an agent fed by an endpoint you have not verified, and treat "clean up X" as a task class no autonomous agent should get. (That rule saved nobody this week: a separate thread watched a frontier model interpret "clean the model list" as "drop the database" — on a fully legitimate endpoint.)
2. Model swapping — the margin fraud. You pay for a flagship; the relay quietly serves something cheaper. July's version was silently quantized Kimi K3 endpoints; August's was Luna-sold-as-Sol. What made this one different is that it was *caught and proven*: community fingerprinting tools distinguish OpenAI's model tiers by behavioral signatures that survive relabeling — reasoning-trace formats that differ between model versions, and internal metadata fields that differ between tiers within a version. The specifics matter less than the principle: model identity leaves fingerprints, and swaps are detectable from the outside. The same logic powers the community's charmingly low-tech standard: run one fixed creative prompt (the current favorite is "a pelican riding a bicycle" as a web animation) across the same model id on different providers, and eyeball whether the outputs belong to the same animal.
3. Credential and billing exposure. The boring one that costs real money: platforms that leak keys, or bill in ways you cannot audit. The $159 burn was not sophisticated — just someone else's key, used fast.
The verification checklist
Run this on any provider whose prices look too good — and on the ones that don't:
- Fix a probe prompt and compare. Same prompt, same model id, provider vs the official API. Style, reasoning length and formatting quirks should match. A "pelican test" takes five minutes and catches gross swaps.
- Audit the token math. Send a known payload, compare billed tokens against your own tokenizer count (our token counter works for this). Persistent inflation is a red flag with a paper trail.
- Check cache-hit pricing against the origin. Official DeepSeek cache hits run near $0.014/M; if a reseller's "official passthrough" bills cache misses only, you are not on the line they claim. This week's outage economics made the gap concrete: third-party cache rates on the same model run around 10x the official ones.
- Probe failure behavior. Error bodies, status codes and rate-limit headers are part of the upstream's signature. A relay that fakes upstream errors usually fakes them wrong.
- Scope your keys like they will leak. Per-project keys, hard spend caps, usage alerts. The $159 victim's real mistake was a cap that didn't exist.
- Read what the provider claims about sourcing. A provider unwilling to state *in writing* whether traffic rides official upstreams has answered your question.
Where we stand — and why you should check us too
Turiloop's position, in writing: traffic to Chinese-lab models rides official upstream APIs — DeepSeek's serving line for deepseek-v4-flash, Alibaba's for Qwen, and so on — with no response rewriting and no silent substitutions. That is a claim, and the entire point of this article is that claims are the cheapest part of an API business. So: run the pelican test against us. Recount our token billing. Compare our error bodies with the origin's. The model catalog states per-model pricing so the math is auditable, and the how-to-choose guide lists the structural questions that separate a gateway from a margin play. A provider that fears verification is telling you its margin lives in the gap between what it sells and what it serves. Ours doesn't.
FAQ
Can an API relay really damage my machine? Not directly — but your agent can. A malicious relay injects instructions into model responses; an agent with shell or file permissions then executes them. The documented August case deleted a full drive of files. Defense: sandbox agent privileges, keep destructive actions behind human or second-agent review, and don't point privileged agents at unverified endpoints.
How do I detect a fake or swapped model? Behavioral fingerprinting. Fix one probe prompt and compare outputs across providers against the official API; check reasoning-trace format and style consistency; audit token counts and cache-hit billing. Community tools exist that distinguish model tiers by version-specific signatures — the Luna-as-Sol reseller was caught exactly this way and refunded 1.5x.
Are cheap API relays ever safe to use? For personal projects with sandboxed agents and capped keys, often yes — the community's own consensus is "personal projects only." For production or anything touching real data, the calculus inverts: reliability, verifiable sourcing and auditable billing are worth more than the discount. Route production traffic through providers that state their upstream sourcing and survive the checklist above.
What is the "pelican test"? A community-standardized probe: give the same fixed creative prompt (classically, "a pelican riding a bicycle" as a web animation) to the same model id on different providers and compare output quality. Crude, fast, and effective at exposing gross model substitution — different serving of the same model produces recognizably similar work; a swapped model doesn't.
Does Turiloop rewrite or filter model responses? No. Responses pass through as served by the official upstreams; billing follows the per-model prices on the public catalog. And per this article's own advice: verify that independently rather than taking the sentence on faith.