The Label on the Tin
Your AI assistant can quietly hand the job to another company's model. The terms say who answers for the data and the mistakes. Mostly, it's you.
Your AI assistant can quietly hand the job to another company's model. The terms say who answers for the data and the mistakes. Mostly, it's you.
My mum kept buttons in a Milo tin. Western Sydney in the 1990s, every house had one. You'd open it hoping for a spoonful of chocolate malt and get a rattle of shirt buttons and a safety pin. Nobody was lying to you, exactly. The tin was just doing a different job from the one on the label.
I thought about that tin last week, sitting in Surry Hills, feeling quite clever. I'd asked my AI assistant to sort a messy spreadsheet, write the notes and draft a picture, and it did all three before my coffee went cold. I took the credit, the way I always do. Then I read the fine print and found out I didn't know who'd actually done the work. Not me, obviously. But not necessarily the company on the app either.
On 7 October, Elon Musk posted this about Grok Bot, an AI agent app: "Going forward, @SpaceX will use the best back end model for any given task, including Claude Opus 5.5, MidJourney, Suno and other leading APIs. Whatever is most likely to give you the best outcome."
Claude Opus 5.5 is made by Anthropic. Midjourney makes images. Suno makes music. None of them is the brand on the front. The post is in the future tense and doesn't say which jobs go where, so I'll treat Midjourney and Suno as a stated plan, not a fact about today.
The product's own help page is plainer. It says Grok Bot "is not tied to a single model" and that the choice "can differ from one request to the next". Can you see which model handled your request? "No." Can you choose or block one? "No." Your usage and spending views record it all as Grok Bot usage, "not by provider or model name". Which outside companies can get your work? "Only providers on the sub-processor list", which the page calls "the authoritative reference for which providers may process your data."
To be fair to it, that's more honest than most. It tells you the tin is shared. It also answers the cost question directly: routing a task to Opus 5.5 "doesn't change what it costs you per token."
Here's the boring bit I enjoyed most. The product's security page lives in two places. The copy on the main docs site agrees with the help page. The copy on the developer docs site, on the morning I read it, said something different: "Usage analytics show the model that served each request, including failovers, and billing follows the serving model." So one official page says you can't see the engine, and another says you can. I'm not accusing anyone of anything. Products move faster than their paperwork, and one copy is probably just behind. But if the product's own pages don't agree on whether you can see the engine, I'm not going to pretend I know.
This isn't a story about one app. Anthropic does a version of it inside its own house. Its post on Claude Code Projects describes a coordinator that "delegates the work, coordinates parallel threads", where "each thread is a Claude Code cloud session". Its launch post for Claude Haiku 5.5 says the small model "pairs well with Opus 5.5 and Sonnet 5.5 as a subagent on coding work." Its help centre even describes a built-in setting that plans with Opus and executes with Sonnet.
So one job can be done by two or three models now, and that's normal. The difference is the dial. Anthropic says you can "select the model and effort levels used by the coordinator chat as well as the worker threads," and its help page calls the model command "the source of truth for your account." The engines are all from one maker, you can pick them, and you can look under the bonnet. It isn't total, mind. Anthropic's own Opus 5.5 launch post says most cybersecurity tasks "will be re-routed to Opus 4.8" as a safety measure. Even the careful shops swap engines sometimes.
Developers have their own version. I keep reading people who run two coding agents, or two editors, and switch when one hits its usage limit. That's a habit I've seen described, not something I've counted, so take it as colour. The point is that plenty of people already run several engines under one workday without thinking much about it.
And the money is moving with them. Pieter Levels, the indie builder, posted in July that he'd cancelled his software subscriptions and built replacements with AI. What he still pays for, in his words: "domains, server hosting and storage and AI APIs." The subscription with the nice logo goes. The bill for the engine stays.
Getting something from this? The List sends the next essay first, free, Sunday mornings.
So when the label on the tin isn't the engine, who answers for what's inside? I went to the terms, because the terms are where the boring truth lives.
The data. The help page says it can only go to listed sub-processors. The security page says Privacy Mode means your data isn't used for training, and that model providers don't keep prompts or outputs under existing agreements, though they "may run abuse and safety classifiers, and flagged data may be stored for investigation." If your contract limits sub-processors, it tells you to talk to your account team. That's the job of a grown-up: read the list.
The mistakes. The Grok Bot Terms say agentic actions "are probabilistic, may contain errors," and that the customer "is solely responsible for all agentic actions taken by Grok Bot, whether or not such actions were intended." Approval tools are "aids only."
The bill. The same terms make the customer "solely responsible for charges, commitments, communications, and other consequences" of those actions. And the documentation "does not create a service level, warranty, or commitment that any feature, integration, model, or configuration will remain available."
So the engine can change, the documents say it can change, and the person holding the tin answers for most of what comes out of it. The terms keep a narrow carve-out for the provider's gross negligence or wilful misconduct, but the gist is plain enough: you signed it, mate.
I'm not a lawyer, so here's one comparison, and only because it clarifies the point. In Australia, under the Privacy Act, a business covered by the Act that sends someone's personal information to an overseas recipient is generally "accountable for any acts or practices of the overseas recipient" that would breach the privacy principles, even a subcontractor's, subject to exceptions. Put simply, the name on the front answers for the back room.
American readers will have their own rules and their own contracts. My point isn't the law. It's the habit. When you put your name on a job and quietly pass it down the line, the person who trusted you is still trusting you.
There's a type online who'll sell you a course on "their" AI workflow. Prompt, paste, profit, and a screenshot of a dashboard. Plenty of them couldn't tell you which company's model wrote their last post, and the help pages say they mightn't be able to find out. Taking the credit for a machine you can't even name is a strange thing to be proud of. I should know. I've done it.
My spreadsheet was fine, by the way. Better than fine. But it would be a bit rich to call myself clever when I don't know whose brain I borrowed.
Three questions, before you hand an assistant anything that matters. Can I see which model did this? Who is on the sub-processor list? And what do the terms say I'm responsible for?
If the answers are "no", "a list" and "everything", that's not a scandal. It's the deal. Just read the tin before you put it in the pantry.
If this was useful, leave a tip.
New essays by email: ricoholt.com/list
Rico Holt · ricoholt.com
If this was worth your time, you can leave a tip. Rico Holt runs on readers, not big tech or big media money, and the essays stay free.
Leave a tip · A$5Get the next essay and the book launch price first.
Privacy: your email gets used for one thing, sending you Rico Holt essays and book news. It's stored with Netlify, our form host. Never sold, never shared. Want off? Reply to any email and you're gone.