AI Model Routing Boom Moves Frontier Safety Into the Middle Layer

The middle of the AI stack is now worth billions

For most of the generative AI boom, the frontier labs set the terms. Companies picked a model, wrote code against its API, and inherited whatever safety work that lab had done. That setup is coming apart. Businesses looking for cheaper and more private ways to use AI are moving to routing, where software sends each query to whichever model suits it best at the lowest cost.1

The clearest evidence is Stripe's agreement to buy OpenRouter for slightly more than $8 billion, according to a person familiar with the matter who spoke to Reuters.17 OpenRouter had raised money in May at a valuation of about $1.3 billion.13 It now says it handles more than 10 trillion tokens a day across more than 400 models for over 10 million developers and companies.19 Others are building routers too. Meta is reportedly working on a rival called Switchboard.1 Ramp launched its own router on the same day Stripe announced its deal.19 Snowflake announced dynamic model routing for its Cortex AI Gateway on August 18.22

Most coverage treats this as a story about margins. Axios says routing turns models from destinations into interchangeable commodities, which could squeeze frontier margins.1 Semafor says Stripe can accept a low-margin router because it can make money on everything around it, including billing, tax, fraud and settlement.13 Both readings hold up. The bigger story for safety and evaluation is less discussed: routing moves the place where safety decisions get made.

What the reporting agrees on, and where it splits

The outlets agree on the main facts. They agree on the price of more than $8 billion, that Stripe and OpenRouter worked together before the deal, and that OpenRouter makes money from a 5.5% fee on credit purchases rather than marking up tokens.151922 Everyone also links the boom to cost. Axios notes that average token prices have fallen sharply since a peak in mid-May, as frontier labs cut prices to win back share.1

The details are less consistent. Forbes stresses that early reports described a signed agreement, not a completed deal, and that the price could still change.15 Some trade outlets wrote as if the deal had already closed. One aggregator dated the announcement to September 19, a month after other coverage.1417 One crypto outlet gave the price as $80 billion, which looks like a typo given that its own text says $8 billion.21 The traffic numbers also vary. CNBC, as cited by Forbes, reported that Chinese-origin models have stayed above 30% of US token volume on OpenRouter every week since early February, peaking near 46%.15 Another account says open-weight models made up about 60% of OpenRouter's US-originating tokens in August, mostly from Chinese models.14 Those figures measure different things, but they point the same way. Axios reports that OpenRouter's five most-used models are all open-weight or open-source, and that Anthropic has no model in the top ten.1

That point matters most for safety.

When the cheapest adequate model is also the least guarded

A router does what it is told: find the cheapest model that clears a quality bar for cost, speed and reliability.13 Many of the models that win on those terms come with much weaker safeguards than closed frontier systems.

SaferAI's assessment of Z.ai's open-weight GLM-5.2 shows the gap. Working through Z.ai's public API, the nonprofit found the model refused none of the offensive cyber or biology tasks it was given. Claude Opus 4.7 refused so consistently that SaferAI could not finish one cyber benchmark on it. SaferAI also said Z.ai published no safety framework, no pre-deployment testing commitments and no risk assessment for the model. Its executive director put the problem simply: the frontier of capability is not the frontier of risk, and mitigations have to be part of any risk assessment.

Other research shows how fragile open-model safeguards are. The TamperBench study tested 21 open-weight models and broke every model's safety mechanism with at least one tampering method. The authors also found that defenses designed to resist tampering largely failed under systematic stress testing.27 Testing by the Financial Times and the research group Alice found that a free tool could strip the safety alignment from Meta's Llama 3.3 in under ten minutes on a standard laptop.25 Cisco researchers found that multi-turn jailbreaks succeeded against eight open-weight models at rates of up to 92.78%, two to ten times the single-turn rates.31

None of this proves that routed traffic is mostly harmful. Most of it is ordinary business work. But it does change a key assumption. A frontier lab's refusal policy only protects people if the request actually reaches that lab's model.

Refusal as a failover signal

One detail in OpenRouter's documentation shows the problem clearly. The company says its system can move a request to another provider or model when it hits outages, rate limits, context-length errors or moderation refusals.22 For reliability, that makes sense. For safety, it means a refusal from one model can become a trigger to try another.

A more charitable reading is also available. OpenRouter lets customers limit requests to zero-data-retention endpoints, block providers that train on prompts, and require processing inside the US or EU.22 Those controls show that a router can enforce policy as well as get around it. The open question is which way the defaults lean, and who sets them. Axios notes that companies can set their own router priorities, including which providers they trust with their data.1 It is not clear from the coverage whether refusal behavior or safety posture is a standard selection criterion alongside price and latency.

The frontier labs are running into the same issue from the other side. One industry roundup describes September cyber-capable releases as a single set of weights sold as two products, with classifier-driven routing and refusal-fallback systems built into how the models are served.4 In other words, the labs already use routing as a safety control inside their own products. A neutral third-party router sitting above them can work with that design or work around it.

Evaluations have to follow the traffic

Model cards and frontier evaluations were built for a world where the model was the product. In a routed stack, the thing that actually runs is a portfolio of models plus a policy for choosing among them. Practitioner guidance already reflects this. One forecast tells teams to run their own evaluations on their own data as soon as a new model launches, because those results decide routing weeks before public leaderboards settle.5 Another notes that rate limits, regional restrictions and safety routing add unpredictability, and that every path to a frontier model needs a tested fallback.8 Microsoft's architecture guidance, cited in coverage of the deal, warns that dynamic model selection makes cost forecasting, debugging and performance analysis harder.22 The same is true of safety auditing.

Some open-weight developers are adjusting how they evaluate. Thinking Machines Lab framed its Inkling release around marginal risk: whether publishing the weights would add material danger beyond what downloadable models already pose. It backed that with internal tests, four external testers and adversarial fine-tuning designed to remove refusals.23 That kind of baseline thinking fits a routed world. But it still evaluates one model in isolation, not the system that decides when that model gets called.

My reading is that routing turns evaluation from a property of each model into a property of the whole system. The meaningful safety question is what a router does with a dangerous request across its entire catalog, not whether one model refuses. Few public evaluations measure that today.

The observation point nobody planned for

Stripe's purchase has a less obvious safety side. Forbes argues that if the deal closes and OpenRouter stays neutral, Stripe will own one of the broadest independent views of multi-model AI usage ever assembled.15 It also notes that OpenRouter's own research shows heavy creative and roleplay use alongside production traffic, so the data is a sample, not a full picture.15 A company that sees which models handle which workloads, week by week, is in a better position than any single lab to spot cross-provider misuse. Nothing in the coverage suggests Stripe plans to use the data that way. Its stated focus is token efficiency and profitability.19

Neutrality cuts both ways. OpenRouter's founders say their mission, neutrality and market lead made a strong case for staying independent, and that the brand and model-neutral approach will continue.19 For safety, a router that is perfectly neutral treats a lab's guardrails as one more cost to optimize around.

What to watch

Nobody quoted in this coverage says routing will kill the frontier labs. Palantir's Akshay Krishnaswamy described the goal as having options, not dropping commercial models.1 Factory AI's Matan Grinberg argued that routers put lab models in front of more users and workloads.1 That seems right on the economics. The safety cost is easier to miss: as routing spreads, much of the alignment work frontier labs publish applies to a shrinking share of real queries.

Three things will show whether the industry deals with this. First, whether routers publish how they handle moderation refusals by default. Second, whether safety posture becomes a filter customers can select, like data retention already is. Third, whether evaluators start testing routed systems end to end rather than models one at a time. If none of that happens, the safety of AI products will increasingly depend on routing defaults that are set mainly for cost.