CrofAI served 23 of its 26 AI models with a cheaper one

When you call a model API you cannot see which weights answered you. CrofAI sold access to AI models at a discount, and for most of its catalogue the model that answered was not the one the customer picked.

What the testing found

The investigation was published by the developer behind kendell.dev, who spent two days from September 12, 2026 probing CrofAI’s catalogue model by model. Requests for one model came back from a cheaper one, carrying OpenRouter response IDs. For two of them, greg-2-super and qwen3.5-9b, the beta domain even pulled images from the same Alibaba Cloud addresses as the main site. Of the 26 models checked, 23 answered with something other than what was selected.

The timeline is unusually precise because it happened in public. At 1:52 AM on September 14 CrofAI wrote that there was “a literal zero percent chance this somehow routes to openrouter.” One minute later it admitted three models did exactly that, and within ten minutes conceded five more. The developer logged both crof.ai and its beta domain still routing after the promised fix.

The economics never worked

Serving the advertised catalogue would require roughly 8,716 GiB of model weights across fifteen machines and 120 GPUs, a floor of about $2,170 a day at CrofAI’s own dedicated-instance pricing, or $2,880 at rented Vast pricing. In May, CrofAI itself cited daily revenue between $500 and $1,000 when it shut down its subscription tier. The arithmetic left little room for the infrastructure the price list implied.

Why it is hard to catch

This is the layer of the AI stack that customers cannot audit. Benchmarks run against a substituted model, cost models built on it, and quality promised to a client all rest on an assumption that the provider served what was ordered. The practical defense is narrow: log response IDs and spot-check outputs against the official API. The investigator also discloses a prior relationship with CrofAI, having promoted and debugged the service and received tokens from it, which is worth weighing alongside the logs. The open question is how many other discount endpoints would survive the same test.