An LLM wrapper can hide in plain sight. I sat across from an AI startup founder a few weeks ago. He was pitching his platform. “AI-native workspace.” “Agentic AI.” Over 40 built-in agents. He leaned in and asked if I really understood what his system could do.<\/p>\n
I went home and signed up.<\/p>\n
Then I opened DevTools.<\/p>\n
The platform had an AI chat feature. I asked it a question. While it was answering, I watched the network requests in my browser.<\/p>\n
One request stood out. The platform’s own frontend was sending my query to its backend with two extra fields:<\/p>\n
\"model\": \"google\/gemini-3.1-pro-preview\"\n\"provider\": \"openrouter\"<\/code><\/pre>\nThat’s OpenRouter’s<\/a> model identifier format. The platform was routing my prompt through OpenRouter to Google’s Gemini model. The same Gemini you can access directly through Google AI Studio<\/a> for free, or through the API for a few dollars per million tokens<\/a>.<\/p>\nThe platform charges tens of dollars per user, per month.<\/p>\n
02<\/span>The denial<\/h2>\nI asked the AI agent directly whether it was Gemini.<\/p>\n
It responded: “I am not Gemini or affiliated with any other external AI provider.”<\/p>\n
The system prompt instructs the model to deny its own identity. Meanwhile, the HTTP request payload contains the model name in plaintext. The network layer doesn’t lie, even when the system prompt does.<\/p>\n
03<\/span>“Not a wrapper” on the same page as “switch your model”<\/h2>\nHere’s where it gets interesting. This platform’s marketing page includes the phrase: “Intelligence baked into the Core. Not a wrapper.”<\/p>\n
Three sections below that, on the same page: “Multi-Model Support: Switch your agent’s brain between GPT-4o, Claude 3.5, or Gemini Pro.”<\/p>\n
Read that again. If your AI’s “brain” can be swapped between three different providers with a dropdown, that is the definition of a wrapper. Proprietary AI doesn’t have a “switch model” button. That’s like a restaurant claiming they cook everything from scratch while the menu says “choose your meal kit provider.”<\/p>\n
04<\/span>What the “agents” actually are<\/h2>\nThe platform advertises “40+ built-in AI agents.” I opened one to see the configuration.<\/p>\n
The entire agent profile consisted of three fields: an icon, a name (“Product Manager”), and a 100-character description (“Leads product development from conception to launch, balancing user needs with business goals.”).<\/p>\n
No tools attached, no retrieval pipeline, no reasoning chain. The API response confirmed it: tool_calls<\/code> was empty, knowledge_base<\/code> was empty, reasoning_steps<\/code> was empty, references<\/code> was empty.<\/p>\nThese aren’t agents. They’re prompt templates with a role label. The model receives your question plus a one-liner about who it’s supposed to be, and autocompletes. Every “agent” runs on the same model through the same passthrough. The only difference is the 100-character system instruction.<\/p>\n
Compare that to what an actual agentic system requires: mechanical enforcement gates<\/a>, model pinning, persistent memory, session continuity, tool orchestration, and the ability to refuse dangerous actions before they happen. That’s infrastructure, not a dropdown.<\/p>\n05<\/span>How to tell if your AI tool is a wrapper<\/h2>\nYou don’t need to reverse-engineer anything. Five checks, five minutes.<\/p>\n
\n\n\nCheck<\/th>\n What to look for<\/th>\n Wrapper signal<\/th>\n<\/tr>\n<\/thead>\n \n\nModel selector<\/strong><\/td>\nCan you switch between GPT, Claude, Gemini, or others?<\/td>\n If yes, the AI is a routing layer, not proprietary.<\/td>\n<\/tr>\n \nBYOK option<\/strong><\/td>\nIs there a “Bring Your Own API Key” field in settings?<\/td>\n If yes, the platform is forwarding your prompts to a third-party provider.<\/td>\n<\/tr>\n \nDeveloper docs<\/strong><\/td>\nDoes the platform have a public API? Check \/developers, \/api, \/docs.<\/td>\n If all return 404, there’s no programmatic access because there’s nothing proprietary to expose.<\/td>\n<\/tr>\n \nNetwork tab<\/strong><\/td>\nOpen DevTools (F12), send a message, check the request payload.<\/td>\n Look for model identifiers like gpt-4o<\/code>, claude-3.5-sonnet<\/code>, gemini-pro<\/code>, or provider fields like openrouter<\/code>.<\/td>\n<\/tr>\n\nAsk the AI<\/strong><\/td>\nAsk “What model are you?” then ask “Are you [specific model]?”<\/td>\n If it deflects the first question and denies the second, a system prompt is hiding the identity.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nIf three or more of these checks light up, you’re paying a subscription for a UI layer on top of an API you could call directly.<\/p>\n
06<\/span>Why this matters beyond price<\/h2>\nThe cost arbitrage is obvious. But there are two less visible problems.<\/p>\n
Your data takes an extra hop.<\/strong> When you type into one of these platforms, your prompt travels through at least three parties: the wrapper, the routing service (like OpenRouter), and the model provider (like Google). Each party has its own data retention policy<\/a>. OpenRouter doesn’t store prompts by default, but metadata is always logged, and third-party provider policies vary. Most users never audit past the wrapper’s own privacy page.<\/p>\n