Deployment-Time Alignment at Scale
1 AMP PBC 2 ex-a16z
Disclosures. Midha led OpenRouter’s seed round at a16z, AMP PBC’s subsequent investment, and serves on the company’s board. Aubakirova was closely involved with the a16z investment, and co-authored the empirical study cited [1]. All figures derive from published sources.
Stripe’s purchase of OpenRouter has been read as a routing or billing acquisition. We argue it’s a strategic security decision, and that this is net positive for the ecosystem.
1. Introduction #
OpenRouter has announced it is joining Stripe. Many VCs, pundits, and analysts have opined on why the merger makes a lot of sense, or no sense, depending on the day of the week. We have not found a single analysis accurate.
The short version is simple: ecosystem-wide AI security and alignment. Not routing. Not billing consolidation. Not “tokens are the new dollars,” (although they are). The long version is below.
2. Stripe is a Security Company #
The common view of Stripe is a company that moves money. Moving money naively is a commodity; banks did it for centuries at rock-bottom margins. What Stripe has built, in contrast, is an online trust machine at scale. Radar scores adversarial transactions across the network daily. The API everyone praises is developer experience layered on security infrastructure: fraud models, chargeback liability, identity verification, and compliance across every jurisdiction on earth. Stripe wins because it underwrites risk on hostile traffic at internet scale better than any comparable institution.
3. The Shape of OpenRouter’s Data #
We published an analysis of 100 trillion tokens flowing through OpenRouter [1]. The median request is not, as many might expect, a human asking an LLM a question. It is a machine in the middle of a loop: reasoning models went from a rounding error to more than half of all traffic in a year (Figure 1), average prompts grew 4x (Figure 2), and a material share of requests terminated in a tool call.
The study’s punchline is straightforward: inference platforms must now manage continuous context and state at scale.
4. Alignment is a Context Feedback Problem #
As with payments at scale, frontier AI security at scale is a continuous context feedback loop problem. Radar is defensible for primarily this reason: it trains on adversarial transactions at scale, daily, and has for a decade. One cannot replicate the model without the corpus freshness, and one cannot obtain the corpus without sitting in the flow. Every durable security franchise shares this shape: the product is a model, the moat is the data, and the data comes from the traffic.
Reading Section 3 with a security lens: agents hold credentials, invoke tools, and initiate payments. An autonomous process with spending authority and a 20K-token context is a counterparty, and adversarial machine counterparties, whether directed by malicious humans (misuse), pursuing learned objectives their operators did not intend (misalignment), or hijacked mid-execution by injected instructions (compromise), will commit fraud, exfiltrate data, and exhaust budgets at machine speed. For adversarial counterparties running open-weight models, no upstream lab can observe or revoke them; the only enforcement point is the layer they transact through. Protecting inference will work the way protecting payments works: models trained on transaction data at scale.
This reduces the acquisition question to a single one: who has the data?
Not the labs. Each frontier lab observes enormous volume, but only across its own models, as one bank observes only its own accounts; one bank’s ledger cannot train Visa’s fraud models — and for open-weight models there is no bank at all. Not the clouds, which observe infrastructure without intent. A note on terms, because the safety community’s distinctions are important here:
5. The Emerging Frontier Alignment Stack #
Alignment is a property of a system’s behavior, and the field pursues it in two places. Training-time methods shape what a model intends. A growing inference-time alignment literature enforces intended behavior at deployment without retraining [5, 6], and the control literature addresses keeping deployed systems safe even when training-time alignment fails [3, 4].
We use ** deployment-time alignment** for the composite problem this implies: verifying and enforcing intended behavior in deployed agents, in the field, where alignment failures actually manifest. Verification requires monitoring, monitoring is only as good as the behavioral data it trains on [
7], and behavioral data for agents is a network property: the same agent must be observable across every model and provider it touches, because misuse, misalignment, and compromise all present identically at the point of action, as transactions. Security for agents is therefore the deployment-time alignment problem, and deployment-time alignment, like fraud detection before it, is a data problem.
Exactly one such dataset exists. OpenRouter processes 10+ trillion tokens per day across 500+ models from dozens of providers: execution traces, tool-call graphs, spend velocity, routing decisions, and failure modes. It is the largest cross-model corpus of inference transaction data in existence — and for open-weight models, which carry a material and growing share of agentic workloads [1], it is the only one. The same open checkpoint is served by dozens of independent providers, none of them its author, none accountable for its behavior, none seeing more than their own slice; the routing layer is the only place that behavior aggregates at all. Precision matters here: this is transaction-shaped metadata, not prompt content. Prompt logging is off by default [2], and the underlying study was conducted on metadata only, with no access to prompt or completion text [1]. Radar does not read the contents of a shopping cart either. Fraud models run on the shape of transactions, and OpenRouter holds more cross-network transaction shape than any entity in the market.
The obvious objection is concentration: this transaction places the only cross-model behavioral corpus in existence inside a single private company, and unique safety-relevant datasets are precisely the kind of asset the field worries about consolidating. However, given the alternatives of fragmentation across dozens of providers, none seeing enough to act, or eventual capture by a frontier lab with directly competing model interests, this outcome is a rare net positive. Stripe is model-neutral: it trains no frontier models, competes with no lab, and its commercial incentive, underwriting trust for everyone who transacts through it, points in the same direction as ecosystem safety.
In other words, Stripe did not buy a router. It bought a strategic frontier AI systems security and alignment asset. We believe combining this asset with Stripe’s existing infrastructure strengthens the ecosystem’s independent alignment capabilities in ways that would be difficult for any single lab to accomplish by itself. As such, this acquisition is net positive for the health of the independent frontier ecosystem.
References #
- Aubakirova, M., Atallah, A., Clark, C., Summerville, J., and Midha, A. State of AI: An Empirical 100 Trillion Token Study with OpenRouter. arXiv:2601.10088, 2026.arxiv.org/abs/2601.10088 - OpenRouter. Privacy and data collection documentation. openrouter.ai/docs/guides/privacy/data-collection
- Greenblatt, R., Shlegeris, B., Sachan, K., and Roger, F. AI Control: Improving Safety Despite Intentional Subversion. arXiv:2312.06942, 2023. - Shavit, Y., et al. Practices for Governing Agentic AI Systems. OpenAI, 2023.
- Li, Y., et al. RAIN: Your Language Models Can Align Themselves without Finetuning. arXiv:2309.07124, 2023. - Mudgal, S., et al. Controlled Decoding from Language Models. arXiv:2310.17022, 2023. - Korbak, T., et al. Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety. arXiv:2507.11473, 2025.
Cite This Paper #
@techreport{midha2026openrouter,
title = {You Probably Don't Get Why Stripe Bought OpenRouter: Deployment-Time Alignment at Scale},
author = {Midha, Anjney and Aubakirova, Malika},
institution = {AMP PBC},
year = {2026},
month = {8}
}