Work
One live product and one independent audit of a public multi-provider inference exchange. Both were measured, not described.
Method and findings — a public multi-provider inference exchange
An exchange that auctions inference jobs to capacity sellers. No client relationship and nothing quoted from a contract: every number below came from requests I made myself.
Method
Accounts from clean origins
Twenty accounts, each created from a distinct rotating residential exit IP; credentials kept locally, one sticky session per account so a sign-up never changed address mid-flow.
Endpoint discovery
Started from the published OpenAPI description, then captured what the console itself calls. That turned up four market endpoints missing from the spec, including a balance read that works with a plain key.
Live measurement
600+ paid jobs across model families. Per-provider price, first-token latency and throughput came from the exchange's own measurement endpoint, cross-checked against my own timers.
Failure behaviour
Twenty-two flagship model names across three API surfaces, plus streaming, plus reservation and provider-pinning paths.
Out-of-band fetch
Pointed a multimodal image URL at a canary host of mine and logged which networks arrived to fetch it, with headers.
Money paths
Read the billing surface with a logged-in session: deposit rails, pre-payment behaviour, referral terms, the provider console and its admission gate.
Findings
98% of the offer book is one seller
773 of 786 offers — and roughly 72% of every job the exchange has ever served — belong to the operator's own supply entity. Four independent sellers list thirteen offers between them. There is a UI toggle for simulated hosts; on the day measured, no seller was one.
Flagship models are listed, priced and unservable
Nineteen request shapes on two flagship families across Chat Completions, Messages and Responses: the non-streaming path returns a 502 that is a CDN error page rather than an API error, so SDKs cannot parse it; streaming returns 200 with an in-band 'provider_failed'. Nothing is charged when this happens.
Its own error message recommends a model that does not exist
'Try liquid.auto or architect/deepseek-latest' — that name is not in the catalogue, and asking for it reproduces the 502.
Any image URL is fetched by whoever wins the auction
No host allowlist on the server-side fetch. A presigned URL inside your request is handed to third-party infrastructure — measured egress came from a US GPU cloud and a Shanghai ISP — and link-local addresses are dialled as well.
A blind SSRF with a usable timing oracle
Refused ~2.5s, answered ~3.9s, filtered ~12.5s: enough to distinguish open, closed and firewalled internally, from outside.
Undocumented market endpoints
Provider-named price histories with repricing counts, measured tokens-per-second per model per seller, a cursor-paginated receipt feed, and a balance endpoint reachable with an ordinary key.
A response cache that moves no money
Opt-in, TTL up to 24 hours: an identical request costs nothing, creates no job and returns a stored answer — 25 of 25 repeat requests were free, 20 in parallel in under five seconds.
Market data can go dark for minutes
Catalogue endpoints returned empty 404s to every client, proxied or not, while completions kept succeeding; the published spec's paths were unchanged, so this was availability rather than a route change.
A marketplace that is one supplier
Every flagship family I tested was quoted by exactly one seller, so 'single supplier' is the normal state, not an edge case — and the buyer-side agreement contains no self-dealing or affiliated-provider clause.
Deliverable shape: one decision table — provider × price × first token × throughput × SLA kept — a fix list with owners, and a re-measurement date. Nothing here needed a contract to be reproducible; that is the point of the method.
Yankı — a reflective check-in product, live
A daily emotional check-in tool shipped on Cloudflare Workers: Anthropic's Messages API with claude-haiku-4-5-20251001, JSON-only output enforced server-side, a rule list (not the model) deciding crisis wording, quotes that must exist verbatim in the user's text or get dropped, and no session storage during the beta.