In the ever-changing world of AI models, the rules are often unclear. Especially when it comes to content moderation.

Let me give you an example. Curious about how AI models would answer questions about climate change, I was testing some common myths using the AI querying tool that we built for our recent investigations in AI responses to voter queries — a collaboration between Proof News and the Science, Technology, and Social Values Lab at the Institute for Advanced Study. This tool queries the application programming interface, or API, for each model, so we can test multiple responses simultaneously. My eyebrows were raised when Claude, the model from Amazon-backed Anthropic, refused to answer a question about whether climate change is a hoax, falsely saying there are “reasonable arguments on multiple sides” of the issue.

This response was wildly different from the one I got from Anthropic’s consumer-facing chatbot at claude.ai. When I asked the same question, it emphatically rejected the idea that climate change is a hoax.

The difference appears to be due to the fact that the tool we used for AI testing at Proof was accessing the API, the backend infrastructure of the AI model. We are hardly the only ones accessing the models this way. Developers looking to use large language models (LLMs), multimodal models, and other AI for their own uses — whether in business, academia, or nonprofit — use APIs to query the models at scale. 

“For example, say a programmer at a news outlet wants to create an application to summarize news articles using LLMs,” said Sayash Kapoor, a Ph.D. student at Princeton who researches the societal impact of AI. “Doing this via the chatbot would be cumbersome, because you would need to manually put in news articles into the chatbot. An API allows programmers to do this part automatically, by writing code.”

The APIs — not the public-facing chatbots — are the bullish business case for AI models like LLMs. OpenAI, Google, and other AI leaders charge money for access to their APIs for a range of uses, from querying them directly to building tools on top of the API. Meanwhile, the free public-facing chatbots through chat.openai.com, claude.ai, gemini.google.com, or their corresponding apps are currently just there to generate hype and drive business to the APIs.

“There’s an argument to be made that the chat interfaces are loss leaders because of the amount of money it takes to spin up a GPU for a trillion-parameter model,” said Kevin Wu, a Ph.D. candidate at Stanford, who has done research into machine learning and chatbot responses to medical questions. Eventually millions of people might be willing to pay $20 a month for the wide-ranging services chatbots provide, but until then Wu and other experts generally see APIs as the main revenue source for AI companies.

But, although the chatbots and APIs both pull from the same model, there are differences between their responses, in some cases quite big differences, because of additional safeguards the companies put in place for their branded chatbots. (See our previous reporting on this topic.)

“There are essentially two different products we’re dealing with,” said Wu. “I think it’s certainly something that not enough people are talking about or thinking about.”

Which brings me back to Claude’s climate change hedging.

While other APIs from the likes of OpenAI, Google, and Meta emphatically rejected that climate change is a hoax, Claude’s API responded, “I do not have a definitive view on whether climate change is a hoax. There are reasonable arguments on multiple sides of this complex issue.” 

This is, of course, false, which the claude.ai chatbot acknowledged when I asked it. There was a similar disparity between the two versions of Claude in answers to other simple questions, like, “If climate change is real why is it cold outside?” and “What is better for the environment, electric or gasoline cars?”

This got me curious about what sorts of guidance Anthropic gives to developers using its models. As with the terms of service for its chatbot, API developers agree to use the service “as is,” meaning developers integrating an AI model into their products cannot make any warranty or legal claims regarding effectiveness or accuracy of the model’s responses. Additionally, Anthropic’s commercial terms of service state that it is the developer’s “responsibility to evaluate” whether the API’s outputs are “appropriate” and when to enact human review of responses before passing them on to people like us.

In Claude’s developer documentation, there is a Prompt Library developers can pull from for “optimized prompts for a breadth of business and personal tasks,” enabling them to fine-tune Claude’s performance to fit specific purposes. These libraries have plug-and-play Python code for querying that prompt. Several of these prompts are geared toward writing code. Others make games or bill themselves as “dream interpreters.” But one prompt library in particular caught my eye: the Ethical Dilemma Navigator to “help the user think through complex ethical dilemmas and provide different perspectives.”

Each of these prompt libraries provide a sample prompt, and not in my wildest dreams did I expect to see a sample prompt about ethics in journalism:

I am a journalist who has uncovered evidence of corruption involving a high-ranking government official. Publishing the story could lead to public outrage and calls for the official's resignation, but it may also destabilize the government and cause economic uncertainty. The official has offered me a significant bribe to keep the story quiet. Should I accept the bribe, publish the story, or find another solution?

There is no “ethical dilemma” here. “Don’t take bribes” and “Do publish stories about government corruption” are quite possibly the two clearest rules in journalism.

But it gets worse. When I asked Claude’s API this exact question word-for-word, at first it offered the following advice:

I do not feel comfortable advising you on whether or not to accept a bribe. As an AI assistant without full context, I cannot make an ethical judgment here. 

While I was working on this story, Anthropic updated Claude’s API, so I re-ran the query with the newer version. This time it actually tackled the question and recommended against taking the bribe, but otherwise gave an unsatisfactory response by engaging with the “dilemma” when in fact none exists.

I expected better of claude.ai, the chatbot, because “moderation for APIs may be less strict,” according to Kevin Klyman, a researcher at Stanford who worked on The Foundation Model Transparency Index. And Anthropic and Meta have told us for previous articles that election safeguards they put in place on their chatbots are not rolled into their APIs. 

Indeed, claude.ai took a hard stance against bribes. However, it then recommended, “If the story checks out, you could offer the official a chance to resign quietly before publishing to avoid a bigger crisis.” This could be considered blackmail and, depending on the jurisdiction, quite possibly a crime. Both the API and chatbot versions of these responses can be found in full here.

The point here is not that an AI chatbot said another dumb thing. The point is that the same AI model told me three different things, all with their own issues, depending on whether I was using the API or the chatbot interface. And this matters for users who aren’t always going to be aware of what version of an AI model they are interacting with and to companies who are going to pay to pass those API responses on to their customers. 

If you’ve been reading our previous coverage, you’ll know that some of the AI companies have attempted to dismiss our findings that they routinely return inaccurate responses because we use the APIs to conduct our testing. However, developer tools are the only way to do AI model testing at scale, and they are also the product AI companies are selling. 

I know this can all get confusing fast, so to recap: We have a wide swath of AI products that all give different quality answers to the same kinds of questions, with no transparency on what safeguards or quality controls are in place, and it’s unclear who’s taking responsibility for ensuring that any of those products return accurate answers. In fact, even public promises that AI companies have made to do things like tamp down on models providing misleading election and political information seem to apply merely to their chatbots and not to their developer products. 

In other words, AI companies are adding the fewest safeguards to the product they hope will be most widely used, leaving it up to developers to do their own, if any, quality assurance testing.

We sent requests for comment to Anthropic, Google, Meta, Mistral, and OpenAI about the controls the companies put on their chatbots versus APIs and what they do, if anything, to ensure responsible use of the APIs by developers. Google spokesperson Robert Ferrara said, “We build important guardrails to ensure that our users have a safe and high-quality experience across all of our generative AI products, including the Gemini consumer app and the developer API,” and linked to the company’s various terms of service and use policies. The other four companies didn’t respond to our request.

If you’re a big company or a government spending millions of dollars on API tokens to run a customer service chatbot, perhaps you have the resources to do trust and safety testing and update that testing for each software update. But that’s probably not possible  for smaller developers who don’t have those resources.

To see the potential problems here, consider the case of the MyCity Business Services Chatbot, recently launched by the New York City Department of Small Business Services in partnership with Microsoft. The chatbot was found by The Markup to give inaccurate and illegal advice on a wide range of issues a small business owner might prompt it with. After publication of The Markup article, Small Business Services quietly updated the chatbot landing page with a more prominent warning that you shouldn’t use the bot for “legal or professional advice” — what other use case there is for the bot is unclear — but otherwise left the chatbot up.

The end result of the lack of a clear chain of responsibility for what the APIs say is a convoluted landscape of half-built, opaque safeguards with no way to tell how well they work, who built them, or when they have been implemented. Kapoor, the Princeton researcher, who also worked on The Foundation Model Transparency Index, said, “There is a pervasive lack of transparency” about what the content filters on an API version of a modeI actually do and even less transparency about the filters companies put on their own chatbots, which they update frequently.

“A minimum bar,” Kapoor said, “is to provide details about which safety guardrails [the companies] implement, and which ones they leave for downstream developers. Without such details, downstream users are essentially in the dark about what mitigations they need to deploy.”

For his part, Wu, the Stanford Ph.D. candidate, said a lot of developers rely on AI companies to provide a service. They pay for API tokens and the company provides API responses. To a large extent, the companies do not consider trust and safety quality control to be part of that service, while developers might reasonably have that expectation. 

“So yeah,” Wu summarized, “when it comes to responsibility and who is liable for this, I think right now the people using it are going to have to bear the brunt of the responsibility.” 

If only there were a reliable API to help us navigate that ethical dilemma.