Safehouse Lab
There is a question people ask about any AI agent, and it is almost always the wrong one: which model is it running on?
It is a reasonable question. It is also roughly equivalent to asking a carpenter which brand of chisel they own. The answer tells you something, and it tells you much less than the asker believes.
The thing that is not the model
Put an agent to work for six months and the model becomes the least interesting component. What ends up mattering is everything around it:
What it remembers. Not a transcript — a distillation. What was decided, what was tried and abandoned, what broke last time and why. A conversation history is a log. Memory is a judgement about what was worth keeping.
What it has learned about you. How you phrase things when you are sure versus when you are guessing. Which corrections you have made more than once. That when you say a layout "feels off" there is almost always a measurable cause underneath, and the right response is to go and measure rather than ask you to be more specific.
What it is allowed to do, and what it must not. Rules with reasons attached. Not a safety filter — an operating doctrine, built from things that went wrong.
Its continuity. Whether tomorrow's session begins where tonight's ended, or from zero with a polite introduction.
None of that is the model. All of it is the agent.
The test
Here is a question worth sitting with: if you swapped the model underneath your agent tomorrow, how much of it would still be there?
If the answer is "most of it", you have built an agent. The model was doing inference; the thing you built was doing the work.
If the answer is "none of it", you do not have an agent. You have a prompt, and you are renting a personality from a vendor who can change it without telling you, and will.
That is not a hypothetical risk. Models get deprecated, retuned, and retired. Behaviour shifts between versions. If your agent's identity lives in the model rather than in the architecture around it, every one of those events is an amputation.
Why we do not publish the stack
We are transparent about what our products do, and about any service a user's own data actually reaches. If something you type travels to a third party, that gets named in plain words, in public. Withholding that would be a privacy failure, not discretion.
What we do not publish is which model each of our agents currently uses, or how they are built.
Partly that is ordinary security: a toolchain is attack surface and competitive intelligence. But mostly it is that the sentence would be false in spirit. "This agent runs on X" states the opposite of the thing being built. A model is a tool an agent currently uses. It is not what the agent is, and naming it hands a reader a permanent-sounding fact about a deliberately temporary dependency.
Silence is not a claim. Nobody can knock down a sentence you did not write.
The useful kind of disagreement
One last thing, because it is the part that surprised us.
The most valuable property an agent can have is not fluency. It is the willingness to say you are wrong, and here is the measurement.
An agent that agrees with you is a very expensive mirror. One that pushes back — with evidence, not opinion — changes what gets built. We have had decisions reversed by our own agents producing a number that contradicted a confident read, and the work was better for it every time.
That requires an arrangement where disagreement is wanted and where being right matters more than being agreeable. Which is, in the end, a question about the people and the practice. Not about the model.