The announcement of the pulled model's return stated it would come back with a new set of classifiers designed to identify and block cybersecurity tasks, with blocked requests redirected to an earlier, less capable version.
The design is interesting because it avoids a flat refusal. Instead of saying it can't, the system delivers a weaker model's result, preserving the user experience and keeping the service running.
That same design brings a transparency problem worth naming. Someone who makes a request and receives a worse answer without notice has no way of knowing whether the model simply erred or was redirected by a filter, and that difference matters to anyone depending on the result.
The arrangement's effectiveness also depends entirely on classifier calibration. Too tight and it diverts legitimate defensive security work; too loose and it fails what was agreed with regulators.
It's the dilemma of any automated barrier, and the applicable rule is the same: the only way to know it works is to exercise it on purpose, with a known case, and check what happens on both sides.