The Drift You Cannot See Until It Costs You: Chronic Vendor-Silent Behavioral Drift and the Case for Behavioral Fingerprinting

Where the upgrade-governance corpus handles the deliberate, customer-visible version bump, this paper addresses the prior and harder problem: a production model's behavior changing while its named version does not. It synthesizes documented incidents (Anthropic's March–April 2026 postmortem, OpenAI's GPT-4o sycophancy rollback, and the peer-reviewed GateScope gateway study) with the 2026 tool landscape and a regulatory overlay, and argues that continuous behavioral fingerprinting — periodic re-execution of a fixed probe set against a stored baseline — belongs in production telemetry as a first-class signal. It is explicit about evidence stratification: the 91%-degrade figure is a DataRobot vendor survey, the problem is documented via incidents rather than a longitudinal study, and no production-grade vendor-agnostic fingerprinting platform exists.