A model with no company name, no press release, and no logo quietly appeared in OpenRouter's catalog on August 20, listed as stealth/ox-alpha. It is free for about a week (through around August 27), offers a 1,048,576-token context window, accepts text, image, and video input, with a 131,072-token max output plus function calling and structured JSON output — and the anonymous provider claims a capacity of 100 trillion tokens per day. Developers rushed in, but the line many skipped: every prompt and completion you send is retained by the provider. (TechTimes report)
The Price of "Free" Sits in Two Conflicting Documents
The model page reads reassuringly: prompts and completions are "retained but not used for training." But the OpenRouter Stealth Model EULA — which governs all stealth models including this one — tells a different story. It grants OpenRouter and the unnamed provider the right to use user content for training, evaluation, and improvement, instructs users who do not want that use to refrain from accessing stealth models, and specifies that personal data in an input will be sent to the provider. No published material explains how the two documents are reconciled, and TechTimes' conclusion is blunt: for any prompt routed through OpenRouter's direct endpoint, the training-rights question is not cleanly settled.
It gets subtler: the same model has two routes with two policies. The OpenCode route for Ox Alpha is listed with zero retention and no training use — but that applies to the same anonymous provider whose identity and legal jurisdiction remain unknown. One model, two entrances, two data policies. For any team thinking of feeding sensitive code into that million-token window, that mismatch should be a red light.
Fingerprint Detectives: Three Days to a Likely Suspect
The community started forensics within hours. By August 22, the evidence had escalated from speculation to serving-layer proof. Researchers ran 30 probe strings across 14 writing systems through Ox Alpha; every token count matched GLM-5.3, with a constant 75-token offset on each request — the signature of an invisible system prompt or routing wrapper. The video encoder's token consumption matched GLM-5V-Turbo — Zhipu's own multimodal agent model — on three independent design choices simultaneously (roughly 147 tokens per second, FPS-invariant sampling). Someone sent a deliberately malformed request; the server threw a Java stack trace exposing an internal class name whose package path maps to Zhipu's documented API routes at open.bigmodel.cn and api.z.ai. The error-code dialect matched Z.ai's operator stack too. The researcher's operator-layer confidence: 0.98. But neither Zhipu nor OpenRouter has officially confirmed anything — the rigorous phrasing remains "the strongest theory, not a verdict." (AgentBreaking rundown)
Nor is this the first time. Per TechTimes' count, this is the fifth stealth model on OpenRouter in six months; the previous four (GLM-5, Xiaomi's MiMo-V2-Pro, Ant Group's Lingxi Ling-2.6-flash, Meituan's LongCat-2.0) were all eventually claimed by their developers. Anonymous launches let a model be tested without brand bias, and the lab gets real-world stress-test data plus a ready user base for the official reveal. The economics of "free inference for usage data" are well understood on both sides of the trade.
Impressive Scores, Tiny Sample
Developer Ben Davis ran Ox Alpha on DeepSWE — an evaluation built on real software engineering tasks — and reported 8 of 10 tasks passed, an 80% rate, against 65% for Claude Fable 5 and 52% for GPT-5.6-Sol on the same set. But this is a single-developer, 10-task trial, not an audited leaderboard: at that scale, one task swings the pass rate by 10 percentage points. Meanwhile Day.dev's Kingbench run put Ox Alpha at 87.5% — behind GLM-5.3's 91.25%. OpenRouter monitoring shows more than 160 billion tokens processed in roughly the first 24 hours, with Claude Code, Hermes Agent, and similar agent tools as top consumers, and a 73.5% cache hit rate — agentic coding workflows are clearly its home turf.
So What
For capability assessment on non-sensitive inputs, this free window is a genuine opportunity. But before you load an entire private codebase into a 1M-token window, answer one question first: would you knowingly send your code to an unnameable third party whose training-rights terms contradict each other and whose jurisdiction is unknown? Most enterprise security policies have the answer written before the data leaves the building. The model is free; your prompts are the price.