A frontier coding model appeared on a developer marketplace three days ago under an anonymous label, offering a million-token context window for free — and retaining every prompt under terms that its per-model listing and the platform’s governing EULA describe in contradictory ways. The model, listed as stealth/ox-alpha on OpenRouter’s model catalog, has attracted serious developer attention since August 20; serving-layer forensics published August 22 now point with high confidence to Zhipu AI’s Z.ai infrastructure as its source — while the question of what the anonymous provider is allowed to do with your data remains officially unresolved.

Ox Alpha Launched Three Days Ago. Here’s What It Actually Does.

Ox Alpha appeared on OpenRouter on August 20, 2026 without a company name, a press release, or a logo, listed under the generic “Stealth” provider label. Open-source coding agent OpenCode announced it would be free for one week — through around August 27, 2026 — with the anonymous provider claiming capacity of 100 trillion tokens per day.

The model’s context window is the first thing most developers noticed: a 1,048,576-token context window, supporting text, image, and video input, with function calling and structured JSON output. That window size is not a small incremental step — it means a developer can load an entire large codebase into a single prompt and ask the model to reason across all of it simultaneously. Most production-grade models handle between 8,000 and 200,000 tokens. A million-token window is a different category of tool.

Community benchmarks ran almost immediately. Developer Ben Davis ran Ox Alpha against DeepSWE, a rigorous coding-agent evaluation that tests AI performance on real software engineering problems, and reported the model completing 8 of 10 tasks — an 80% pass rate. His comparison figures placed Claude Fable 5 at 65% and GPT-5.6-Sol at 52% on the same tasks, according to a 10-task community benchmark trial. These are community-run results, not scores from an audited public leaderboard, and should be treated as preliminary signals rather than settled comparisons — on a 10-task set, a single task’s outcome shifts the pass rate by 10 percentage points. The gap between Ox Alpha and established frontier models, if it holds at scale, would represent a genuine performance story. Patrick Collison, CEO of Stripe — which agreed to acquire OpenRouter on August 19 — called it very impressive, a public endorsement that accelerated developer attention considerably.

Throughput has held at around 29 tokens per second — respectable performance for a model processing queries at this context scale.

Serving-Layer Forensics: How the Community Identified the Provider

The developer community deployed a methodical forensic toolkit within hours of Ox Alpha’s appearance. By August 22, the inquiry had moved from speculation to serving-layer evidence — a qualitatively different class of proof.

Tokenizer fingerprinting was the first tool applied. Models break text into tokens (numeric units the model processes), and each model family uses a distinctive vocabulary and segmentation strategy. Researcher @aitrackerbot ran 25 diverse prompts through Ox Alpha and recorded exact token counts; researcher Chetaslua later expanded this to 30 diverse probe strings covering 14 writing systems, emoji, code, and SQL. Every single prompt matched GLM-5.3’s tokenizer, with a constant offset of 75 tokens on each request — the signature of a system prompt or routing wrapper prepended invisibly to every query, not of a different model architecture, according to 30-of-30 tokenizer probe matches.

Video encoder matching provided a separate, independent signal. Ox Alpha accepts video input; most rival candidate models don’t, or handle it differently. Testing four controlled videos, the research team found that Ox Alpha’s token spend per video matched GLM-5V-Turbo — Zhipu AI’s own multimodal agent model — across three independent encoder design choices simultaneously: how many frames get extracted per second (FPS-invariant sampling), how token cost scales with video duration (approximately 147 tokens per second), and how token cost changes with frame resolution. Three independent choices matching exactly is a substantially harder coincidence to explain than a single number lining up.

The stack trace is the strongest evidence found so far. Researcher Chetaslua sent a deliberately malformed request to OpenCode’s direct Ox Alpha route — setting the top_p parameter to the string "abc" instead of a number — and the server returned a Java validation error with a Java stack trace exposed that named its own internal class: com.wd.paas.api.domain.v4.chat.ChatCompletionRequest. That package path maps directly to Zhipu’s documented API route at open.bigmodel.cn and api.z.ai.

The error-code dialect confirmed the stack trace’s implication. Z.ai-hosted GLM models on OpenRouter return a distinctive error when given a bad role field: {"code":"1214","message":"Incorrect role information"}. Ox Alpha returns the same error in the same format. Critically, when the same test was run against DeepInfra’s hosting of GLM-5.2 — the same model weights, served by a different operator — the error format was different (a pydantic validation error). The error-code dialect matched Z.ai’s operator stack, not the model weights in isolation. This means the evidence identifies who is serving the model, not just what model it might be.

Chetaslua rated operator-layer confidence at 0.98. Explainx.ai, in its assessment, called this “implementation detail leaking at the routing layer” and distinguished it clearly from earlier behavioral fingerprinting. No official statement from Zhipu AI or OpenRouter has confirmed the attribution. The accurate summary is: the leading forensic theory is a Zhipu GLM variant served through Z.ai infrastructure — the strongest independent evidence yet, but still unconfirmed.

How this pattern has played out before: Ox Alpha is, by most accounts, the fifth stealth model in six months on OpenRouter. The four prior stealth models — which included Z.ai’s own GLM-5, Xiaomi’s MiMo-V2-Pro (which appeared under the names Hunter Alpha and Healer Alpha), Ant Group’s Lingxi Ling-2.6-flash, and Meituan’s LongCat-2.0 — were all eventually claimed by their developers after the preview period closed, according to prior stealth model pattern reporting. An anonymous launch, free access at frontier scale, developer community builds a base, the lab steps forward with a named product — this arc has now repeated enough times that it functions less as a mystery and more as a documented launch playbook.

Why a lab does this: anonymous releases let developers evaluate a model without their expectations — positive or negative — shaping the results. A known lab’s model gets tested against that lab’s reputation. A stealth model gets tested against its actual outputs. The practical upside for the lab is real-world stress-test data at frontier scale, plus a ready user base at the moment of official announcement. The economics of serving 100 trillion tokens per day of free inference — a substantial infrastructure cost — only make sense if the lab expects to convert a portion of those free users into paying customers at reveal time.

The Policy Conflict in the Fine Print

This is where Ox Alpha presents a risk that the benchmark discussion obscures.

The OpenRouter listing for Ox Alpha states that prompts and completions are retained but not for training by the provider. Developers reading that notice could reasonably conclude they have a firm guarantee that their code won’t be used to train the model. That conclusion is not supported by the platform’s governing terms.

The OpenRouter Stealth Model EULA — which applies to all stealth models on the platform, including Ox Alpha — grants OpenRouter and the unnamed provider the right to use user content for training, evaluation, and improvement, instructs users who do not want that use to refrain from accessing stealth models, and specifies that personal data in an input will be sent to the provider. The published materials do not explain how the per-model notice and EULA conflict is resolved in the developer’s favor.

The OpenCode route for Ox Alpha carries a different policy: Kingy.ai’s review of OpenCode’s documentation found that the Ox Alpha provider is listed as having zero days of retention and no training use on the OpenCode Go platform. This means two routes to the same model carry different stated data policies — a distinction that matters significantly if you are sending anything sensitive.

The conservative conclusion: for any prompt routed through OpenRouter’s direct endpoint, the training-rights situation is not cleanly settled by the per-model notice. For any prompt routed through OpenCode, the zero-retention claim is stated but applies to an anonymous provider whose identity and legal jurisdiction remain officially unknown.

What Z.ai’s Involvement Would Add to the Risk Picture

If the forensic evidence holds and Z.ai is confirmed as the provider — which, again, has not been officially confirmed — a distinct category of legal risk comes into play.

Z.ai (the international name for Beijing-based Zhipu AI, listed on the Hong Kong Stock Exchange in January 2026 as SEHK: 2513) operates under China National Intelligence Law Article 7, which requires all Chinese organizations and citizens to support, assist, and cooperate with state intelligence work in accordance with the law. This obligation is not contested; it is the operative legal condition under which every company headquartered in China operates, regardless of that company’s stated privacy policy, its international corporate structure, or the physical location of its servers.

Z.ai is also on the US Commerce Department’s BIS Entity List January 2025 on the grounds that it advances China’s military modernization through advanced AI development. US organizations sending data to an Entity List company — particularly through an API, which necessarily routes data through that company’s infrastructure — should understand the compliance implications of that arrangement.

The House Committee on China inquiry from the US House Committee on Homeland Security and the House Select Committee on China opened a formal inquiry into cybersecurity risks from Chinese AI models in critical infrastructure in May 2026, naming Zhipu AI among the companies under scrutiny.

These are structural legal conditions, not contested allegations. They apply whether or not Z.ai has ever been compelled to share user data. The relevant question for a developer or enterprise evaluating Ox Alpha is simpler: would you knowingly route your codebase through a named anonymous third party with an unresolved training-rights conflict and a plausible connection to a BIS Entity List company? Most enterprise security policies answer that question before it gets to the data.

Does the EU AI Act Make Stealth Models Illegal for European Businesses?

The draft article circulating in developer communities has claimed that EU AI Act enforcement began August 2 and makes anonymous stealth model use unacceptable for European enterprises. That framing requires correction.

EU Regulation 2026/1744 entered into force — the Digital Omnibus on AI — was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026. This regulation deferred the original August 2 enforcement deadline for the high-risk AI compliance framework. The sweeping obligations that enterprises had been preparing for — including formal data processing agreements with named AI providers — were not activated on August 2 as originally scheduled.

Specific provisions still apply. Article 50’s transparency requirements for AI-generated content remained in effect. But the high-risk compliance framework — including the documentation, auditing, and data-handling obligations that would most directly affect enterprise use of an anonymous AI provider — was deferred. The EU regulatory situation for anonymous model use is therefore complicated and evolving, not cleanly resolved in either direction. European enterprises should consult current legal guidance rather than relying on the August 2 date that appeared in earlier coverage of this story.

What has not changed: the underlying problem is real regardless of enforcement timing. Using an AI model whose provider you cannot identify, whose contractual terms conflict between the model page and the platform EULA, and whose likely jurisdictional home carries state intelligence cooperation obligations — that is a set of facts a legal or compliance team needs to evaluate before routing enterprise data through the endpoint.

Is Ox Alpha Worth Testing?

For evaluation and capability assessment on non-sensitive inputs, the honest answer is yes. A million-token context window at zero cost is an unusual research opportunity. Developers who want to stress-test a model’s ability to reason across large codebases, or who want to establish a personal benchmark for long-horizon agentic work, have approximately four days remaining to do it.

The constraints are equally honest. The community benchmark suggesting Ox Alpha beats Fable 5 and GPT-5.6-Sol on DeepSWE is a 10-task trial by a single developer, not an audited leaderboard entry. On a test that small, one task determines 10 percentage points of the result. The model’s actual comparative performance at scale is unknown. Day.dev testing placed Ox Alpha at 87.5% on Kingbench benchmark results August 2026 — behind GLM-5.3’s 91.25%, which would make Ox Alpha a strong but not frontier-leading performer if that benchmark is representative.

The free window closes around August 27. The pattern from prior stealth launches suggests a formal reveal from the developing lab — with a name, a price, and documented terms — shortly after. Whether Ox Alpha’s eventual product is GLM-5.3 Vision, a Flash variant, or something else named in the reveal, the serving-layer forensics have already told developers a great deal about what is running underneath.

Until then: evaluate the capability, withhold the sensitive data, and read the EULA before you decide the per-model notice is the whole story.

Frequently Asked Questions

Who built Ox Alpha, and why won’t they say?

No lab has officially confirmed building Ox Alpha. Serving-layer forensics — including a Java stack trace exposing Zhipu AI’s internal API class names, an error-code dialect matching Z.ai-hosted GLM models on OpenRouter, and 30-of-30 tokenizer probe matches to GLM-5.3 — point with high confidence to Zhipu AI’s Z.ai infrastructure. The MiMo precedent (Xiaomi’s two prior stealth models appeared as Hunter Alpha and Healer Alpha before being confirmed) and the pattern of all four prior OpenRouter stealth models being eventually claimed by Chinese labs strengthen the inference. Anonymity benefits the lab by removing brand bias from early evaluations and by building a user base before the official named product launch must carry the lab’s full reputation.

Is the “no training” promise from the Ox Alpha model page actually guaranteed?

No — not by the per-model notice alone. The OpenRouter Stealth Model EULA grants OpenRouter and the unnamed provider rights to use user content for training, evaluation, and improvement — a per-model notice and EULA conflict the platform’s published materials do not resolve. The per-model notice says the provider does not use prompts for training, but the governing EULA contains broader provisions that the per-model notice does not explicitly override. OpenCode’s direct Ox Alpha route carries a separate zero-retention stated policy — but applies to the same anonymous, unidentifiable provider. The safest operational assumption: treat retention as nonzero and training rights as unresolved until a named, auditable provider with clearly binding terms is available.

What if Ox Alpha is confirmed as Z.ai’s GLM-5.3 — does that change the risk for US users?

Significantly. Z.ai (Zhipu AI) is on the BIS Entity List January 2025 for its role in advancing China’s military modernization through AI. China’s National Intelligence Law Article 7 requires all Chinese organizations to cooperate with state intelligence work on demand — regardless of stated privacy policy or server location. US enterprises routing proprietary code through Z.ai’s infrastructure should have that legal obligation in their risk assessment. The China data risk is a distinct and additional concern on top of the contractual policy conflict already present in Ox Alpha’s terms.

What happens when the free window closes around August 27?

Based on prior stealth model precedent — Hunter Alpha became Xiaomi’s MiMo-V2-Pro; GLM-5 stealth testing preceded Z.ai’s named GLM product launch — the most probable outcome is a formal reveal from the developing lab shortly after the preview ends, with a named product, documented pricing, and full terms of service. The endpoint may be renamed or retired. Developers who want to continue using the underlying model after the reveal should wait for the official named product, which will carry identifiable data processing agreements and a contractually binding privacy framework.