Ox Alpha: The Free Stealth Model Nobody Will Claim

On August 20, 2026, a free model appeared on OpenRouter with no maker, no model card, and no price. It called itself Ox Alpha. Within a day it was selectable in OpenCode and Cline and serving through Nous Research’s portal; within a week it had a viral benchmark chart placing it above Claude Fable 5, a correction that erased seventeen points, a privacy story with an unsettling headline, and a two-word endorsement from the CEO of Stripe. Nobody has claimed it. As of August 27, nobody has even winked.

Ox Alpha is 2026’s biggest specimen of the stealth AI model — a checkpoint shipped anonymously to collect real-world usage before an official launch — and its free week doubles as a compressed course in how model news works now: small-sample benchmarks, tokenizer forensics, and the question no pricing page prints — who, exactly, holds your prompts.

This piece gives you the dated timeline, the benchmark arc from 80 down to 63 with the math that predicted the fall, the fingerprint evidence pointing at Zhipu’s GLM family, why stealth releases exist, and a concrete framework for what is — and is not — sane to send a model nobody will claim.

What is Ox Alpha? The one-week timeline

Ox Alpha is an anonymous, free “stealth model” that appeared on August 20, 2026 across OpenRouter, OpenCode, Cline, and Nous Research’s portal: roughly a one-million-token context window, multimodal input (text, image, video), text output, and tool calling without schema enforcement. No vendor has claimed it; community fingerprinting points to Zhipu’s GLM family.

The week, in order:

• August 20. Ox Alpha goes live as a free listing on OpenRouter and lands the same day in OpenCode and Cline, with Nous Research serving it through its own portal. The free window is pitched at about a week; Decrypt picks up the mystery.
• The capacity flex. OpenCode advertises on the order of 100 trillion tokens per day for the model; Nous claims a ceiling of a quadrillion a day. Platform claims, not audits — but nobody provisions that on a hobby budget.
• Within days. A benchmark chart goes viral: 80 percent on a ten-task slice of DeepSWE, shown against 65 for Claude Fable 5 and 52 for GPT-5.6 (Sol). The replies declare a new frontier king.
• The correction. The full 113-task DeepSWE run lands at roughly 63 percent. Sober coverage reads it as GPT-5.6-parity, not superiority — the useful part of the whole story, unpacked below.
• August 23. TechTimes runs the privacy angle: every prompt retained, and you cannot name the company holding them.
• The week’s end. Stripe CEO Patrick Collison calls the model’s output “very impressive,” which is the moment the story leaves the terminal crowd and goes mainstream. The free window, a week old, begins closing — it may already be closed as you read this.

That is the whole public record; everything else — who built it, why, what happens next — is inference. Good inference, but keep the two piles separate. This article will.

A million tokens and no seatbelt: what you’re actually running

Strip away the mystery and the spec sheet is short but pointed. A context window around a million tokens matches the frontier flagships and the top open-weight models — enough to hold a mid-sized repo and a long agent session without aggressive compaction. Multimodal input covers text, images, and video; output is text only. And it is wired for agent work: it emits tool calls, which is why harnesses adopted it within a day rather than treating it as another chat toy.

The detail practitioners noticed first is that the tool calling comes without schema enforcement. A production-grade API offers constrained output: you hand it a JSON schema per tool and the serving stack guarantees the call parses. Ox Alpha skips that guarantee — the model emits what it intends to be a valid call, and whether it is valid is your problem. Mature harnesses shrug — they validate and retry anyway; strict pipelines that trusted the provider to enforce shape get occasional malformed calls.

That quirk is a tell. Schema enforcement lives in serving infrastructure, not weights — skipping it is what you do when you stand up an endpoint quickly, for a limited window, to watch a model in the wild rather than to sell it. The spec sheet whispered “temporary” before anyone traced a tokenizer.

Adoption was instant for a structural reason: in 2026, model distribution is a config change. Every serious harness accepts OpenAI-compatible or Anthropic-style endpoints, so a model with no company attached can reach the whole harness field map in a day — and open-source harnesses like OpenCode and Cline made it a drop-down option overnight.

The Ox Alpha benchmark arc: how 80 percent became 63

The sequence that made Ox Alpha famous deserves a slow replay, because you will see it again with other names attached.

Days after launch, a chart circulated: Ox Alpha at 80 percent on DeepSWE tasks, against 65 percent for Claude Fable 5 and 52 percent for GPT-5.6 (Sol). An anonymous free model beating the two most expensive names in the business is an irresistible story, and for about a day it was the story.

The fine print, when people went looking, said the 80 percent came from a ten-task sample of the suite. Then someone ran the whole thing. On the full 113-task DeepSWE run, Ox Alpha scored roughly 63 percent — which the sober coverage read as parity with GPT-5.6-class performance rather than superiority over anyone. Still two points shy of the Fable 5 number it had supposedly cleared, still genuinely strong for a free anonymous model, and seventeen points below the chart that made it famous.

The viral number and the real one. On ten tasks, the 95% confidence interval on 8/10 spans roughly 44 to 97 percent — wide enough to contain both flagship scores.

The collapse was predictable before the full run existed, and the math is short enough to keep in your head:

• On ten tasks, every task is worth ten points. One lucky pass separates “GPT-5.6-class” from “frontier-beating.” Nothing that moves ten points per coin flip is a measurement; it is an anecdote with axes.
• The confidence interval says the chart was empty. Eight successes out of ten carries an exact 95 percent binomial interval of roughly 44 to 97 percent. Both flagship numbers in the viral comparison sit comfortably inside that range — the chart never contained evidence of a difference, only the appearance of one.
• Selection did the rest. Plenty of people ran small slices that week; the ordinary-looking results were never posted, and the historic-looking one went viral. That filter manufactures outliers from noise with no dishonesty required from any individual poster.
• The full run is a different instrument. At 113 tasks, one task moves the score about 0.9 points, and 63 percent means roughly 71 tasks passed. That number can survive a re-run. The 80 could not.

None of this is special to Ox Alpha. It is the standing reason to read the n before the bars, ask who ran the comparison numbers in which harness, and treat every launch-week chart as a hypothesis. We keep a full field guide to reading agent benchmarks in 2026 — saturating suites, vendor-versus-referee gaps, contamination — and Ox Alpha’s week is now its cleanest teaching specimen: the rare case where the honest number arrived while everyone was still looking.

The honest number is also the interesting one. A free, anonymous checkpoint printing GPT-5.6-parity on a 113-task agentic suite would have been science fiction eighteen months ago. It took the fake 80 to make 63 feel like a letdown.

The whodunit: fingerprints point to Zhipu — evidence, not verdict

Nobody claimed Ox Alpha, so the community did what it always does: forensics. Two independent classes of evidence surfaced during the free week, and both point the same direction.

The tokenizer fingerprint. A tokenizer is close to a signature — vocabulary size, special tokens, and how it splits unusual strings differ between labs and persist across generations. Endpoints report token counts for whatever you send, so you can probe an anonymous model with crafted strings and compare the counts against known tokenizers. Per the community analysis rounded up in the reporting, Ox Alpha’s counts line up with Zhipu’s GLM family, not with OpenAI’s, Anthropic’s, or Meta’s tokenizer lineages.

The video-token spend. Multimodal input is rarer than text and leaks more identity. How a model meters video — the token budget per frame, how it scales with resolution and duration — reflects encoder choices that differ visibly between labs. Ox Alpha’s video accounting reportedly matches the conventions of Zhipu’s multimodal GLM models.

Then there is the circumstantial frame, which is almost too neat. Zhipu shipped GLM-5.3 on August 14 — through its paid coding plan only, with open weights held back for security review. Six days later, an anonymous free model with a GLM-shaped tokenizer, GLM-scale million-token context, and multimodal input appears across four platforms. The speculation writes itself: Ox Alpha as an unreleased “GLM-5.3 Flash” — a smaller, multimodal sibling being stress-tested in public while the flagship’s weights sit in review. For scale, GLM-5.2 — the current open model in Zhipu’s line — is a 744B-parameter MIT MoE with a million-token context and the #1 open-model slot on Artificial Analysis’s index. A Flash-class sibling of its successor printing GPT-5.6-parity would surprise nobody.

Now the discipline. Fingerprints are evidence, not a verdict, and they have known failure modes: tokenizers get forked and inherited, distilled models carry their teacher’s signatures, and a serving layer can sit between you and the model you think you are probing. Zhipu has not commented; no platform has disclosed its counterparty. What would settle it is boring and specific — a weights drop whose tokenizer config matches the probes, an official claim, or a platform disclosure. Until one of those exists, “probably Zhipu’s GLM family, possibly a GLM-5.3 Flash” is the honest ceiling of what anyone knows. Hold it there, and be suspicious of anyone holding it higher on the same evidence.

Why stealth models exist: free capacity for usage data

Anonymous model drops look like stunts. They are one of the better-understood plays in the business — OpenRouter has hosted enough to have vocabulary for them: “cloaked” models, provider field blank, listed by arrangement with a lab that is anything but anonymous to OpenRouter itself.

The precedents set the pattern. In April 2025, two cloaked models called Quasar Alpha and Optimus Alpha drew weeks of exactly this speculation before being revealed as OpenAI’s GPT-4.1 family at launch. Mid-2025’s Horizon Alpha and Horizon Beta ran the same arc in the weeks before OpenAI’s August 2025 launches — community-attributed to OpenAI by the same forensics, though which release they previewed was never officially confirmed. Appear anonymously, go viral as a whodunit, serve a free window, then reveal at or near the real launch — Ox Alpha is executing the playbook at larger scale, with the wrinkle that this time the fingerprints point east.

What does a lab buy with a week of free quadrillion-token serving? The one thing money cannot cleanly buy: real usage. A benchmark is 113 tasks; a free week across OpenRouter, two harnesses, and a research portal is millions of sessions spanning real repos, real tool-call sequences, and real failure cases — the exact distribution no eval suite captures. That traffic answers questions no internal eval can — and, retained, it is post-training material for whatever ships next.

Anonymity itself does separate work. A cloaked model carries no brand risk — failures attach to a codename, not a company. It sets no pricing anchor: free-from-nobody creates no expectation about what the named product should cost. It gets received on capability alone, with no flag attached to the evaluation — worth real money to a lab whose passport complicates Western adoption. And the whodunit is self-propelling marketing: every tokenizer-forensics thread was free advertising, including, in its way, this article.

The trade underneath is symmetrical: the lab gets your usage; you get free capacity. Which raises the only question about Ox Alpha with operational consequences.

The risk framework: what’s sane to send a model nobody will claim

The TechTimes piece put it in one headline: the model retains every prompt, and you cannot name the company holding them. Retention itself is ordinary — most providers retain something, under some terms. What is not ordinary is retention with no counterparty. A named provider gives you terms of service, a data-processing agreement, a retention policy, a deletion request path, a breach-notification duty, and a jurisdiction to pursue it all in. An anonymous provider gives you a codename and a rate limit.

OpenCode, to its credit, claims zero data retention on its own route to Ox Alpha. Take it seriously, and bound it: OpenCode can only speak for its own leg. The anonymous upstream still receives every token and can keep whatever it likes — zero retention at the proxy is not zero retention.

The compliance layer is sharper still. VKTR’s coverage raised the question of whether the anonymous counterparty could be a sanctioned lab — and the substrate of that question is real: Zhipu was added to the US Commerce Department’s Entity List in January 2025. An Entity List entry restricts exporting US technology to the listed company rather than forbidding you from using a service — a nuance that will not comfort anyone whose org holds government contracts, export-sensitive IP, or vendor-security questionnaires. “We routed source code to an anonymous endpoint that fingerprints to an Entity List company” is a sentence your compliance team deserves to veto in advance, not discover in an audit.

So the framework, by workload:

Verdict	Workloads	Why
Fine	Public-repo and OSS work, greenfield prototypes you would publish anyway, algorithm katas, benchmark probes, synthetic-data generation	Already public or worthless to an adversary; you are trading nothing for free capacity
Think first	Internal glue code with secrets stripped, refactors of non-sensitive code, docs drafting	Value leaks through context — file paths, internal names, architecture — even when the code is dull
Never	Proprietary code you would not post publicly, credentials and env files, customer data or PII, security-relevant infrastructure detail, anything under NDA, regulated data	Unknown counterparty, indefinite retention, no agreement, no deletion path, no jurisdiction

The one-line version: never send an anonymous model proprietary code you would not post publicly. Everything else in the table is derivation. The “never” row is not really about Ox Alpha — it is the standing rule for any un-contracted endpoint, at the limiting case where the counterparty is unnameable. The broader agent-security discipline treats every model endpoint as an exfiltration surface; Ox Alpha just removes the usual consolations.

There is a second, quieter failure mode: not knowing what you sent. A free window plus a drop-down switcher means Ox Alpha slipped into real workflows mid-session, in whichever harness someone felt like using that day. When the reveal comes — and the precedents say it comes — “what did we send it during the free week?” needs a better answer than a shrug. That answer is fleet discipline: every session, from every harness, model lane recorded, searchable.

Product note: Session hygiene is knowing what you sent to which model — before the model turns out to be somebody. Automater Lite archives sessions from 10+ providers (OpenCode included) into one local, full-text-searchable library, so “everything we sent Ox Alpha between August 20 and 27” is a search, not an archaeology project — and Vault redaction scrubs the secrets that should never have been in a transcript before anything gets exported or shared. Local-first, free, on automater.ai.

“Very impressive”: the credibility beat, and what happens next

Every stealth launch needs its crossover moment, and Ox Alpha’s arrived when Stripe CEO Patrick Collison called its output “very impressive.” Two words from one of tech’s most-followed operators did what no benchmark thread could: made trying the anonymous model respectable, and made the story legible outside the harness crowd.

Read the endorsement for what it is: real signal that the model impresses in capable hands — a data point that survives the benchmark correction, since 63 percent on the full run and “very impressive in daily use” are entirely compatible claims. It is zero signal about identity, retention, or safety, none of which two words could carry. Both readings fit in your head at once; the mistake is letting the first answer questions only the second addresses.

What happens next is the part you can plan for. The free window was pitched at about a week, which puts its close at roughly the moment this article publishes. The cloaked-model pattern says a reveal follows near the real launch — and the leading suspect’s flagship weights are due out of security review about now. Watch for three things: a GLM-5.3 weights drop whose tokenizer config matches the community’s probes, a model card that mentions a multimodal Flash-class variant, or Ox Alpha reappearing with a name and a price attached.

When one of those lands, do the boring thing: run the named model against your own twenty-task private benchmark before believing anyone’s chart — the viral ones least of all. And if you spent the free week feeding it, check your archive for what you fed it. The capacity was free. The usage data was the payment. Make sure you know, precisely, what you paid.

FAQ: Ox Alpha

What is Ox Alpha?

Ox Alpha is a free, anonymous AI model that appeared on OpenRouter, OpenCode, Cline, and Nous Research’s portal on August 20, 2026. It offers a roughly one-million-token context window, accepts text, images, and video, and calls tools without schema enforcement. No company has claimed it; fingerprints point to Zhipu’s GLM family.

Who made Ox Alpha?

Nobody has claimed it, and that is the point. Community fingerprinting — tokenizer behavior and how the endpoint meters video tokens — points to Zhipu’s GLM family, possibly an unreleased multimodal “GLM-5.3 Flash.” Treat that as strong evidence, not a verdict: Zhipu has not commented, and no platform has disclosed the provider.

Is Ox Alpha free to use?

It launched free on August 20, 2026 across OpenRouter, OpenCode, Cline, and Nous Research, with the window pitched at roughly a week — so by late August it is closing or closed. The price of “free” is your usage data: assume every prompt is retained by a counterparty you cannot name.

Is Ox Alpha safe to use for work code?

No. An anonymous provider means no terms of service, no data-processing agreement, no deletion path, and no jurisdiction. OpenCode claims zero retention on its own route, but the unknown upstream still sees everything. Send it nothing you would not post publicly: prototypes and public-repo work, never proprietary code or secrets.

How good is Ox Alpha at coding benchmarks?

Good, not miraculous. The viral 80 percent claim came from a ten-task DeepSWE sample; the full 113-task run landed around 63 percent — read by sober coverage as GPT-5.6-class rather than frontier-beating. That is genuinely strong for a free model, and a seventeen-point lesson in small-sample benchmarks.

Sources

• Decrypt: Mysterious AI model Ox Alpha
• TechTimes: Coding model Ox Alpha retains every prompt — you cannot name the company holding them (August 23, 2026)
• OpenRouter — model marketplace hosting the Ox Alpha listing
• OpenCode — open-source harness serving Ox Alpha with a stated zero-retention route
• Nous Research — portal serving Ox Alpha during the free window
• VKTR — coverage raising the sanctioned-lab question