Ox Alpha

On August 20, 2026, a model called Ox Alpha appeared on OpenRouter with a 1 million token context window, video input, mandatory reasoning, and no lab attached to it. It costs nothing to use right now. The provider field says only "Stealth," the tokenizer field says only "Other," and the Hugging Face field is empty. If you have seen it written as "0x Alpha" with a zero, that is a typo worth correcting: the slug is stealth/ox-alpha, as in the animal, and the zero spelling drags in results about the unrelated 0x Protocol DeFi project.

Here is what the platform metadata actually says, what the forensic evidence supports, which viral number was retracted by the person who produced it, and what you are agreeing to when you send it your code.

TL;DR

• It is free until roughly August 27, and then probably not. Pricing reads 0 for both input and output while the preview runs. OpenRouter's terms let the provider pull it "at any time... with or without notice."
• The serving profile is nearly identical to Z.ai's GLM-5.3. We compared all 422 models OpenRouter lists and found a match on nine of ten fields. Independent researchers reached the same conclusion by completely different routes.
• The benchmark number that made it go viral was withdrawn. The widely repeated 80 percent DeepSWE score came from a 10 task subset. The same author re-ran the full 113 tasks and got about 63 percent. Most coverage has not caught up.
• Your prompts are training data. OpenRouter's Stealth Program terms grant a "perpetual" license to pass your content to an unnamed provider so it can "train, evaluate, and improve" the model. Three separate policy statements about this contradict each other.

What the API actually says

Rather than quote anyone's summary, we pulled OpenRouter's public model catalogue directly on August 23, 2026. These are the raw fields.

Two of those deserve emphasis. hugging_face_id is null, so there are no weights, and we will come back to that. And knowledge_cutoff is null, which means the "cutoff is around November 2025" figure circulating in several write-ups is somebody's inference from probing the model, not a published fact.

Check it yourself in about ten seconds:

curl -s https://openrouter.ai/api/v1/models \
  | jq '.data[] | select(.id=="stealth/ox-alpha")'

The serving fingerprint

OpenRouter exposes more than most people read. Every model carries a reasoning configuration, a parameter surface, and a set of defaults, and those describe the serving stack rather than the marketing. So we compared Ox Alpha against all 422 models in the catalogue.

Only three entries combine mandatory reasoning with the effort ladder max/high/low and a default of max: stealth/ox-alpha, z-ai/glm-5.3, and the glm-latest alias that points at it. Put the first two side by side:

The parameter surface is the part that carries weight. GLM-5.2 exposes 21 parameters including logprobs, seed, stop, structured_outputs and the penalty family. GLM-5.3 narrowed that to exactly 10, and Ox Alpha exposes exactly the same 10. DeepSeek V4 Pro, the other lab people guessed early, does not fit at all: reasoning is optional there, the default effort is high, the tokenizer reports as DeepSeek, and it still exposes 21 parameters.

Independent researchers arrived at the same suspect through evidence we never touched. A malformed request reportedly returned a Java stack trace containing com.wd.paas.api.domain.v4.chat.ChatCompletionRequest, which maps onto Zhipu's documented endpoint path /api/paas/v4/chat/completions. Tokenizer probes across multiple writing systems matched GLM-5.3 with a consistent 75 token wrapper offset. Video token consumption matched GLM-5V-Turbo's encoder, and audio input is rejected the same way GLM-5V rejects it.

Why we are still not calling it

Two things stop this being a confident attribution, and both belong in any honest write-up.

First, metadata describes a serving configuration, not a set of weights. A shared inference stack, a copied config template, or one lab renting another's infrastructure would all produce the pattern we found. It is strong evidence about who is operating the endpoint, which is not quite the same question as who trained the model.

Second, there is a live competing theory built on the same class of evidence. Robert Lukoszko of Stormy argues a cl100k_base tokenizer signature rules out OpenAI, Google, Anthropic and xAI and instead points at Microsoft's MAI and Phi lineage. Two independent tokenizer analyses reaching opposite conclusions is not a detail to bury. It tells you the method is less clean than any single confident blog post suggests.

A Manifold prediction market has Zhipu at about 85 percent. No lab has claimed the model, and none has denied it. As of August 23, 2026, "unclaimed" is the accurate word.

The base rate on guessing

Cloaked launches are a standing OpenRouter programme, not an accident, and there is now enough history to check how often the crowd gets it right.

Every tracked case eventually got claimed by its lab, so the model almost certainly will be. But roughly two of eight first guesses were wrong, and our own Hunter Alpha coverage is a reminder of how confident a wrong consensus can look: for a week most of the local model community was certain that one was DeepSeek V4.

One caveat on that table. It only lists cloaked models that were eventually revealed. Tests that went badly and were quietly retired never show up in anyone's timeline, so the real accuracy rate is likely worse than it looks.

The benchmark that got withdrawn

If you have seen a headline saying Ox Alpha beats GPT-5.6 and Claude at coding, it traces to a single number: 80 percent Pass@1 on DeepSWE, reported by an independent developer. That figure came from a 10 task subset, under 9 percent of the benchmark.

The same author then ran the full 113 task set and got roughly 63 percent, describing it as about par with GPT-5.6 Sol mid rather than ahead of the field. The correction landed within about 48 hours. A large amount of secondary coverage is still repeating the 80.

The only evaluation we found with fully published methodology is a LiveCodeBench v6 run by GitHub user xnasarx, executed on August 21, 2026 against the free endpoint. It reports 28.0 percent Pass@1 overall, 49 of 175 problems solved: 51.2 percent on easy, 30.8 percent on medium, 13.8 percent on hard. Greedy decoding, single sample, fresh subprocess per test, 20 second timeout, dataset and prompt disclosed. That is a small independent effort, not an audited lab result, but it is the one number here you can actually reproduce.

Everything else is thinner. A "Kingbench" score of 87.5 percent is circulating; the source itself notes it has no published methodology and no lab uses it, and Ox Alpha lost to GLM-5.3 on it anyway. There are no published AIME, GPQA, MMLU or SWE-Bench numbers at all. Ox Alpha does not appear on LMArena, so there is no blind vote Elo, and Artificial Analysis does not track it. Every "beats X" claim in circulation rests on self reported provider capacity or one hobbyist's small sample.

Using it today, and what you agree to

Access is a one line change for anything already speaking the OpenAI protocol:

curl https://openrouter.ai/api/v1/chat/completions \
  -H "Authorization: Bearer $OPENROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"stealth/ox-alpha","messages":[{"role":"user","content":"hello"}]}'

Tool calling works, and existing agent harnesses run against it by changing only the model string. response_format gives you JSON but does not enforce a schema, which matters if your pipeline assumes validation. Reasoning cannot be switched off, so the max default will cost you latency on trivial calls; drop reasoning_effort to low for simple work. OpenRouter's own telemetry over the first three days shows a median latency around 6 seconds and roughly 22 tokens per second, with uptime above 99.9 percent.

Now the part that deserves your attention more than any benchmark. OpenRouter's Stealth Program terms state that "your User Content may be collected by us and shared with the Stealth Provider," and grant OpenRouter a "non-exclusive, irrevocable, perpetual, transferable, worldwide, fully paid-up, royalty-free license" to pass that content on "for the sole purpose of enabling the Stealth Provider(s) to train, evaluate, and improve those Stealth Model(s)." The same terms confirm that "OpenRouter will not disclose the name or origin of Stealth Providers to you."

Meanwhile the model's own page says prompts and completions are retained but not used for training, and OpenCode advertises "Zero Data Retention" for its route to the same model. Those three statements do not agree, and nobody has reconciled them publicly. The safe reading is the blunt one: an unnamed company is keeping your prompts and has a contractual right to train on them, and you cannot verify which policy governs your particular access path. Do not send it credentials, customer data, or proprietary source.

There is a compliance edge here too. The EU AI Act's transparency obligations took effect on August 2, 2026 and expect named processors, which an anonymous provider by definition cannot supply.

What it is not

This is not an open weights release, and we want to be direct about that because it is the reason this article is not a local setup guide. There is no Hugging Face repo, no GGUF, no Ollama tag, no vLLM path. A community repository named 0xKitkat/Ox-Alpha-GGUF exists and is an honest placeholder: its own README states there are no public weights there and warns against downloading anything claiming otherwise.

We are covering it anyway for two reasons that fit our lane. It is free to everyone today, and the evidence points at a lab with a real open weights record. Z.ai has published GLM-5, GLM-5.1 and GLM-5.2 under MIT. GLM-5.3 launched on August 14, 2026 with no weights released so far, and Ox Alpha adds video input that GLM-5.3 does not have. That makes "does this checkpoint eventually get weights" a live question rather than a rhetorical one, and it is the question worth tracking.

What to watch

• The preview ending. Reported for around August 27. When free access stops, watch whether the model is claimed at the same moment.
• Whether the Microsoft theory survives. The competing tokenizer analysis needs to be resolved, not shouted down. Whoever reconciles the cl100k_base claim with the GLM probe results will have settled this.
• Whether weights follow. If this is a GLM variant, Z.ai's MIT track record makes an eventual release plausible. Plausible is not promised.
• A real evaluation. An LMArena listing or an Artificial Analysis entry would replace the entire benchmark section above with something auditable.

Sources and further reading

• Hunter Alpha: how a cloaked model fooled everyone for a week
• GLM-5.2: Z.ai's MIT-licensed flagship
• DeepSeek-V4-Flash
• DeepSeek Harness: pointing an agent runtime at any model
• Ollama vs llama.cpp vs vLLM for local inference
• The Ox Alpha listing on OpenRouter
• OpenRouter Stealth Program terms
• Independent LiveCodeBench evaluation of Ox Alpha
• Manifold market on who is behind Ox Alpha
• Hacker News discussion
• OpenRouter confirming the Quasar and Optimus stealth experiment

Tested on: not independently tested. We ran no inference against the model. The OpenRouter catalogue, the model record, the Stealth Program terms and the benchmark repository were queried directly from public endpoints on the date below; the 422 model comparison is our own. Attribution forensics (stack trace, tokenizer and video encoder probes) are the work of independent researchers and are reported as claims, not verified by us. Benchmark figures are community-reported and labelled by source.
Date checked: 2026-08-23