A free model called Ox Alpha appeared on OpenRouter on August 20, 2026 with a 1,048,576-token context window, image and video input, and no disclosed owner. Two sets of official documentation describe its data handling in incompatible ways: OpenRouter's own model page says prompts and completions are retained by the provider, while OpenCode's documentation describes the same model as following a zero-retention policy. If you are sending code or customer data to a free model this week, that conflict is the story.
Key facts
- 1,048,576-token context window, up to 131,072 output tokens, free, released August 20, 2026.
- OpenRouter states it routes the requests but is not the developer, owner, or provider.
- An independent analysis found Ox Alpha used exactly 75 more tokens than Zhipu's GLM-5.3 on all 25 test prompts.
- Primary source: OpenRouter's Ox Alpha model page.
Stealth releases have become a normal part of how models reach the market. A provider puts an unnamed model on a routing platform, offers it free for a window, watches how people actually use it, then launches it under its real name with the rough edges sanded off. It is a beta program disguised as a gift, and the developer community mostly plays along cheerfully, because a free million-token model is a free million-token model.
The forensics are the fun part. An independent writeup published this week ran 25 matched prompts through Ox Alpha and Zhipu's GLM-5.3 and found the two models were not merely similar, they were mechanically parallel. Ox Alpha consumed exactly 75 more tokens than GLM-5.3 on every single prompt, a constant offset that reads like a fixed system-prompt prefix. Both force reasoning mode on, expose the same three thinking-strength settings, default to the highest one, and share identical default values for the sampling parameters that control randomness. Then Ox Alpha returned error code 1210 on a malformed system prompt, and error 1210 is documented in Zhipu's own developer materials.
That is a fingerprint, and it is worth understanding why it works. Models leave behavioral traces the way machines leave tool marks: not in what they say, which varies, but in the invisible constants around what they say. A fixed token offset is a serial number. This is the same logic behind a research direction the field is formalizing right now, including a paper published this month on verifying model lineage from weights alone. The forensic question of "which model is really answering me" has become a live discipline.
The analogy is a numbered print. Two copies of the same image look identical hanging on a wall. Hold them to the light and one has a watermark in the paper. Nobody signed the print, but the mill is not in doubt.
Here is why the documentation conflict matters more than the whodunnit. OpenRouter's Stealth EULA states that stealth models are free for a limited period and are specifically for collecting user content for training and improvement, and that user content may be shared with the stealth provider. The Ox Alpha model page says prompts and completions are retained by the provider and not used for training. OpenCode's documentation says zero retention and no training use. Three official pages, three different pictures. And OpenRouter explicitly says it routes the requests but is not the developer, owner, or provider, meaning the entity actually holding your prompts is one nobody will name.
For anyone treating model choice as a supply-chain question, that is the concrete risk: an unnamed vendor, in an undisclosed jurisdiction, receiving your prompts under terms that three sources describe differently. The engineering appeal is genuine, a million tokens of context is not a small thing, and this site has covered how OpenRouter now routes by what everyone else is paying for, which makes free models unusually sticky. The security posture is the part that has not caught up.
The honest caveat: the Zhipu attribution is an inference, and the analysis that produced it says so. Constant token offsets and shared error codes are strong evidence but not proof, and a shared upstream serving framework could in principle explain some of it. The precedent is suggestive rather than conclusive, an earlier anonymous model on the same platform was later confirmed as a GLM release after a similar test run. What is not an inference is the documentation conflict, which is visible on the primary pages right now, and which is enough on its own to keep anything sensitive away from this endpoint.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)