A stealth model showed up with a million-token context and 100 trillion free tokens a day. Everyone read the specs. Almost nobody read the four lines that matter.
Every few months the internet finds a new AI model to lose its mind over. This month it is Ox Alpha, and I understand the appeal. It showed up on OpenRouter on August 20 with no name attached, a 1,048,576 token context window, 131,072 tokens of output, and up to 100 trillion free tokens a day. Stripe's CEO called it very impressive. The timeline called it the future. Developers called it their new default and started feeding it their actual code.
I test AI pipelines for a living, which mostly means I read the terms while everyone else reads the benchmarks. So before I ran a single prompt, I read the data policy. It is four lines. Here is the one that matters, word for word:
"Prompts and completions for this model are retained by the provider and are not used for training."
Great. And the provider is?
"Ox Alpha is a stealth model. It is developed and operated by a third-party provider who has chosen to remain anonymous during this preview."
Read those two sentences back to back and the party gets quiet fast. Everything you type and everything it types back is kept. Not trained on, they are very careful to say. Just kept. By a company that has decided you do not get to know its name, in a country you cannot point to, under laws you cannot read, for a length of time nobody specified.
Let me save everyone the suspense on the big mystery. Yes, "free" was the catch. A frontier-grade model handing out a claimed 100 trillion tokens a day is not doing charity, it is doing acquisition. Compute is the single most expensive thing in this industry, and nobody sets a pile of it on fire for strangers out of kindness. When the price tag makes no sense, you are not the customer. You are the training set's more useful cousin: the corpus of everything real engineers paste into a box, complete with source code, internal architecture, the API key somebody fat-fingered into a stack trace, and the exact question your company is quietly asking about its own product two quarters before launch.
To be clear, I am not calling Ox Alpha evil. I genuinely do not know, and that is the entire point. The risk was never that the model is plotting against you. The risk is that you cannot evaluate the other side of this deal at all. No name. No security posture. No data processing agreement. No breach notification. No way to tell whether your retained prompts sit behind a hardened login or in a bucket someone forgot to make private. Every vendor review a grown-up company runs before adopting a tool exists to answer those exact questions, and Ox Alpha answers all of them with a shrug and a wink.
The rationalization going around is adorable: it is a preview, it is not used for training, I am only testing. Sure. But "retained" and "not trained on" are wildly different promises wearing the same coat. Training exposure is diffuse and statistical, a smear of your data across a billion parameters. Retention is a photocopy. It is your prompt, intact, on someone's disk, sortable and searchable, kept for exactly as long as they feel like keeping it, and you will learn the terms changed at roughly the same moment everyone else does.
None of this is hidden, which is the part I find almost funny. Ox Alpha put the retention clause and the anonymity clause right there on the page, in plain sentences a child could parse. It just printed them next to the words "free" and "100 trillion," and those numbers were loud enough to drown out the only two lines that counted. This is how AI security actually fails, by the way. Not with a dramatic exploit and a CVE. With a default nobody scrolled down to read.
So use it if you want. Just use it the way you would use any anonymous stranger who promises to keep a copy of everything you tell him. Sanitized inputs. No credentials. No client code. No proprietary anything you would mind meeting again in a context you did not choose. Work on the assumption that every token you send is already a token someone else owns, because by the provider's own terms, it is.
The whole internet is busy trying to figure out who built Ox Alpha. Fine. The better question, the one that should keep engineering leaders up tonight, is why so many of their engineers just shipped the company's source code to a party they cannot name, because a meter somewhere said zero.
Top comments (0)