Ox Alpha: What the Stealth Model Does and Who Is Behind It

Since Thursday evening, OpenRouter has been serving a language model nobody can attribute. It is called Ox Alpha, costs nothing, handles a million tokens of context, and beat GPT-5.6 and Claude in the first coding tests. The provider goes by the name Stealth. Who stands behind it is disclosed neither by the provider nor by OpenRouter.

For developers this is a puzzle. For companies it is a question with a legal edge: may you deploy a model in production when you do not know who operates it?

In brief: Ox Alpha is an anonymously operated language model, available free through OpenRouter since 20 August 2026, with 1,048,576 tokens of context, image and video input, and tool calling. The headline scores come from tests over ten tasks and are therefore not statistically meaningful. Tokenizer fingerprints point to the GLM family, while the stated capacity of 100 trillion tokens per day points to a very large Western operator. Our own assessment follows below. For production use in German companies the model is currently unsuitable: under the terms of the Stealth programme, every input including any personal data it contains is passed to a provider whose name remains contractually secret. A data processing agreement is therefore impossible.

What is Ox Alpha?

A model with no known sender. OpenRouter runs a programme called Stealth, through which providers can have new models tested anonymously before announcing them officially. The platform handles routing only, not development. The terms state explicitly that OpenRouter does not disclose the name or origin of Stealth providers.

The procedure is not new. OpenAI also had GPT-5.6 tested under codenames such as iris-alpha and ember-alpha before its announcement, which we traced at the time in our piece on the GPT-5.6 leaks. What is new is that this time nobody raises a hand even after launch.

Ox Alpha appeared in that programme on 20 August 2026. The model identifier is stealth/ox-alpha. The official description calls it a reasoning model for coding, sustained agentic work, and production workloads.

Two values in this table deserve attention because most reports skip past them. Throughput of 19 tokens per second is slow for a model of this class. Cursor's Composer 2 reaches over 200 by the vendor's own account. And the wait for the first token runs to seven and a half seconds. Anyone working interactively notices immediately.

That fits a preview where capacity is tight and the operator is mainly collecting test data. It does not fit a finished product.

What can the model actually do?

Less certainly than the headlines suggest. The number quoted everywhere comes from developer Ben Davis, who ran the model through ten tasks of the DeepSWE benchmark. Result: around 80 percent. Claude at 65 percent and GPT-5.6 at 52 percent were cited for comparison.

Ten tasks. This is the point at which to pause briefly.

With ten attempts and eight hits, the 95 percent Wilson confidence interval runs from 49.0 to 94.3 percent. It is therefore consistent with the available data that the true hit rate sits at barely half. The intervals of the three compared models overlap completely:

No ranking can be derived from these numbers. To reach an interval of plus/minus five percentage points at a hit rate of 80 percent would take around 250 tasks rather than ten.

This does not mean the model is weak. A second test on Kingbench produced 87.5 percent, second place behind GLM 5.3 at 91.25 percent and ahead of Opus 4.8 at 80 percent. Feedback from developers who tried it on their own code is largely positive. It only means this: turning ten tasks into a leaderboard measures a considerable amount of chance.

How do you use Ox Alpha?

Through OpenRouter's OpenAI-compatible interface. Anyone already working with the platform changes exactly one line: the model identifier to stealth/ox-alpha. No separate access and no approval is needed.

It therefore works anywhere an own OpenRouter key can be stored. That covers the common terminal tools for agentic coding as well as bespoke applications talking to the interface. Tool calls follow the usual scheme; the model returns structured output as JSON, though without enforcing a supplied schema. Anyone relying on that should validate the response themselves.

The model makes sense where the large context window is decisive: analysing a whole codebase in one pass, working through long logs, checking documentation against source. For interactive work, throughput argues against it.

And for anything touching company data, the section below applies.

Who is behind it? The theories in overview

Within 48 hours the developer community took the model apart. The primary method is tokenizer fingerprinting: you send character sequences where model families differ in how they segment them, and compare the behaviour with known models.

The debate goes in circles because two findings appear to contradict one another. The tokenizer points to China. The capacity points to a very large Western operator. As long as one assumes both must be the same company, every theory stays vulnerable.

Our assessment: Composer 3 on a GLM base

That assumption is the error. The operator of a model need not be whoever trained the base model.

Our assessment is therefore: Ox Alpha is Cursor's Composer 3, post-trained on a model of the GLM family. This is a reasoned conjecture, not a confirmed fact. It is, however, the only one that explains both findings at once, and it rests on a documented precedent.

Cursor has done exactly this before. Composer 2 is built on Kimi K2.5, a Chinese open-weight model from Moonshot AI. About a quarter of the pretraining comes from the base model; Cursor added the rest through post-training and reinforcement learning. The original announcement said nothing about it. A user probing the model found out, and co-founder Aman Sanger subsequently conceded it had been a mistake not to communicate the origin from the start.

A company that post-trains a Chinese base model and initially omits the origin is therefore not a hypothetical construct. It is a pattern documented at this very provider.

Four further points support it.

The capacity has fit for a week. SpaceX closed its acquisition of Cursor on 14 August 2026, six days before Ox Alpha appeared. Anyone looking for an operator able to carry 100 trillion tokens per day while also having an interest in a coding model finds both here.

The positioning matches the wording. The official description names coding, sustained agentic work, and production workloads. That is not a generic model description; that is Cursor's line of business.

The throughput matches the state. 19 tokens per second from a provider reaching over 200 with Composer 2 suggests a preview under load rather than a capacity problem.

And the fingerprints match the method. If a quarter of the pretraining comes from a GLM model, the tokenizer remains that of the base model. Post-training changes behaviour, not character segmentation. That is precisely why the probes register GLM while the model does not feel like a Chinese product in use.

This becomes testable shortly: by consistent accounts the free preview ends around 27 August. Identity is usually revealed at that point. Should it turn out to be a pure Z.AI model, this assessment was wrong. We are leaving it here regardless, because a prediction quietly withdrawn afterwards is not one.

Why a free frontier model is not free

Because the consideration sits in the terms of use, not on the invoice.

The Stealth programme has its own end user licence agreement. Three clauses in it should be read by anyone considering the model for company use.

First, the transfer. It states verbatim that every input and all personal data contained therein is passed to the Stealth provider. Not anonymised, not filtered.

Second, the anonymity. OpenRouter does not disclose the name or origin of Stealth providers. So you do not learn who receives the data, nor in which country it is processed.

Third, the use. The agreement grants an irrevocable, perpetual licence to the content, with the express purpose of enabling the Stealth providers to train, evaluate, and improve those models. Inputs therefore flow into training.

The agreement does note that content is given a hashed identifier so the individual user is not identifiable. That protects the identity of the OpenRouter account. It does not protect the personal data standing inside the prompt itself. A customer name in a support ticket, an address in an invoice template, a record in a spreadsheet handed over for analysis: all of it stays in plain text.

This is not an accusation against OpenRouter. The programme is transparently documented, and for private experiments it is a fair offer. It is simply something other than what many read into the word free.

May German companies deploy Ox Alpha?

For anything touching personal data: no.

A company having a service provider process personal data requires a data processing agreement under Article 28 GDPR. A contract presupposes a named counterparty. With a provider whose identity remains contractually secret, that cannot be established.

The same applies to disclosure duties. Under Articles 13 and 14 GDPR, data subjects must be informed about the recipients of their data. Anyone who does not know the recipient cannot provide that information.

And without a known processing location, there is no way to assess whether a third-country transfer under Chapter V is taking place and on what basis it would be permissible.

Added to this is the duty under Article 4 of the AI Regulation to ensure sufficient AI literacy among the people involved. Deploying a model whose provider you cannot name sits awkwardly with the awareness of risks required there. We have broken down the requirements of Article 4 in a separate piece.

The result is not a blanket refusal. It is a boundary:

Defensible use covers open-source code without personal references, synthetic test data, general technical questions, and material already published.

Not defensible is use with customer data in any form, internal source code carrying trade secrets, personnel and application documents, contracts, and anything under a duty of confidentiality. For law firms, medical practices, and tax advisers this applies with added force.

In practice: try it, yes; deploy it in production, no, and not until the provider has a name and a contract is possible.

What to do now

Three steps that take an hour.

Check whether anyone in your company is already working with the model. Free frontier models travel fast through developer teams, and an OpenRouter key is set up in minutes. The question is not whether someone finds it interesting, but whether someone has already fed company data into it.

Record in your AI policy that models without a named provider are not approved for company data. This rule is framed more generally than the individual case and will hold for the next stealth model too. There will be one.

And treat benchmark reports with a single follow-up question: how many tasks? If the answer is missing or sits in the low double digits, the ranking is noise. That question prevents more bad decisions than any model overview.

What happens on 27 August

By consistent accounts the free preview ends around 27 August 2026. At that point the model will either appear under a name with a price tag, or it will disappear again.

For companies that changes the assessment fundamentally. Once a provider is named, everything unresolvable today becomes resolvable: contract, processing location, retention, training use. A model you may not deploy can become one you may deploy within a day.

Until then Ox Alpha remains what it is: a technically remarkable model, an open case, and a good illustration that the most interesting question about a language model is not always the one about performance.