Ox Alpha: What the Anonymous Stealth Model Can Do, Who Is Behind It, and What Companies Must Settle First

Since 20 August 2026 there has been a model on OpenRouter with a context window of one million tokens, accepting text, images and video, costing nothing, and belonging to nobody anyone can name. It is called Ox Alpha. For a developer that is a gift. For a company subject to data protection law it is a question that has to be answered before the first prompt, and the answer sits in a single sentence most readers scroll past.

What is documented

Everything in this table comes from the model page itself, not from coverage of it. That distinction matters more than usual here, because almost everything else written about this model is inference.

Positioning, according to the listing, is coding, sustained agentic work and production use, meaning long-running software tasks rather than single questions. Benchmark scores are circulating in the community, some of them flattering, and this article deliberately does not repeat them as fact. They come from individual runs by third parties, not from a published evaluation by the provider, for the simple reason that there is no provider to publish one.

How to try it

The model ID is stealth/ox-alpha and the interface is OpenAI-compatible. In practice that means existing code usually needs three changes and no rewrite: the base URL points to OpenRouter, the key becomes an OpenRouter key, the model name becomes the ID above. Anything that already speaks that interface will work.

Because nothing is billed during the preview, the sensible use is the kind of test you would otherwise avoid on cost grounds. Feed it a whole repository and ask for an architecture summary. Give it a two-hundred-page specification and have it list the contradictions. Hand it a long video and ask what happens in it. Those are the questions a million-token window is actually for, and running them at zero cost tells you whether that window is genuinely usable or merely advertised.

What not to put in is the subject of the section after next, and it is the part worth reading before the first request rather than after.

Five theories about the origin

Guessing the lab behind a stealth model has become a small sport, and the arguments are more interesting than the guesses. The strongest evidence anyone can gather from the outside is the tokenizer, meaning the way a model chops text into units before processing it. That choice is made early in training, it leaves a measurable fingerprint, and it is awkward to disguise.

None of this is confirmed. The only confirmed statement is OpenRouter’s own: the provider wishes to remain anonymous.

My own reading: Composer 3 on a GLM foundation

Since a piece like this is more useful with a position than without one, here is mine, clearly marked as an assessment rather than a finding. I consider the fifth theory the most probable: Ox Alpha is Cursor’s next Composer generation, built on the GLM architecture and served on infrastructure only a very small number of operators can supply.

Three observations lead there. The first is that the fingerprint evidence points to a Chinese architecture while the model does not behave like a purely Chinese product in other respects. That combination is not a contradiction; it is what a Western post-train on an openly published Chinese base looks like from the outside. The second is capacity. The figure circulating for this preview is on the order of one hundred trillion tokens per day, and whether or not that exact number holds, a free frontier-class preview implies serving capacity that only a handful of operators worldwide possess. The third, and it carries the most weight: the precedent is documented. Cursor built Composer 2 on Kimi K2.5, an open-weight model from the Beijing company Moonshot AI. The announcement of 19 March 2026 said nothing about it. Moonshot’s own staff noticed, and only on 21 March did Cursor acknowledge it. Lee Robinson put the base at roughly a quarter of the pretraining, with Cursor contributing the remainder through its own continued training. Co-founder Aman Sanger called it a miss not to have named the Kimi base in the blog post from the start, and said they would fix it for the next model.

That makes the pattern demonstrated rather than hypothetical: an open Chinese foundation, a Western post-train, and a result that sits cleanly in neither camp. It is precisely what observers report about Ox Alpha. The episode also explains why a successor would be trialled anonymously. A company publicly criticised for an undisclosed model base has every reason to let the next one be tested without a nameplate and to answer the provenance question later, on its own terms. That is not an insinuation; it is the obvious lesson from its own case.

What would show me to be wrong, stated plainly so this can be checked rather than believed: if the model appears under a lab’s own name with no editor product attached, the Composer part of my reading falls. If a published technical report shows a tokenizer built from scratch, the GLM part falls. And if the eventual owner turns out to operate its own large fleet without partnering, the third leg falls with it. I expect an answer within weeks rather than months, because previews of this kind exist to end.

Why spend paragraphs on a guessing game at all: because the answer decides who has been storing your prompts. That is not trivia. It is the identity of a processor you would otherwise have to name in a contract.

The sentence that matters for companies

On the model page, between the technical specifications and the terms, sits this: prompts and completions are retained by the provider and are not used for training. Most readers stop at the second half and are reassured. The first half is the one with consequences.

Retained is retained, whatever the purpose. And the party retaining it is, by design, unnamed. Put those two facts together and three requirements of European data protection law become unfulfillable at once, not through anyone’s negligence but by construction.

This is not an argument against stealth models, and it is not a claim that the provider is untrustworthy. It is an observation about what anonymity implies: an assurance is worth what it can be enforced for, and enforcement needs an address. A promise from a party you cannot name is a promise you cannot pursue.

The realistic risk in a mid-market company is not a considered decision to adopt this model. It is that a developer reads about a free frontier model on a Friday, wires it into a branch to see what it does, and pastes in a customer’s codebase because that is the interesting test. Nobody decided anything. The data left anyway.

What to do about it this week

• Say yes to the test, and say what it may contain. Banning it outright pushes the experiment onto private accounts where you see nothing. Allow it explicitly for synthetic and public data, and say so in one sentence rather than a policy document.
• Draw the line at personal and confidential data, and name it concretely. No customer data, no personnel data, no unpublished contracts, no proprietary source that is not already public. Concrete beats comprehensive; people remember four items.
• Check whether an OpenRouter key already exists in your organisation. The interesting question is not whether the model is approved but whether a route to it is already open. A key in a repository or a developer environment answers that faster than a survey.
• Note the preview status in your AI inventory. If you keep a list of the AI services in use, and under the AI Act it is sensible to keep one, then a model whose provider is unnamed belongs in it with exactly that entry. It documents that you looked rather than missed it.
• Set a review date rather than a decision. The identity will surface, previews end, and the terms will change with the name. A note in the calendar is worth more than a judgement formed today on incomplete information.

Conclusion

Ox Alpha is technically remarkable and, for testing, genuinely useful: a million tokens of context, video as an input, and no bill during the preview. Whether my reading of its origin holds will become clear soon enough, and I have said what would falsify it. What does not depend on the answer is the operational point. A model whose provider is anonymous cannot become part of a compliant processing chain, however good it is, because a contract needs a counterparty and a record needs a recipient. Treat it as what it is, an excellent laboratory and not a production system, tell your team the difference in one sentence, and revisit it when the name appears. If you want to know which AI services are actually in use across your organisation and which of them would survive an audit, that is precisely the purpose of a first conversation, and the practical side is covered in AI integration in the mid-market.

Frequently asked questions about Ox Alpha