Ox Alpha

What Ox Alpha is

On 20 August 2026 a model called Ox Alpha appeared on OpenRouter with no owner attached to it. The provider is listed as “Stealth”. The model ID is stealth/ox-alpha. It costs nothing, it takes a million tokens of input, and it accepts video.

OpenRouter’s own listing is direct about the arrangement: “Ox Alpha is a stealth model. It is developed and operated by a third-party provider who has chosen to remain anonymous during this preview. OpenRouter routes requests to it and is not its developer, owner, or provider.”

The published specification is unusually generous for a free listing:

OpenRouter’s stealth landing page states that Ox Alpha is currently the only model in the programme. That page carries usage charts rather than a published total, so we are not putting a traffic figure on it.

What you give up to use it

This part is worth reading before the fingerprinting, because it is the part that affects anyone who has already sent Ox Alpha their work.

OpenRouter runs the stealth programme under a separate agreement, the Stealth Program EULA, last updated on 6 July 2026. It states the trade without dressing it up. Anonymous providers offer models free “for purposes of collecting User Content”, and the payment clause says so outright: “In consideration for the provision of your User Content for Stealth Model training and improvement, access to the Stealth Models is provided to you free of charge.”

There is no setting to turn this off. The EULA’s own remedy is to stop using the model: “If you do not want your User Content to be provided to Stealth Providers for Stealth Model training, then you should refrain from accessing or using the Stealth Models.”

Sending a request also grants OpenRouter “a non-exclusive, irrevocable, perpetual, transferable, worldwide, fully paid-up, royalty-free license” over what you send, including the right to pass it to the anonymous provider. The stated safeguard is that content reaches the provider carrying a hashed identifier, and that the provider is contractually forbidden from re-identifying users. The content itself is not anonymised. Anything you type about yourself or a third party goes across.

Two of OpenRouter’s own documents disagree about training. The Ox Alpha listing page says prompts and completions are retained by the provider but are not used for training. OpenRouter’s machine-readable provider policy feed records the Stealth provider as "training": true and "retainsPrompts": true. That feed is the structured data OpenRouter’s own Provider Logging documentation describes as reflecting each provider’s policies. We are not able to say which is correct. Anyone who has fed a stealth model something they would not hand to an unnamed company should assume the stricter reading.

Why anyone bothers to identify it

Stealth listings are how labs get real traffic on an unreleased model without announcing it. The pattern has a history on OpenRouter, and the history is public.

Quasar Alpha and Optimus Alpha ran anonymously through spring 2025 and were revealed on 14 April 2025 as tests of OpenAI’s GPT-4.1, which OpenRouter stated in its own reveal post. The reveal was timed to the real model going generally available, and the free endpoints were killed rather than redirected, so calls returned a 404 instead of silently billing anyone.

The cloak can go further than a codename. For Cypher Alpha in July 2025, OpenRouter described the model in its own announcement as presented from Cypher Labs, which it identified as a fictional provider. An invented company was printed on the listing.

Nobody is going to answer the question if you ask it, so the only way to an answer is measurement.

How we tested it

Two measurements, both on data the model does not control and cannot choose to withhold. We ran both again on 21 August 2026, the day this page was published, rather than relying on an earlier run.

Test one: the published API contract

Every model on OpenRouter carries a machine-readable record: context length, maximum completion tokens, the exact set of API parameters it accepts, its default sampling settings, and how it handles reasoning. That record is written by the provider.

We took Ox Alpha’s record and compared seven fields of it against every other model in the catalogue. On 21 August the catalogue held 422 models.

Three catalogue entries matched on all seven fields. They were Ox Alpha itself, z-ai/glm-5.3, and ~z-ai/glm-latest, which is an alias pointing at GLM-5.3. Discount Ox Alpha and discount the alias, and exactly one other model in the catalogue shares Ox Alpha’s complete published contract: GLM-5.3.

Taken one at a time the fields are common enough: forty-seven models carry a 1,048,576-token context, and ninety have mandatory reasoning. Requiring all seven together is what empties the field.

What makes this more than a coincidence of house style is the discontinuity inside Z.ai’s own range. GLM-5.2, from the same lab, matches on two of the seven fields. GLM-5.3 matches on seven. A static per-lab template would produce the same record across a lab’s models. This one changed at 5.3 and Ox Alpha changed with it.

Z.ai documents that contract itself. Its GLM-5.3 page states the model “always operates with reasoning enabled and supports three reasoning effort levels: low, high, and max. Disabling reasoning is no longer supported”, and specifies “a 1M-token context window and a maximum output length of 128K tokens”. Ox Alpha’s listing reports the same three effort levels, the same mandatory reasoning, 1,048,576 tokens of context and 131,072 of output.

Test two: how it counts tokens

The stronger test, because a catalogue record could in principle be copied and a tokenizer cannot.

A model’s tokenizer is the part that turns text into the units it actually processes. It is fixed at training time. A lab can rename a model, reprice it, put it behind a codename and rewrite its description, and none of that touches how the model chops up a Chinese sentence or a family emoji.

We do not need the model to tell us anything. Every API response reports usage.prompt_tokens, the number of tokens the provider counted in the input. Send fifty carefully chosen strings, read the count each time, and you have a signature.

One complication has to be removed first. Every model carries a fixed overhead: a chat template, and often a hidden system prompt. Measure it once with a single character and subtract it, and what remains is the marginal cost of the test string under that model’s own tokenizer.

That overhead is itself revealing. Sending the single character x to GLM-5.3 reports 13 prompt tokens. Sending the same character to Ox Alpha reports 88. There are about seventy-five tokens of instruction sitting in front of every request to Ox Alpha that the user never sees, which is consistent with a model being run under a cloak.

The fifty strings are chosen to force disagreement between tokenizers that look identical on English prose: Chinese, Japanese kana and kanji, Korean, Thai, Arabic, Hebrew, Cyrillic, Greek, Hindi, emoji with skin-tone modifiers and zero-width-joiner families, long digit runs, whitespace runs, rare Unicode, and code.

What the tokenizer test found

Ox Alpha agreed with GLM-5.3 on all fifty strings. It agreed with GLM-5.2 on all fifty as well.

Here is what that looks like on four of the strings, as marginal token counts:

Mistral Small, run alongside as a further comparison, spent 19 tokens on the Chinese sentence, 18 on the family emoji and 29 on the digit run.

Note the Thai row. Ox Alpha and GLM-5.3 both spend more tokens there than the Llama model does. Efficiency is beside the point here. A fingerprint has to match on the awkward details as well as the flattering ones, and this one does.

The control, which is what makes it evidence

A test that cannot fail proves nothing, so the run included a control designed to break the method if the method was breakable.

The Llama3 tokenizer family is sold by several different vendors who fine-tune the same base model. If our measurement were picking up the seller rather than the underlying model, those would scatter. Two of them, NousResearch’s Hermes 3 and sao10k’s Euryale, agreed with each other on 48 of 50 strings, across two unrelated companies. That is the method working: it tracks lineage, not vendor.

Set the full result against that baseline:

Ox Alpha matches GLM more closely than two Llama fine-tunes match each other.

Eight of the fifteen models in the run were excluded rather than scored. Six reported different token counts for identical inputs on repeated calls, one returned counts a cache had clearly disturbed, and one, Google’s Gemini 3.7 Flash, never answered the probe at all. A provider whose accounting moves under a fixed input cannot be measured this way, and reporting a distance for it would be inventing precision. The exclusions are in the results file rather than averaged away.

How far the evidence goes

A shared tokenizer proves shared lineage. It does not prove two models are the same model.

The difference is load-bearing here, because GLM-5.2 matched Ox Alpha on all fifty strings too. The tokenizer is shared across the GLM 5 generation, so the tokenizer evidence identifies the family and stops there. It is the API contract, where 5.2 matches on two fields of seven and 5.3 on seven of seven, that separates the specific release.

Nobody at Z.ai has said anything about this, and we have not asked them to confirm a model they are running anonymously. OpenRouter has committed in its own EULA not to identify stealth providers. There is no announcement, no filing and no statement to point at, and there will not be one until the lab decides there should be.

Our reading is that Ox Alpha comes from Z.ai’s GLM 5 line, and we put it at roughly ninety-five per cent. The residual five per cent is genuine and we are not going to argue it away.

The detail that does not fit

Ox Alpha accepts video. Z.ai’s own documentation says GLM-5.3 “currently supports text-only inputs”.

That is a real inconsistency and it is the strongest thing anyone could hold against this reading, so here is the evidence on both sides.

Z.ai does build models that take video. GLM-5V-Turbo, released 1 April 2026, is documented as processing “images, video, and text”. GLM-4.6V and GLM-4.5V do the same. Its API accepts a video_url content part with published limits: 200 MB per video, mp4, mkv or mov.

More directly, the tokenizer itself already knows about video. The special-token list shipped in GLM-5.2’s public tokenizer_config.json includes <|begin_of_video|> and <|end_of_video|> alongside the image and audio boundary tokens. The vocabulary the text-only model ships with has video markers built into it.

The reading that fits everything on the table is that Ox Alpha is a multimodal member of the GLM 5 line that has not been announced, sharing the generation’s tokenizer and 5.3’s API contract while adding the video input the vocabulary was already carrying. That is an inference. We are labelling it as one.

Who Z.ai is

Worth stating, since the conclusion points there.

The company is Beijing Zhipu Huazhang Technology, 北京智谱华章科技股份有限公司, established on 11 June 2019 and converted to a joint stock company in March 2025. It listed on the Hong Kong Stock Exchange Main Board on 8 January 2026 under stock code 2513, at HK$116.20 per H share, using Chapter 18C of the listing rules for specialist technology companies because it could not meet the ordinary financial tests. Its 2025 annual report gives total revenue of RMB724.3 million, up 131.9 per cent year on year. In June 2026 the board proposed changing the English name to Z.AI Co., Ltd. and the exchange’s own listed-company records now return “Z.AI” for that code.

The international z.ai platform is operated by a Singapore entity, JINGSHENG HENGXING TECHNOLOGY PTE. LTD., under Singapore law.

GLM-5.3 itself was announced on Z.ai’s blog on 14 August 2026, six days before Ox Alpha appeared. Its standalone API was listed as coming later, and Z.ai said on its own blog that it would release the weights two weeks after launch, once safety evaluation and hardening were complete. As of 21 August there is still no GLM-5.3 repository in Z.ai’s Hugging Face organisation.

What happens next

Stealth listings end. The EULA states that “any access to a Stealth Model will be limited in time and Stealth Models may be removed from our Stealth Program at any time upon request of the Stealth Provider or at OpenRouter’s sole discretion”.

There are two documented endings. A model is revealed and retired, as Quasar and Optimus were when GPT-4.1 shipped. Or it is deprecated in favour of a second codename under the same cloak, as Horizon Alpha was when its page was changed to point at Horizon Beta.

If our reading holds, the reveal arrives when Z.ai ships the model publicly. We will update this page when it does, and say whether we were right.

How to check this yourself

The tooling and the frozen data are in our repository, so the figures on this page can be re-run rather than taken on trust. The catalogue was snapshotted on 21 August, the day these figures were taken, and committed alongside the code, so “3 of 422” stays checkable after the stealth listing is renamed or withdrawn.

Both tests read only what providers publish about themselves: catalogue records from a public endpoint, and token counts returned in ordinary API responses. No user data is involved anywhere in the method.