Anonymous model Ox Alpha counts tokens exactly like GLM

A model called Ox Alpha appeared on OpenRouter on 20 August 2026 with no owner attached to it. The provider field reads “Stealth”. It is free, it accepts a million tokens of input, it takes video, and OpenRouter’s own listing says it “is developed and operated by a third-party provider who has chosen to remain anonymous during this preview”.

It is currently the only model in the stealth programme.

We ran two tests on it. Both point at the same lab.

Test one: the contract it publishes

Every model on OpenRouter carries a machine-readable record written by its provider: context length, maximum output, the exact set of API parameters accepted, default sampling settings, and how reasoning is handled.

We compared seven fields of Ox Alpha’s record against every other model in the catalogue. On 21 August that was 422 models. Three entries matched on all seven. Ox Alpha itself, Z.ai’s glm-5.3, and an alias pointing at GLM-5.3. Set aside Ox Alpha and the alias and exactly one other model shares its contract.

Taken one at a time the fields are common enough: forty-seven models carry a 1,048,576-token context, and ninety have mandatory reasoning. Requiring all seven together is what empties the field.

What rules out a house template is the discontinuity inside Z.ai’s own range. GLM-5.2 matches Ox Alpha on two of the seven fields. GLM-5.3 matches on all seven. The record changed at 5.3 and Ox Alpha changed with it.

Test two: how it counts

A tokenizer is the part of a model that turns text into the units it processes, and it is fixed at training time. A lab can rename a model, reprice it and put it behind a codename without touching how it chops up a Chinese sentence.

Every API response reports how many tokens the provider counted in the input. Send fifty strings chosen to separate tokenizers, subtract each model’s fixed overhead, and what remains is a signature.

Ox Alpha agreed with GLM-5.3 on all fifty strings, and with GLM-5.2 on all fifty as well.

The run included a control designed to break the method. Two Llama fine-tunes sold by unrelated vendors, NousResearch and sao10k, agreed with each other on 48 of 50, which shows the measurement tracks the underlying model rather than the seller. Against that baseline, Ox Alpha and GLM-5.3 at 50 of 50 is a closer match than two Llama fine-tunes are to each other.

What we are claiming

A shared tokenizer proves shared lineage, not that two models are the same model. GLM-5.2 matched all fifty strings too, so the tokenizer evidence identifies the GLM 5 generation and stops there. It is the API contract that separates the specific release.

Our reading is that Ox Alpha comes from Z.ai’s GLM 5 line, at roughly ninety-five per cent. Nobody at Z.ai has said anything, and OpenRouter has committed in its own terms to not identifying stealth providers. The remaining five per cent is real.

One detail still does not fit. Ox Alpha takes video, and Z.ai’s documentation says GLM-5.3 “currently supports text-only inputs”. Z.ai does build models that take video, and the special-token list shipped in GLM-5.2’s public tokenizer configuration already contains video boundary markers, which is suggestive rather than conclusive.

Prompts are the payment

Stealth models are free because the prompts are the payment. OpenRouter’s Stealth Program EULA says so in the payment clause: “In consideration for the provision of your User Content for Stealth Model training and improvement, access to the Stealth Models is provided to you free of charge.”

There is no setting to decline. The EULA’s own remedy is to stop: “If you do not want your User Content to be provided to Stealth Providers for Stealth Model training, then you should refrain from accessing or using the Stealth Models.”

Two of OpenRouter’s own documents also disagree on whether stealth prompts are used for training. The Ox Alpha listing page says they are not. OpenRouter’s machine-readable provider policy feed records the Stealth provider with training set to true. Anyone who has fed it something sensitive should assume the stricter reading.

The full method, the controls, the models we had to exclude and the figures behind all of it are on our Ox Alpha model page, along with the tooling, so the numbers can be re-run rather than taken on trust.