How we identified two anonymous AI models, Ox Alpha and Union Alpha, before their makers did

At 04:51:17 UTC on 17 September 2026 we posted that Union Alpha, the anonymous model that had appeared on OpenRouter the previous afternoon, was Pareto, built by Circuit and Chisel and sold through Unbiased. Eighteen hours and fourteen minutes later the company posted “You found us” and named Pareto 26.9.

The method had already run once. On 21 August we published that an earlier anonymous listing, Ox Alpha, counted tokens exactly as Z.ai’s GLM-5.3 did, on all fifty of our test strings. Z.ai confirmed it five days later as GLM-5.3-Flash, a model with no public existence on the day we measured it.

Both calls are checkable, and this page is the working: the timestamps, the arithmetic, the raw completion IDs and every reading in the order we took it.

The post naming Pareto went up at 04:51 UTC

Every time below is UTC, read from the X API rather than from a screenshot, so each one can be looked up against the post ID it belongs to.

To place our post against everyone else’s, we pulled every entry in X’s index mentioning Union Alpha alongside Pareto, Unbiased, Chisel or Circuit and Chisel: 132 posts, sorted by time. Four posts from 16 September come before ours, and all four use Pareto as the economics term, praising the model’s position on the Pareto frontier of price against performance. None names the company.

So the honest claim is the narrow one. Ours is the earliest public post we can find connecting Union Alpha to Circuit and Chisel’s Pareto, and the search that establishes it is one anyone can rerun.

OpenRouter put the same point in its own words when it lifted the cloak: “Impressive detective work and demand from the community cut this stealth period short.”

The rate card falls out of Cloudflare’s own examples

Cloudflare documented Union Alpha on 16 September in pull request 33478, which added stealth-union-alpha.json alongside entries for three other models. The page carries five worked examples, each with its request, its token counts and a dollar cost.

Two of the uncached examples give two equations in two unknowns, in millionths of a dollar:

19 x input + 46 x output = 311.25
14 x input + 39 x output = 261.25

Solving returns $1.25 per million input tokens and $6.25 per million output, with nothing assumed. Those rates then reproduce the other two uncached examples to the cent. The fifth example is 29 input tokens of which 28 were cached, plus five output, at $0.0000367, and with the first two rates known it forces a third: $0.15 per million cached input.

When we ran that arithmetic, Unbiased published Pareto at exactly those three numbers. Three for three, including the cached-input discount, which is the figure a coincidence has to work hardest to produce.

Pareto’s own card has moved since. Unbiased now lists $2.50 input, $0.25 cached and $7.50 output, the paid 26.9 rates announced at the reveal. The match we found dates the documents it was run on: those examples were priced the way Pareto was priced when they were written.

One caution we published at the time and keep here. The arithmetic connects two documents, Cloudflare’s page and Unbiased’s price list. On its own it leaves open that Cloudflare’s entry was adapted from Pareto’s documentation while a third party served the endpoint, in which case both clues share one origin and must never be multiplied together as independent evidence. What closed that distance was the reveal.

The same endpoint counted tokens two different ways

The second leg was the measurement. Only one number is read, usage.prompt_tokens, with the reply capped at one token, so nothing the model generates can reach it.

A tokenizer is exactly proportional to its content, which gives a test that needs no trust in the endpoint’s overhead. Send a string, then send twice as much of the same content, and subtract. Everything fixed cancels, the chat template included, and what survives is the content’s own cost.

Thirty digits are the sharpest single probe. The Llama 3 vocabulary bundles digits in threes, so thirty digits cost it ten tokens. The Qwen vocabulary splits them one per token, so the same thirty cost thirty. Union Alpha returned both, from requests identical down to the byte.

Scored across all fifty strings against a frozen corpus of 291 models measured on 3 September, one reading matches the Llama 3 family on 47 and the other matches the Qwen family on 46, against a median of 12. Forty-three of the fifty strings returned both, and not one returned a reading that fitted neither.

There is a control that makes this mean something. Union Alpha is tagged tokenizer: "Other" in OpenRouter’s metadata, and if that tag made the platform fall back to one shared estimator, every model carrying it would score alike. In the corpus, 104 models carry the same tag and their scores run from 94% down to zero. The agreement is a property of the models.

An image made it answer as a third family

Attach an image and the alternation stops. Fourteen identical readings out of fourteen, and the same under a tool declaration, both landing on the GLM family rather than on either text path.

Digits cannot separate Llama 3 from GLM, because both charge ten for thirty, which is why the image path needs strings chosen to split them. Our first reading of that path used digits and landed in the Llama 3 group. Re-running with eight strings that do separate the two, drawn from emoji, Thai, Hindi and combining marks, the image path resolves to the GLM family on seven of eight, while plain text under those identical strings resolves to Llama 3 on eight and Qwen on three, with no GLM at all.

Three tokenizers behind one address is the finding, and at the time we could not say what produced it. A router picking a model per request, speculative decoding with a draft model from another family, and two backends under an A/B test all produce the same signature. The reveal named the shape: several models working the same request, which carries several tokenizers because it carries several models.

The completion IDs carry a clock

Cloudflare’s five archived examples each carry a generation ID. These are the raw values, still on the page today:

chatcmpl-mu3b7o02sf9tov9z
chatcmpl-mu3b7pxpj3kdi2v5
chatcmpl-mu3b7t0objtvuaa4
chatcmpl-mu3b7wo2jrkvi2t8
chatcmpl-mu3b80ptkze4dltt

Read the first eight characters as base-36 milliseconds since the epoch and they decode to a single run:

Five calls inside 16.479 seconds, strictly increasing, in the order the file lists them, about 15.1 hours before the OpenRouter catalogue record was created. That is what a scripted capture run looks like shortly before a launch.

It also explains something about the pattern Palmer matched. He identified Union Alpha’s completion IDs as chatcmpl-mu followed by 14 lowercase alphanumeric characters. The mu is the leading edge of that clock: in this scheme every ID minted between 13 September and 8 October 2026 begins mu. So the prefix match carries an era and a shared ID-minting library, which makes it a lead. The load-bearing half of his finding is the other one.

What the clock establishes is narrow. It dates the completion. Whoever ran the capture, and the moment the cost field beside it was calculated, both sit outside what an ID can carry.

Palmer read the plumbing and arrived at the same name

A researcher posting as Cary Palmer worked the infrastructure while we worked the documents, and published his own identification at 21:17:43 UTC on 17 September, before the reveal. He reported matching the completion-ID pattern exactly against The Unbiased Co’s platform, then watching a request he sent to Union Alpha answered by the same vLLM fleet that answers Unbiased. He closed with “CASE CLOSED”, and three minutes later credited the earlier work here.

Weigh the two observations differently. An ID format travels between systems that share software, and as the clock above shows, part of that prefix is a date. Two names answered by one backend fleet is the strong one. Both are his reports of his own testing rather than something anyone else can rerun, and the confirmation arrived two hours later in the operator’s own words.

We read Qwen first, then Llama 3, then the blend

On 16 September our research register measured Qwen, on 46 of 50 strings. By that evening we had re-measured and read Llama 3, on 47 of 50, which is where an independent toolkit, stealthprint, had arrived from its own testing, and that is the reading our first public post on the tokenizer carried. The register keeps every reading in the order we took it, because the sequence is the evidence.

Both counts came from real tokenizers, because the endpoint was returning both from byte-identical requests. That pair is what sent us looking for a system behind the address. A third team reported GLM behaviour on image requests, and once we re-ran that path with strings chosen to separate GLM from Llama 3 we reproduced it exactly: a third family, on images and on tool declarations.

Three families behind one address, each of them a real component, and the differential test named all three. That is the reading the reveal confirmed, and the register carries each step that got there.

Ox Alpha in August is where the method came from

Ox Alpha appeared on OpenRouter on 20 August 2026, free, with a million-token context and video input, and no stated owner. Two measurements ran against it.

The API contract came first. Of the 418 models OpenRouter listed, exactly three carried Ox Alpha’s complete seven-field contract: the stealth entry itself, z-ai/glm-5.3, and the ~z-ai/glm-latest alias. GLM-5.2 matched two fields of seven, so the contract had changed at the 5.3 generation rather than being a standing Z.ai template.

The tokenizer came second, and it is the measurement the obvious objection cannot explain, because the inference backend produces it rather than OpenRouter’s metadata. On the fifty strings, Ox Alpha and GLM-5.3 returned identical counts every time. Kimi K3 is the control: it carries the same tokenizer: "Other" tag and scored 18%.

We published on 21 August. Z.ai confirmed on 26 August, and the answer carried a correction for us: the model was GLM-5.3-Flash. Our own write-up had already flagged the misfit that turned out to be the key, because Ox Alpha accepted video, and video arrived in the series with the Flash model, the first natively multimodal one.

How far this evidence goes

Read precisely, the token counts support less than people want them to, and the discipline is the whole of the method.

• A shared vocabulary places a family, and families have guests. Perplexity’s Sonar pair and the Hermes line sit in the Llama 3 group, Kwaipilot sits in the Qwen group, and none of those companies created the vocabulary it uses. Kwaipilot’s KAT Coder returns counts identical to Qwen 3.6 on all fifty strings, so the test cannot separate them at all.
• Input accounting follows the text as far as the tokenizer and no further. Under a blend that reading held exactly: the models that counted the prompts sat inside a system that also called stronger ones to write the answers.
• The documents name the operator. The pricing, the architecture wording, the completion IDs and the infrastructure trace carried this from a family to a company. The tokenizer’s job was to place the family, and it did that to 47 of 50.

Fingerprinting a stealth endpoint now means fingerprinting a system. Our full method, including the controls that stop a false positive, is written up in how to identify a stealth AI model, and the measurements sit on the model fingerprints page with the raw readings beside them.

Check it yourself

Open Cloudflare’s model page and read the five examples: the token counts, the costs and the completion IDs are all there. Two of them give the rate card. Decode a completion prefix with one line:

node -e 'console.log(new Date(parseInt("mu3b7o02",36)).toISOString())'

The frozen catalogue revisions, the tokenizer readings, the differential pairs and the 291-model scoring corpus are committed in our research folder, and the dated claims we wrote before the reveal are in it too, scored against what the reveal showed.