Ox Alpha: What the Stealth Model Could Do, Who Was Behind It, and What Companies Must Settle First

On 20 August 2026 a model appeared on OpenRouter with a context window of one million tokens, accepting text, images and video, costing nothing, and belonging to nobody anyone could name. It was called Ox Alpha. For a developer that was a gift. For a company subject to data protection law it was a question that had to be answered before the first prompt, and the answer sat in a single sentence most readers scrolled past.

Ox Alpha was GLM-5.3-Flash. Z.ai released the model on 26 August 2026 and stated that it had previously been previewed under that alias. The OpenRouter model page answers the question directly: “the stealth model Ox Alpha was revealed to be ZAI’s new model, GLM-5.3 Flash”. It is a 320B-parameter mixture-of-experts with 18B active, natively multimodal, and the weights are published on Hugging Face under the MIT licence.

Our assessment of 22 August turned out half right, and the half that held was the contested one: the GLM foundation was correct, the attribution to Cursor’s Composer was wrong. It failed exactly on the condition we had stated in advance: the model appeared under a lab’s own name with no editor product attached. How we arrived at the assessment and where it failed is set out further down.

With the reveal, the obstacle described in the data protection section further down fell away for companies: a model from an anonymous provider could not become part of a compliant processing chain, because an anonymous provider cannot be a named processor. It was replaced by a choice with three legally distinct answers: Z.ai’s own API in China, a Western provider running the same weights, or operation on your own infrastructure. The full analysis is in GLM-5.3-Flash: what open weights change.

What was documented during the preview

Everything in this table comes from the preview model page itself, not from coverage of it. That distinction mattered more than usual here, because almost everything else written about this model during the preview was inference.

Positioning, according to the listing, was coding, sustained agentic work and production use, meaning long-running software tasks rather than single questions. Benchmark scores circulated in the community, some of them flattering, and this article deliberately does not repeat them as fact. They came from individual runs by third parties, not from a published evaluation by the provider, for the simple reason that during the preview there was no provider to publish one.

How to test a stealth model sensibly

The model ID during the preview was stealth/ox-alpha, and like every model on OpenRouter the interface is OpenAI-compatible. In practice that means existing code usually needs three changes and no rewrite: the base URL points to OpenRouter, the key becomes an OpenRouter key, the model name becomes the model’s ID. After the reveal on 26 August 2026 the model appeared on OpenRouter as GLM-5.3-Flash.

Because such a preview costs nothing, the sensible use is the kind of test you would otherwise avoid on cost grounds. Feed the model a whole repository and ask for an architecture summary. Give it a two-hundred-page specification and have it list the contradictions. Hand it a long video and ask what happens in it. Those are the questions a million-token window is actually for, and running them at zero cost tells you whether that window is genuinely usable or merely advertised.

What not to put in is the subject of the section after next, and it is the part worth reading before the first request rather than after.

Five theories about the origin, and which was right

Guessing the lab behind a stealth model has become a small sport, and the arguments are more interesting than the guesses. The strongest evidence anyone can gather from the outside is the tokenizer, meaning the way a model chops text into units before processing it. That choice is made early in training, it leaves a measurable fingerprint, and it is awkward to disguise.

None of this was confirmed during the preview; the only confirmed statement was OpenRouter’s own: the provider wished to remain anonymous. The reveal on 26 August 2026 proved the first theory right: Ox Alpha was GLM-5.3-Flash from Z.ai.

My reading of 22 August: Composer 3 on a GLM foundation

Since a piece like this is more useful with a position than without one, I committed to one on 22 August, clearly marked as an assessment rather than a finding. I considered the fifth theory the most probable: Ox Alpha was Cursor’s next Composer generation, built on the GLM architecture and served on infrastructure only a very small number of operators can supply. The GLM half held; the Composer half did not.

Three observations led there. The first was that the fingerprint evidence pointed to a Chinese architecture while the model did not behave like a purely Chinese product in other respects. That combination did not look like a contradiction; it is what a Western post-train on an openly published Chinese base looks like from the outside. The second was capacity. The figure circulating for the preview was on the order of one hundred trillion tokens per day, and whether or not that exact number held, a free frontier-class preview implied serving capacity that only a handful of operators worldwide possess. The third, and it carried the most weight: the precedent was documented. Cursor built Composer 2 on Kimi K2.5, an open-weight model from the Beijing company Moonshot AI. The announcement of 19 March 2026 said nothing about it. Moonshot’s own staff noticed, and only on 21 March did Cursor acknowledge it. Lee Robinson put the base at roughly a quarter of the pretraining, with Cursor contributing the remainder through its own continued training. Co-founder Aman Sanger called it a miss not to have named the Kimi base in the blog post from the start, and said they would fix it for the next model.

That made the pattern demonstrated rather than hypothetical: an open Chinese foundation, a Western post-train, and a result that sits cleanly in neither camp. It seemed to be precisely what observers reported about Ox Alpha, and the episode would have explained why a successor would be trialled anonymously: a company publicly criticised for an undisclosed model base has every reason to let the next one be tested without a nameplate. In hindsight the simpler explanation was the right one: a GLM-like fingerprint came from a GLM model, and the additional assumption of two organisations quietly cooperating was unnecessary.

The conditions under which the reading would fall were stated in advance, so that it could be checked rather than believed: if the model appeared under a lab’s own name with no editor product attached, the Composer part would fall; if a published technical report showed a tokenizer built from scratch, the GLM part would fall; and if the eventual owner turned out to operate its own large fleet without partnering, the third leg would fall with it. I had expected an answer within weeks rather than months; it came after six days and met the first condition: Z.ai released the model under its own name on 26 August 2026, with no editor product attached.

Why spend paragraphs on a guessing game at all: because the answer decides who has been storing your prompts. That is not trivia. It is the identity of a processor you would otherwise have to name in a contract.

The sentence that matters for companies

On the preview model page, between the technical specifications and the terms, sat this: prompts and completions are retained by the provider and are not used for training. Most readers stop at the second half and are reassured. The first half is the one with consequences.

Retained is retained, whatever the purpose. And during the preview the party retaining it was, by design, unnamed. Put those two facts together and three requirements of European data protection law became unfulfillable at once, not through anyone’s negligence but by construction. That holds for every stealth model as long as its provider stays unnamed.

This is not an argument against stealth models, and it is not a claim that the provider is untrustworthy. It is an observation about what anonymity implies: an assurance is worth what it can be enforced for, and enforcement needs an address. A promise from a party you cannot name is a promise you cannot pursue.

The realistic risk in a mid-market company is not a considered decision to adopt this model. It is that a developer reads about a free frontier model on a Friday, wires it into a branch to see what it does, and pastes in a customer’s codebase because that is the interesting test. Nobody decided anything. The data left anyway.

What to do about stealth models

• Say yes to the test, and say what it may contain. Banning it outright pushes the experiment onto private accounts where you see nothing. Allow it explicitly for synthetic and public data, and say so in one sentence rather than a policy document.
• Draw the line at personal and confidential data, and name it concretely. No customer data, no personnel data, no unpublished contracts, no proprietary source that is not already public. Concrete beats comprehensive; people remember four items.
• Check whether an OpenRouter key already exists in your organisation. The interesting question is not whether the model is approved but whether a route to it is already open. A key in a repository or a developer environment answers that faster than a survey.
• Note the preview status in your AI inventory. If you keep a list of the AI services in use, and under the AI Act it is sensible to keep one, then a model whose provider is unnamed belongs in it with exactly that entry. It documents that you looked rather than missed it.
• Set a review date rather than a decision. The identity surfaces (with Ox Alpha after six days), previews end, and the terms change with the name. A note in the calendar is worth more than a judgement formed on incomplete information.

Conclusion

Ox Alpha was technically remarkable and, for testing, genuinely useful: a million tokens of context, video as an input, and no bill during the preview. My reading of its origin held by half: GLM foundation yes, Composer no. What does not depend on that answer is the operational point, for this and for every future stealth model. A model whose provider is anonymous cannot become part of a compliant processing chain, however good it is, because a contract needs a counterparty and the record has to state whether and to which third country data is transferred. Treat it as what it is, an excellent laboratory and not a production system, tell your team the difference in one sentence, and revisit it when the name appears. If you want to know which AI services are actually in use across your organisation and which of them would survive an audit, that is precisely the purpose of a first conversation, and the practical side is covered in AI integration in the mid-market.

Frequently asked questions about Ox Alpha