Stealth Models: Anonymous AI Launches, Their Reveals and the Licence Clause Almost Nobody Reads

When a frontier-class model appears without a name attached, the reflex is to ask who made it. That question is entertaining and, as the record up to October 2026 shows, never settled by the people asking it. The more useful question is a different one, and it has a documented answer: what exactly do you agree to when you send your first prompt to a provider whose name you are contractually promised never to learn?

Twenty-one models have launched this way since April 2025. That is enough history to stop treating each one as a curiosity and start reading them as a pattern. Below is the record, what it says about where the AI market is moving, and the clause that matters for any company subject to European law.

What is a stealth model?

A stealth model is fully usable and deliberately unattributed. It runs under a codename, it is almost always free, and it disappears or gets renamed once the provider is ready. OpenRouter, the routing platform where most of these launches happen, is explicit about the arrangement in its Stealth Program End User License Agreement: it “will not disclose the name or origin of Stealth Providers to you”. The anonymity is not a side effect. It is the product.

The reason providers do it is sound. A model released under a known brand is graded against expectations of that brand. Released without one, it collects something harder to manufacture internally: unbiased feedback and load patterns from real developers doing real work. The first public instance said so plainly. Announcing Quasar Alpha on 3 April 2025, OpenRouter added a note that has aged into the defining sentence of the whole practice: “All prompts and completions will be logged so we and the lab can better understand how it’s being used and where it can improve.”

The record up to 21 October 2026

OpenRouter’s own model entries in its openrouter and stealth sections show twenty-one stealth launches between April 2025 and 21 October 2026. Nineteen were officially resolved and two never were. The resolved cases are the interesting part.

Read the left column by year and the market moves in front of you. In 2025 the resolved anonymous launches came mostly from American labs staging their own releases: two GPT-4.1 builds, two GPT-5 checkpoints, one GPT-5.1 snapshot, two test versions each of Grok 4 Fast and Grok 4.1 Fast and one NVIDIA image-understanding model, plus an early test version of Mistral Large 3 from France, all eventually named by OpenRouter itself. Up to August 2026 every resolved case came from China, and not only from the providers a Western reader would name first. Besides Z.ai there were Xiaomi, better known here for phones, Meituan, a food delivery company, and inclusionAI, the AGI initiative of Ant Group. DeepSeek was not among them. Xiaomi and Meituan both shipped near-frontier coding models. Meituan’s ran anonymously at the top of the platform for two months before anyone knew whose it was.

That is the strategic content of this record. A company evaluating coding models on capability alone, without regard to origin, has already been using Chinese frontier models in production for months. It simply did not know, because the label was withheld precisely so that judgement would be made on output rather than provenance. Whether that is a problem depends on your compliance position. That it happened is not in dispute.

Why the guessing game cannot replace a reveal

Every stealth launch produces the same ritual: developers probe the tokenizer, ask the model about itself, compare quirks against known families, and post conclusions. The record on that method is mixed, and one case shows exactly where its limit lies.

Hunter Alpha appeared in March 2026 with a trillion parameters and a million tokens of context. Asked about itself, it said it was a Chinese model trained primarily in Chinese, and named a knowledge cutoff matching DeepSeek’s. Reporting followed accordingly: this was DeepSeek V4, arriving early. It was Xiaomi. The fingerprint had identified the language and training environment correctly and the provider not at all.

That failure is not bad luck, it is structural. Fingerprinting reads what a model was built from, and modern models are routinely built from shared foundations. An open-weight base from one country, post-training from another, inference hosted somewhere else again produce a signature that points at a lineage rather than at a company. The stronger evidence is unavailable by design, because the provider chose to withhold it.

The honest summary of twenty-one cases: not one identity was confirmed by community analysis. Nineteen were announced by the platform or the provider when it suited them, and the guesses before that were sometimes right, as with Pony Alpha, and sometimes wrong, as with Hunter Alpha. The remaining two had still not been resolved on 21 October 2026. That is worth holding on to the next time a stealth model appears and the timeline fills with confident attribution, including in my own reading of Ox Alpha, which is offered as an assessment rather than a finding for exactly this reason.

The clause almost nobody reads

Here the article stops being about industry watching and starts being about your company. Using a stealth model means accepting a separate agreement, and its content is not what most users would assume from the reassuring line on the model page.

The Stealth Program End User License Agreement, last updated 6 July 2026, provides that “your User Content may be collected by us and shared with the Stealth Provider”. Its licensing section goes further, granting “a non-exclusive, irrevocable, perpetual” licence to distribute that content to the stealth providers “for the sole purpose of enabling the Stealth Provider(s) to train, evaluate, and improve those Stealth Model(s)”. And the same document confirms that OpenRouter “will not disclose the name or origin of Stealth Providers to you”.

Set that against the provider page, which states that prompts and completions “are retained by the provider and are not used for training”. Two documents from the same platform, describing the same data, reaching opposite conclusions on training. Which one governs is a question for lawyers. Which one you should plan around is not: when a general agreement grants a perpetual training licence and a product page promises the opposite, prudence follows the agreement.

Two words in that licence deserve to be read slowly. Irrevocable means you cannot take it back. Perpetual means it does not expire when the preview does. Whatever went in stays licensed, to a party you will not be told the name of, after the model has been renamed and moved on.

What that means under European law

None of this makes stealth models illegitimate, and none of it implies the providers behave badly. It does mean that anonymity and compliance are mutually exclusive in a specific, checkable way.

The fourth row is the one companies overlook. Data protection is discussed constantly, trade secrets rarely, and yet the trade secret exposure applies even where no personal data is involved at all. Source code, pricing models and unpublished contracts carry no personal data and are frequently the most valuable thing an organisation owns. Protection depends on having taken reasonable measures to keep them secret. That defence does not survive contact with an irrevocable distribution licence granted to an unnamed recipient.

The realistic failure mode in a mid-sized company is not a considered decision to adopt a stealth model. It is a developer reading about a free frontier-class model on a Friday, wiring it into a branch to see what it does, and pasting in a client’s codebase because that is the interesting test. Nobody decided anything. The licence was granted all the same.

A workable rule

• Permit the testing, define the input. Banning stealth models moves the experimentation to personal accounts where you can no longer see it. Allow them explicitly for invented and public data, in one sentence rather than a policy.
• Name the four things that never go in. No client data, no personnel data, no unpublished contracts, no proprietary source code. Specific beats comprehensive, because four items are remembered and a policy is not.
• Check whether the route is already open. The question is not whether stealth models are approved but whether an OpenRouter key already sits in a repository or a developer environment. That answers faster than a survey.
• Treat the free tier as the price tag. Zero cost is the consideration for data and testing, which is a fair trade as long as you know what you are paying with. It becomes a bad trade the moment the payment is something you were contractually obliged to protect.
• Diarise the reveal, do not pre-judge it. Previews end and names appear, and the terms change with them. On the evidence, the name will come from the provider rather than from anyone’s analysis, so waiting costs nothing.

Conclusion

Twenty-one anonymous launches since April 2025 have turned a novelty into standard practice, and the practice is genuinely useful: these models are excellent and free, and testing them teaches you things a benchmark table will not. What the record adds is proportion. The identity you are speculating about will be confirmed by its owner or the platform, or not at all, and while everyone speculates, a licence is quietly running that is irrevocable, perpetual, and made with a counterparty you are promised never to identify. Test freely with data you could publish. Keep everything else out. If you want to know which AI services are actually in use across your business and which of them would survive an audit, that is precisely what a first conversation is for, and the practical groundwork is set out in AI integration in the mid-market.

Frequently asked questions about stealth models