On August 20, 2026, a new coding model called Ox Alpha showed up on OpenRouter and OpenCode with a 1,048,576-token context window, 131,072-token output limit, multimodal input, and — the part that made it spread fast — a completely free preview with “near unlimited” rate limits and a claimed capacity of 100 trillion tokens a day. Nobody knows who built it. Five days later, that’s still true. And per Bloomberg, Claude Code is already one of its top consumers, having pushed roughly 9.32 billion tokens through the model since launch.
That combination — frontier-class capability, zero attribution, and real developer tools already routing production coding work through it — is worth taking seriously as more than a curiosity. It’s the sharpest instance yet of a risk this blog has been tracking all year under different names: the trust boundary between your agentic coding tool and whatever’s actually running behind the API it calls.
What Ox Alpha actually is#
OpenRouter’s own listing is unusually candid about what it doesn’t know. It classifies Ox Alpha as a “stealth model,” states plainly that “OpenRouter is not the developer, owner or provider of this model,” and notes that prompts and outputs are “retained by the provider” under a separate Stealth Model Terms agreement — not OpenRouter’s own privacy policy. OpenCode’s own listing, meanwhile, advertises zero retention. Those two claims describing the same backend don’t obviously reconcile, and neither OpenRouter nor OpenCode has explained the discrepancy.
Early performance claims were dramatic before they weren’t. Developer @davis7’s initial run scored Ox Alpha above 80% on a 10-task DeepSWE subset, ahead of Claude Fable 5 (65%) and GPT-5.6-sol (52%) — numbers that lit up timelines fast. Fuller testing since has walked that back to “roughly level with GPT-5.6-sol.” Worth remembering: a 10-task subset is under 9% of the DeepSWE suite, and none of these are official vendor SWE-bench Verified submissions. Treat the benchmark story as unsettled, not as evidence Ox Alpha is secretly SOTA.
Whodunit, mostly Z.ai#
The most interesting work here isn’t the benchmark chasing — it’s the forensics. Security researcher unclecode built a fingerprinting tool that compares infrastructure signals (stack traces, error codes, tokenizer behavior) across known model families. Across 14 candidates, only Z.ai’s GLM family matched Ox Alpha on all four normalized tokenizer probes, and later forensics reportedly tightened that to a 30-of-30 tokenizer match plus a shared error code (1214) and stack-trace pattern. unclecode’s own documentation is careful to caveat that this shows “shared infrastructure, not identity” — Z.ai could be the operator, or Ox Alpha could simply be built on the same underlying stack Z.ai licenses or shares with someone else.
Z.ai (formerly Zhipu AI) is not a random guess. It previewed GLM-5 under the codename “Pony Alpha” before GLM-5.3’s official release on August 14 — the same stealth-then-reveal pattern Ox Alpha appears to be following. It’s also the company the US Commerce Department added to its Entity List on January 16, 2025, citing its role in advancing “China’s military modernization through… advanced artificial intelligence research.” Alternative theories — Xiaomi’s MiMo team, or simply an operator using OpenAI’s cl100k_base tokenizer encoding — remain on the table and unconfirmed. Nobody has claimed authorship. That silence, five days in, is itself informative.
Why this is a Claude Code story, not just an OpenRouter story#
This blog has spent a lot of 2026 covering Anthropic’s harness-level security work — deny-by-default network egress, sandbox.credentials, JWT-aware credential masking, the wildcard-deny-rule hardening in last week’s v2.1.236 release. All of that is real, and all of it protects a specific threat model: what Claude Code itself can do to your machine and your secrets.
None of it protects against the choice, made by a developer or a tool integration, to point Claude Code’s model backend at an anonymous third party. If you’re using OpenRouter as a provider — whether directly or through a proxy layer some teams wire into Claude Code for cost or model-diversity reasons — “free, frontier-class, unlimited” is exactly the kind of offer that gets production code routed through it before anyone reads the fine print. And the fine print, in this case, is a provider identity nobody can confirm and a data-retention policy that contradicts itself across two listings of the same model.
This is a different failure mode from the STDIO transport crisis, the MCP OAuth token hijacking, or Ghostjacking — Claude Code’s own architecture isn’t implicated, and there’s no CVE here. It’s closer to a supply-chain trust question: the same discipline that makes you read a LICENSE file before adopting an open-weight model (a lesson this blog drew from Kimi K3’s license surprise in July) applies just as much to where your prompts and code actually go when a model backend won’t say who operates it.
The practical takeaway#
If your team runs any workflow — Claude Code included — through OpenRouter, OpenCode, or a similar aggregator that can silently route to “stealth” models, this is worth an explicit policy conversation, not an assumption that free-and-fast means safe-by-default:
- Check what’s actually configured. A default or fallback provider setting can route real work through a model nobody vetted, especially in cost-optimization or load-balancing configurations that pick the cheapest available option.
- Treat “zero retention” claims as unverified until confirmed by the operator directly — not by a third-party aggregator restating a claim the actual provider hasn’t put its name behind.
- Don’t confuse benchmark hype with due diligence. An 80%-on-a-subset claim spreading on social media is not the same signal as an audited SWE-bench Verified score from a named lab.
Ox Alpha’s free window is reportedly closing around August 24-27 depending on the platform, which may make this whole episode moot within days — either the operator reveals itself, or the model quietly disappears the way four prior stealth releases have this year. Either way, the pattern it exposed — agentic coding tools with real, automatic model-routing flexibility, pointed at infrastructure with no confirmed owner — isn’t going away with it.
Sources:
- OpenRouter — Ox Alpha model listing (primary, fetched directly for specs, pricing, and retention language)
- SiliconANGLE — Nobody knows who built AI coding model Ox Alpha or where the code goes
- [Bloomberg, via SiliconANGLE — Claude Code and Hermes Agent token-usage figures]
- This blog’s prior coverage of the Kimi K3 license-conflation episode and Claude Code’s v2.1.234-241 hardening cycle for context on both halves of this story.