Bloomberg’s report, republished by The Business Times, captured the reason Ox Alpha spread so quickly: a powerful model arrived without a vendor name and with free, near-unlimited access for a short period. International Business Times Australia added the community speculation that its technical behavior resembles Z.ai’s GLM line, formerly associated with Zhipu AI. That theory is unconfirmed. OpenRouter identifies the creator only as an anonymous third-party “Stealth” provider, while neither Z.ai nor another named lab has publicly claimed Ox Alpha.
For Windows developers and IT teams, the useful conclusion is more immediate: Ox Alpha is a legitimate live model listing, but it is a test-only option for non-sensitive material until its operator, data handling, and post-preview terms are clear.
OpenRouter’s listing confirms the model, not its maker
OpenRouter’s public model page lists Ox Alpha under the identifier stealth/ox-alpha, released August 20, 2026. The platform describes it as a reasoning model for coding, sustained agentic work, production workloads, and long-horizon software engineering. Its live metadata reports a 1,048,576-token context limit, up to 131,072 completion tokens, mandatory reasoning, function calling through tools and tool_choice, and JSON output through response_format.
Those are substantial capabilities for a free preview. A one-million-token context can accommodate a large repository, documentation set, issue history, logs, and test output in one working session. The model also accepts images and video, which makes it theoretically useful for examining UI screenshots, visual regression artifacts, screen recordings, and design references alongside code.
OpenRouter’s usage page shows that the model has already been heavily exercised by coding-agent services including Hermes Agent, Claude Code, DeepSeek Harness, omp, and pi. Those numbers demonstrate demand and accessibility; they do not establish code quality, reliability, security, or benchmark leadership. Neither OpenRouter nor the anonymous provider has published a model card, safety report, training-data disclosure, supported-language matrix, or independently audited coding evaluation for Ox Alpha.
That missing documentation matters more than the model’s rumored origin. Developers have no published statement on model versioning, deprecation policy, regional processing, incident response, service commitments, or whether behavior can change without a new model identifier. A model that is highly capable during a one-week preview can still be unsuitable as a production dependency.
“Free” has different meanings on OpenRouter and OpenCode
The two access paths now circulating under the Ox Alpha name should not be treated as interchangeable.
On OpenRouter, the model is free at the time of publication: both prompt and completion token prices are listed as zero. OpenRouter also says the model is run by an anonymous third-party provider, not by OpenRouter itself. Its model page states that prompts and completions are retained by that provider, though they are not used for training.
That statement is narrower than a zero-retention promise. Retention means the provider keeps a copy. “Not used for training” limits one declared purpose, but it does not answer how long content is retained, where it is stored, who can access it, how it is secured, or how a user could request deletion. It also does not convert an anonymous provider into an approved vendor for an organization with contractual, regulatory, or customer-data obligations.
OpenRouter’s broader Stealth Program agreement adds another important caveat. The agreement says stealth models are generally offered free in exchange for user content that may be collected and shared with the unnamed provider for model training and improvement. It grants OpenRouter a perpetual, transferable license to store and use content for the program and to provide it to the applicable stealth provider for training, evaluation, and improvement.
Ox Alpha’s individual model card says its provider does not use prompts and completions for training, while the general Stealth Program agreement describes the opposite default for the program. The model-specific statement is the more precise description of Ox Alpha’s stated treatment, but the two documents leave an operational ambiguity that OpenRouter has not publicly resolved: whether Ox Alpha has a provider-specific exception to the program’s general training terms, and what exact terms control if the documents conflict.
OpenCode’s Zen documentation presents a materially different claim. It lists “Ox Alpha Free” under the internal model ID x-preview-f-free, says the access is free for a limited time, and says the provider follows a zero-retention policy and does not use data for model training. Its privacy documentation separately says its models are hosted in the United States, with the listed exceptions—and Ox Alpha is not among those exceptions.
The documentation does not publicly establish that OpenCode’s x-preview-f-free endpoint and OpenRouter’s stealth/ox-alpha route terminate at the same upstream provider or infrastructure. That distinction is vital. A zero-retention promise on OpenCode Zen cannot automatically be carried over to direct OpenRouter use, and OpenRouter’s retention statement should not automatically be applied to OpenCode’s separately documented route.
The China theory remains a fingerprint, not an identification
The most repeated explanation for Ox Alpha’s identity is that it is a Z.ai GLM-family model, perhaps an unreleased or specially configured derivative. International Business Times Australia, citing several smaller AI-tracking outlets, reported claims of tokenizer matches, similar error behavior, and a shared error code. Some developers on public forums have also reported behavior they believe resembles GLM 5.3.
There is a real basis for the speculation: OpenRouter’s metadata for both Ox Alpha and Z.ai GLM 5.3 lists the same one-million-token context length, 131,072-token maximum completion size, mandatory reasoning, the same max, high, and low reasoning-effort choices, tool calling, JSON response formatting, and matching default temperature and top-p settings. Those are suggestive implementation similarities, not proof of common ownership. Shared API options can result from compatible serving layers, common software frameworks, deliberate imitation, or a model wrapper.
There is also a key technical difference in the listings. GLM 5.3 is listed as text-to-text, while Ox Alpha is listed as accepting image and video input in addition to text. If the GLM theory is right, Ox Alpha may be a multimodal variant, a routed composition, or a wrapper around more than one internal component. If it is wrong, the shared metadata could be designed to invite exactly this kind of speculation.
No public, primary-source confirmation currently ties Ox Alpha to Z.ai, Alibaba’s Qwen team, Xiaomi, Moonshot AI, ByteDance, or another Chinese lab. The safest description is therefore “anonymous provider,” not “Chinese model.” For a security review, the operational problem is the same regardless: the identity, jurisdiction, infrastructure, and contractual accountability of the operator have not been disclosed on the OpenRouter route.
Treat it as an external experiment, not an approved coding assistant
Teams evaluating Ox Alpha should use it for the kind of work that can safely leave the organization and be retained by an external party: synthetic repositories, public open-source bugs, deliberately scrubbed logs, toy projects, generated test fixtures, or code already intended for public release.
Do not submit proprietary repositories, private Git diffs, production configuration files, customer tickets, crash dumps, API keys, access tokens, internal architecture diagrams, security findings, or unredacted screenshots. Multimodal input increases the chance of accidental disclosure: a screenshot can contain usernames, tenant IDs, document titles, IP addresses, browser tabs, customer names, or secrets in a terminal pane.
A sensible evaluation should also separate model capability from tool privilege. Do not grant an experimental model write access to a working repository, deployment credentials, cloud consoles, package publishing, or CI/CD secrets merely because it produces strong code suggestions. Run it in a sandbox, require human review, and verify generated changes with tests, static analysis, dependency scanning, and ordinary code review.
The model’s stated support for long-running agent work makes this especially important. Agentic systems can pull more context than a developer realizes, follow linked files into sensitive directories, and generate actions that look plausible but do not match a team’s security controls. A million-token window is an advantage only if the material placed in it is appropriate for an unknown provider to process.
The preview may disappear before its reputation settles
OpenRouter’s Stealth Program terms say models can be removed at the provider’s request or at OpenRouter’s discretion, with or without notice. The current zero-dollar price therefore has no bearing on future pricing, capacity limits, availability, or model continuity. Any proof of concept built around Ox Alpha should make the model configurable and preserve a fallback to a named, approved provider.
The free access window has delivered what it was designed to deliver: enormous developer attention and a large volume of real coding-agent traffic. What it has not delivered is the vendor transparency needed for enterprise adoption. Until the provider identifies itself and reconciles the OpenRouter retention language with the program’s general training terms, Ox Alpha belongs in a disposable test environment—not in a Windows development pipeline that handles code or data the organization cannot afford to surrender.