Update, August 26: Z.ai confirmed it directly. Releasing GLM-5.3-Flash, Z.ai stated: "Before release, we tested GLM-5.3-Flash anonymously as ox-alpha on OpenCode and OpenRouter to gather user feedback." The fingerprinting evidence below — independently produced by two people using two unrelated techniques, before any official confirmation existed — pointed at the right lab and the right model family. Full details in the follow-up post. The rest of this post is preserved as originally published, as a record of what was known and how confident it was reasonable to be before the confirmation arrived.
A new model calling itself Ox Alpha appeared on OpenRouter and, per OpenCode's own announcement, as a free-for-a-week option on the OpenCode Zen plan starting August 20. It offers a 1M-token context window, multimodal input (OpenRouter's own listing states text, image, and video), and, per OpenCode's stated terms, zero data retention on prompts and completions. Stealth releases like this aren't new: a lab ships a model anonymously on a provider like OpenRouter to gather real-world signal before a named launch. By most community counts this is roughly the fifth such anonymous release in the past six months, with the four prior ones eventually traced to Chinese labs — Zhipu's GLM-5, Xiaomi's MiMo-V2-Pro, Ant Group's Ling-2.6-flash, and Meituan's LongCat-2.0. What's worth covering this time isn't the mystery itself so much as how it got resolved, and how fast.
The identity question, and two ways people actually tried to answer it
Guessing the lab behind a stealth model is usually vibes — writing style, refusal patterns, how it handles a particular kind of joke. This time, two people ran actual technical fingerprinting instead, using unrelated methods, and got the same answer.
The first: an account posting as Pliny the Liberator reported results from an automated agent that compared prompt-token counts returned by Ox Alpha's API against several candidate models across 15 probe strings — ASCII, Python source, CJK text, emoji, Arabic, Hebrew, Thai, rare Unicode, whitespace, regex, HTML, JSON, and a long repeated string. Ox Alpha's token counts matched Zhipu's GLM-5.3 exactly on all 15 probes (mean absolute error 0.0), with a constant offset of 75 tokens on every single string — consistent with a fixed chat-template wrapper added on top of an identical underlying tokenizer, not a different vocabulary. The same test against Xiaomi's MiMo-V2.5-Pro — a plausible enough candidate given Xiaomi's own MiMo-V2-Pro was one of the four prior anonymous Chinese-lab releases — came back with a mean absolute error of 65.8 and only 2 of 15 exact matches: a clear miss, not a close call.
The second, independent method: an account posting as chetaslua reported sending a deliberately malformed request that caused the server to return a raw stack trace, naming an internal class — com.wd.paas.api.domain.v4.chat.ChatCompletionRequest. Only part of that string is independently checkable: the paas/v4/chat/completions segment matches Zhipu's own documented API route (open.bigmodel.cn/api/paas/v4), which is real, verifiable overlap. The com.wd package prefix itself isn't something any public Zhipu documentation explains — it may be an internal codename with no public equivalent, so it should be read as unexplained rather than as independent confirmation in its own right. That's still a different kind of evidence than tokenizer statistics: an error message leaking server-side implementation detail, rather than an inference drawn from output behavior. Two people, two unrelated techniques, no coordination implied by either post, arriving at the same conclusion is a meaningfully stronger signal than either result alone. Still, "meaningfully stronger" isn't "confirmed": neither Zhipu, Z.ai, OpenRouter, nor OpenCode has stated anything officially about who operates Ox Alpha as of this writing.
What that does and doesn't settle
Worth being precise about what each finding does and doesn't establish. Zhipu already has a public, named GLM-5.3 with a documented text-only tokenizer. Both fingerprinting results point to Ox Alpha sharing GLM-5.3's underlying vocabulary and backend routing, not to Ox Alpha being the identical publicly released GLM-5.3 checkpoint — Ox Alpha accepts image and video input, which the public GLM-5.3 card doesn't claim to. The more defensible reading is that Ox Alpha is a next-generation or multimodal-extended variant built on the same stack, rather than the existing public model relabeled. That distinction matters and is easy to blur in a headline.
Also circulating alongside the identity guesses: a separate system-prompt extraction, posted by the same Pliny the Liberator account, claiming Ox Alpha was instructed to identify itself only as "ox-alpha, an LLM developed by an undisclosed organization" and never as any other model. This account's stated purpose is jailbreaking and prompt extraction. Text an LLM produces when asked (or manipulated) to reveal its own system prompt is not reliably the actual system prompt — models can and do fabricate plausible-sounding instructions under this kind of pressure. It's consistent with the tokenizer and stack-trace evidence in spirit — a stealth model with a scripted non-disclosure instruction is exactly what you'd expect a lab testing anonymously to configure. But it should be read as an unverified, secondhand claim about the model's own configuration, not as evidence with the same weight as the tokenizer or stack-trace findings.
The benchmark numbers are a separate, weaker claim
Community-reported scores have circulated alongside the identity story — a figure around 87.5% on something called "Kingbench," and a report of Ox Alpha beating GPT-5.6, Grok 4.6, and GLM-5.3 itself on a 10-task DeepSWE subset. Those numbers deserve real skepticism independent of the identity question: OpenRouter's own listing for the model reportedly carries no official intelligence, coding, or agentic benchmark scores, and the figures above come from small, community-run samples rather than a disclosed, reproducible methodology. A stealth model performing well is entirely plausible — Zhipu's confirmed GLM-5.3 is itself a strong recent release. But a 10-task subset and an unnamed leaderboard aren't the standard this blog holds any other benchmark claim to, and they don't get a pass here just because the identity-fingerprinting evidence happens to be unusually solid.
The other figure worth flagging as an outsized, unverified claim: OpenCode's own promotional post reportedly states capacity for 100 trillion tokens per day — on the order of 1.16 billion tokens per second, sustained. That's an extraordinary infrastructure claim on its own terms, known only from a screenshot of the post rather than a primary source, and it's worth treating with the same caution as any other self-reported capacity number until there's an independent way to check it.
The story reached prediction-market Twitter
Polymarket's own account posted about Ox Alpha — "JUST IN: Mysterious new 'Ox Alpha' AI model appears on OpenRouter with a 1 million token context window, multimodal capabilities, & no disclosed owner" — framed as breaking news, not as a linked market with priced odds. Worth being precise about that distinction: no actual Polymarket market taking bets on Ox Alpha's origin appears to exist, only the account relaying the same "mysterious model, no disclosed owner" framing every other outlet has used. What the tweet actually demonstrates is reach, not resolution. A prediction-market company's own account treating an AI stealth-release mystery as content worth posting to a general audience is a real signal of how far this story has traveled in under two days, independent of whether anyone is actually pricing the answer.
Worth restating plainly as the story spreads to a wider, less AI-focused audience: the fingerprinting evidence above is a well-evidenced leading hypothesis, not a confirmation. "Two independent fingerprints agree" is the kind of finding that's easy to round up to "we know" in retelling. Each retelling that drops a caveat turns "meaningfully stronger signal, still unconfirmed" into "it's GLM" a few shares later. The correct label for the identity question right now is unresolved, with one well-evidenced leading hypothesis — not resolved.
What to expect next (as originally published)
Watch for an official statement from Zhipu/Z.ai.Resolved August 26 — see the update at the top of this post.- Watch for a disclosed, reproducible benchmark run. If Ox Alpha's coding results hold up, a properly documented evaluation — not a 10-task community subset — is what would make that claim comparable to any other model's reported scores.
- Watch for an actual priced prediction market, if one appears. A real-money or play-money market opening specifically on Ox Alpha's origin would be a genuinely new data point — a different kind of signal than social-media fingerprinting, aggregating what a broader set of people are willing to bet on rather than what one or two technical investigators found.
Watch what happens when the free trial window ends.Resolved — it converted to GLM-5.3-Flash, attributed to Z.ai, as this post's fingerprinting anticipated.