A model called OX Alpha showed up on OpenRouter on August 20. No lab name. No announcement. No documentation beyond a spec sheet: 1,048,576-token context, text and image and video input, function calling, free to use until August 27. Within 24 hours, people were routing production traffic through it.
The benchmark claim driving that adoption: 80% on DeepSWE Pass@1. For context, the numbers being passed around put Claude Fable at 65% and GPT-5.6 Sol at 52%. Those numbers came from a ten-task community test, not an audited leaderboard, but that didn't slow anyone down.
I'm not here to litigate whether OX Alpha is actually better at coding. I'm more interested in what happened to people's due diligence.
What "Stealth" Actually Means on OpenRouter
OpenRouter runs a program where labs can preview models anonymously. The provider shows up as "Stealth," and the model name is whatever the lab chooses. The idea is straightforward: labs get real-world eval data and developer feedback before a public launch. The free pricing is the mechanism. You use it, they collect your prompts.
This is not open weights. Not even close. There are no weights to download, no model card, no reproducible training details, no license. It is a closed API with an anonymous provider. The open weights community has spent years carefully distinguishing between "open weights" and "open source," and this is neither. It is anonymous commercial inference with a free trial.
The Detective Work That Unmasked It
By August 22, researchers had done the forensics. Three separate signals pointed to Zhipu AI (Z.AI) and their GLM-5.3 model.
A Java stack trace leaked through an error response, exposing internal API class names consistent with Zhipu's infrastructure. Error code 1214 matched the exact dialect used by Z.ai-hosted GLM models already available on OpenRouter. And 30 out of 30 tokenizer probes matched GLM-5.3's tokenizer exactly.
That's a strong fingerprint. Zhipu hasn't confirmed or denied it as of today.
I find the forensics revealing for what they say about the limits of "anonymous." In the modern AI stack, you leave traces at multiple layers: the error code format, the tokenizer vocabulary, the infrastructure stack. Full anonymity is harder than it looks. Every API eventually exposes its lineage somewhere.
The Problem Most Coverage Skipped
Here's what I kept waiting to see in the write-ups and mostly didn't: if you sent prompts to OX Alpha, you sent them to an entity you cannot identify, cannot hold accountable under any data processing agreement, and cannot point to a privacy policy for.
OX Alpha retains prompts, and you cannot name the company holding them.
Think about what that means if you're building a product. You don't know if the operator is in the EU, the US, or China. You don't know what jurisdiction governs data retention. If this is Zhipu AI and your users are in the EU, you may have just routed their data through a system with no GDPR data processing agreement in place. That's not a theoretical concern anymore.
The EU AI Act's GPAI enforcement powers came into force on August 2, three weeks ago. The AI Office can now request technical documentation from general-purpose AI providers and issue fines up to 15 million euros or 3% of global annual turnover. The regime applies to providers who place models on the EU market, which includes API access. Using an anonymous stealth API to serve EU users creates compliance exposure that is genuinely hard to unwind after the fact.
I'm not saying Zhipu is operating in bad faith or that GLM-5.3 is a bad model. Zhipu has been releasing competitive open-weight models for a while and they've been reasonably transparent about prior releases. The issue is that the stealth wrapper hides all of that. You have no way to verify who you're dealing with.
Why This Keeps Happening
Benchmark performance is visible and shareable. Data governance is not.
When a number like "80% on DeepSWE" circulates on X, it's easy to compare and repost. When "unknown data processing agreement with unknown jurisdiction" circulates, there's nothing to share. The incentives push teams toward evaluating capability and skipping provenance.
The other factor is the free price. In AI inference, "free" is almost always either a loss leader for market capture or a data collection mechanism. A stealth model that's free for a week, during which it collects your prompts and usage patterns, is very clearly the second one. That's not inherently malicious, but it should change your calculus about what you send it.
I've watched multiple teams over the past year route sensitive internal workflows through a new API because the benchmark was good and the price was right. The supply chain conversation always comes later, usually after a customer's legal team asks questions.
What I'd Actually Check Before Using Any New Model API
A ten-minute check that I do before wiring up any new model endpoint:
- Who is the actual provider? If the answer is "unknown," that's a stop sign for anything beyond personal experiments.
- Is there a terms of service you can read? No ToS means no agreement protecting you either.
- What data do they retain and for how long? "Free" APIs almost always retain prompts for some period.
- What jurisdiction governs the service? This matters for GDPR, EU AI Act compliance, and enterprise customers who will ask.
- Is there a data processing agreement available? EU enterprise customers require one before allowing third-party API access to their data.
OX Alpha might be a genuinely capable model if the benchmark holds up under proper evaluation. I'd be interested to run it on some internal tasks once Zhipu (or whoever it actually is) confirms their identity and publishes a real ToS. But routing production traffic through it on day one, without knowing who runs it? That's moving faster than the legal exposure warrants.
The capability race is real. But "who made this and who holds my data" is a foundational question, not a compliance checkbox you handle later.