A model that nobody will take credit for is quietly being stress-tested across the industry. It is called Ox Alpha, it appeared on the AI marketplace OpenRouter last week as a stealth release from an anonymous third-party provider, and it is free, with a context window of just over a million tokens and the ability to read text, image and video. The open-source coding agent OpenCode says it will stay free for a week with near-unlimited usage, and that whoever runs it has capacity for 100 trillion tokens a day. That is not a hobby project.
Developers rate it, and rate it highly. Stripe chief executive Patrick Collison tried it and called it "very impressive." The interest is concentrated where it counts: coding. One developer, Ben Davis, pulled 10 real software-engineering tasks from the DeepSWE benchmark, in which a model must read a repository, find the bug, edit the code and iterate against failing tests. Ox Alpha solved 8 of them, an 80% pass rate that edged out named frontier models on the same small sample. A separate subset produced a more modest 63%. The sample is tiny and the configurations differ, so nobody can rank it precisely yet. But "approaching the top tier" is a fair reading.
The guessing game is where the fun is. The leading theory points to the Chinese lab Z.ai, which has anonymously tested a model before: one analyst found Ox Alpha consumed the exact same number of visual tokens as Z.ai's GLM-5V across four different videos, and held a fixed 75-token gap from GLM-5.3 across 25 text prompts. A competing analysis of the tokenizer suggested Microsoft's MAI family instead. It has not stayed clean. A second anonymous model, Korrine, has surfaced on Code Arena, variously fingered as Moonshot's Kimi, Qwen or MiMo. By the weekend, one analyst noted, people seemed less sure of everything than the night before.
None of this is sinister. Masked testing has become a standard step before a launch, because hiding the maker strips out brand bias and turns a benchmark into an honest stress test. Providers get to watch failure cases in advance, validate their inference capacity, and build a reputation before they attach their name. Guess-the-model has also become free marketing, and the suspense keeps the conversation running for days.
The more useful detail is not the identity but the terms. OpenRouter's own listing states plainly that prompts and completions "are retained by the provider and are not used for training." Read that again with a work project in mind. Whatever you send goes to a company that has not said who it is, and it keeps it.
For a European business, that is not intrigue, it is a blocker. Data protection law requires a contract with a named processor and an assessment of where the data goes, neither of which is possible when the counterparty refuses to identify itself. The timing sharpens it further: the EU AI Act's transparency obligations took effect on 2 August, in a regime built on knowing exactly which provider is responsible for what. So the sensible position holds even while the model impresses. Try Ox Alpha with anything you like, as long as none of it matters.