Ox Alpha: Data Terms, DeepSWE Results, and Buyer Risks

Last updated: August 25, 2026

Ox Alpha is an anonymous reasoning model that OpenRouter lists for coding and sustained agentic work, released August 20, 2026 with a 1,048,576 token context window at zero token price. Three services market access to it. The buyer problem is not the missing company name on its own. It is that no route currently supplies one binding answer on who receives your code, how long they keep it, and what they may do with it.

Verdict: approve Ox Alpha for public, synthetic, or fully sanitized evaluation only, unless a route names the processor and offers data terms your organization can sign.

Practice and permission are different layers

OpenRouter’s Ox Alpha page states that prompts and completions are retained by the provider and are not used for training, and that all other use is governed by the Stealth Model Terms. That is a model-specific representation about reported provider practice.

The Stealth Program End User License Agreement, updated July 6, 2026 and incorporated into the Terms of Service by section 5.1, is broader. Section 1 describes the program as offering models anonymously and free of charge for the purpose of collecting user content for use in Stealth Model training and improvement. Section 3 describes free access as consideration for the provision of that content. Section 4 grants a non-exclusive, irrevocable, perpetual, transferable, worldwide, royalty-free license, with the right to sublicense that content to the Stealth Provider for training, evaluation and improvement. The same section states that a user who does not want content provided for Stealth Model training should refrain from using Stealth Models. There is no partial opt-out described.

These statements sit in tension, and the tension does not resolve into proof. A provider can hold a broad contractual permission and not exercise it for a particular model. The open question is narrower and more useful: does the Ox Alpha notice expressly limit or waive sections 1, 3 and 4 for this model?

Section 5.8 of the Terms frames that question rather than answering it. It states that OpenRouter does not modify, waive, or limit any Model Terms unless expressly stated in writing. The Ox Alpha notice is written. The reviewed public documents do not state whether it operates as that written limitation, and OpenRouter’s Stealth Program Supplemental Terms page, which is where a model-specific carve-out would appear, listed no models on August 25, 2026.

Two further provisions keep a buyer from closing the question on the notice alone. Section 6.1 states that while OpenRouter strives to represent logging and training status accurately for each model, it is not liable for errors or misrepresentations in any Model Terms. Section 16 states that OpenRouter makes no representation or warranty regarding any model provider’s data handling, retention, training, security, availability, or intellectual property practices.

A third document adds a fourth published position. OpenRouter’s provider logging documentation classifies the Stealth provider as retaining prompts for an unknown period and as a provider that may train. Of the 83 providers listed there, five carry that classification. This is a dated platform classification rather than evidence about any specific request; it was read on August 25, 2026.

The defensible conclusion is a procurement conclusion, not a legal one. OpenRouter’s public materials do not give a buyer one unambiguous, route-specific statement covering both current practice and contractual permission, and the platform has disclaimed liability for the accuracy of the statement a buyer would most want to rely on. That is enough to fail a vendor review. It is not enough to say the notice is wrong.

One provision runs the other way and belongs in the record. Section 4 states that content provided to Stealth Providers carries a hashed identifier so that individual users are not identifiable to the provider, and that OpenRouter contractually prohibits providers from attempting to re-identify users. That is a stated control over user identity, and it says nothing about the content itself. The contract stack is also wider than the Stealth documents: sections 10.1 and 10.2 incorporate OpenRouter’s Privacy Policy and its Data Processing Agreement by reference, and a complete review reads those too.

Sources: OpenRouter model page, read 25 August 2026 · Stealth Program EULA, updated 6 July 2026, read 25 August 2026 · OpenRouter Terms of Service, updated 29 July 2026, read 25 August 2026 · Stealth Program Supplemental Terms, read 25 August 2026 · OpenRouter provider logging documentation, read 25 August 2026

The route is the procurement unit

Three services publish route-specific data terms for a model marketed as Ox Alpha. The public materials do not establish that they serve the same checkpoint, the same wrapper, or the same upstream deployment, so they should be audited as separate services carrying the same marketed name. A fourth route, Nous Portal, has been reported to offer the model; FSR did not locate published route-specific data terms for it and therefore does not list it below.

Card note: cards 01 and 02 were read directly by FSR on 25 August 2026. Card 03 and the $10 subscription figure come from an external research pass and have not been read at source. Every value shown is a vendor representation, not an independent verification of the data path.

OpenCode’s own terms add the limitation its marketing does not: content sent to third party models is subject to the retention policies of the providers of those models. Its published operational representations for Ox Alpha are materially better than the anonymous OpenRouter route, and they are still statements about a provider OpenCode has not named either. The same documentation says Zen models are hosted in the United States, without explaining how the hosting location of an unnamed provider is established.

The practical consequence is that data terms attach to the access route rather than to the marketed model name. Two engineers using “Ox Alpha” on the same afternoon can be operating under different published retention promises, different hosting statements, and different governing contracts. A vendor register entry that records the model name records almost nothing.

Third-party websites add a further path. At least one, oxalpha.org, offers browser chat under the Ox Alpha name with no signup, no account, and no card, and states in its footer that prompts and completions are handled by a third-party provider via OpenRouter. It is not operated by OpenRouter, and FSR did not locate a data processing agreement, a named operator, or a stated retention period for it. Anyone routing work through a site like that is adding an unidentified intermediary in front of an already unidentified provider.

Sources: OpenRouter, read 25 August 2026 · OpenCode Zen documentation, read 25 August 2026 · OpenCode Zen, read 25 August 2026 · oxalpha.org, read 25 August 2026 · OpenCode Go documentation and OpenCode terms of service.

The 58.4% run and its failure modes

Three DeepSWE figures circulate for Ox Alpha. They are three different sample sizes, and the most repeated one is the smallest.

Table note: only the third row is described by its runner as covering the complete 113-task set. FSR has not opened the underlying run log and marks that verification as outstanding.

Davis posted the lower figure himself, writing that the run ended at roughly 63% rather than the 80% his first subset produced, and that this made more sense. He posted again to clarify that the larger run was not his. Both statements are on the record. Neither invalidates the original subset, which was correctly labeled as a subset when it was published. What went wrong happened downstream, where the caveat fell away and a ten-task figure was repeated as a benchmark score.

The aggregate number also conceals the finding an engineering team would act on first. An external research pass reviewing the published run log reports that 11 of the 113 tasks, 9.7% of the set, ended after Ox Alpha returned three consecutive responses containing no tool call, and that five more exceeded the task time budget. The same pass records the harness as mini-swe-agent on a Docker backend. FSR has not opened that log.

If those figures hold, the distinction matters more than the rank. A reasoning failure argues for a better model or a better prompt. A recurring tool-format failure argues for retry policy, wrapper validation, or a different agent harness, and it is the kind of defect that produces silent cost in an autonomous loop rather than a visible wrong answer.

The supportable claim is narrow. One public full run shows Ox Alpha completing a material share of difficult software engineering tasks, with a measurable agent-loop failure mode alongside it. That does not establish run-to-run consistency, production reliability, or superiority over named alternatives.

No independent leaderboard has published a score

Artificial Analysis, the tracker most often cited for cross-model intelligence scores, has no Ox Alpha entry. Its Intelligence Index v4.1.1 combines nine evaluations and covers 605 models, and the model-creator legend on its release-date chart lists eighteen labs, none of them an anonymous or stealth provider. FSR read that page on August 25, 2026. The chart data itself is rendered client side and could not be extracted, so this is a check against the visible page rather than a query against the underlying dataset. Independent reporting on the same dates describes the same absence.

That absence has been filled by someone else. The third-party site oxalpha.org publishes a comparison table with an Intelligence column, listing Ox Alpha at 59 with an asterisk beside models priced per million output tokens. Its footnote attributes the column to the Artificial Analysis Intelligence Index and SWE-bench, and states that Ox Alpha is in preview and that its starred score is a community-reported estimate.

The mechanism is worth naming because it will repeat. Two of the comparison values on that page, Claude Opus 5 at 63 and Claude Fable 5 at 62, match what Artificial Analysis publishes; FSR checked both on the same day. The Ox Alpha figure does not come from there, and the footnote says so. Placed in the same column, a number nobody measured travels alongside numbers somebody did, carrying an index name that lends it weight the disclaimer cannot take back.

Anyone quoting an intelligence score for Ox Alpha should establish where it came from. As of August 25, 2026 the answer was not Artificial Analysis, and the word frontier attached to this model is the operator’s own.

Sources: Ben Davis on X, 21 and 22 August 2026 · Henry Zhang on X and GitHub, 22 August 2026 Artificial Analysis Intelligence Index v4.1.1, read 25 August 2026 · oxalpha.org, read 25 August 2026 · SiliconANGLE, 23 August 2026

What is documented about the model

OpenRouter describes Ox Alpha as a reasoning model designed for coding, sustained agentic work and production workloads, suited to long-horizon software engineering and to workflows combining text with visual context. The listing also states that OpenRouter routes requests to it and is not its developer, owner, or provider.

Beyond the specification in the table above, the listing documents tools and tool_choice for function calling and response_format for JSON output without schema enforcement. One provider serves it, labeled Stealth, so there is no routing fallback if that provider stops responding.

What is not documented anywhere is the part a review normally starts with. There is no parameter count, no architecture description, no training data description, no model card, no version or checkpoint identifier, and no named legal entity. The listing carries a marketing name and an alias. Nothing in the public record pins the alias to a specific build, which means the behavior behind the slug can change without any published signal.

Serving telemetry on the model page moves continuously and is not reproduced here. Record the timestamp with any figure taken from it.

Sources: OpenRouter model page and FAQ, read 25 August 2026 · OpenRouter Stealth provider page, read 25 August 2026

One new account’s privacy defaults

OpenRouter lets an account holder control whether requests may be routed to endpoints with particular data policies. The settings page states that enabling a toggle allows routing to endpoints with that policy and disabling it excludes them.

FSR created an OpenRouter account on August 25, 2026 at 10:08 JST and read the privacy settings page at 10:10 JST. This is what that page displayed.

Table note: single account, created in Japan, personal account type, read 25 August 2026 at 10:10 JST. FSR treats this as the delivered default rather than a configured state, and a reader can check that in under a minute by creating an account and opening the same page. Whether the same defaults apply to organizational accounts or to accounts created in other jurisdictions was not tested.

The switch that is on reads: enable providers serving free models that may retain and/or train on prompts and completions. The equivalent switch for paid endpoints is off.

FSR did not test whether this setting controls routing to Ox Alpha specifically, and does not claim that it does. The observation is that a free-endpoint training permission arrived enabled while its paid counterpart arrived disabled, on one account, on one day. Anyone can check it in a minute by creating an account and opening the same page. The eligibility preview on that page, which reports how many models the current configuration permits, displayed 536 available and 3 unavailable; toggling the free-training switch and rereading that count would establish whether it gates this model. That test is outstanding.

Sources: OpenRouter privacy settings, read 25 August 2026, sign-in required · OpenRouter provider logging documentation, read 25 August 2026

Three hypotheses, none confirmed

As of August 25, 2026 OpenRouter had not publicly identified the provider. Three hypotheses circulate, and none is authenticated.

Z.ai, formerly Zhipu AI, serving a GLM-family model. An independent fingerprinting tool reports that GLM-5.3 matched on all four normalized tokenizer counts while no other candidate cleared more than two, and separate reports describe error codes and an API path structure consistent with Z.ai’s published reference. Against it: the publicly documented GLM-5.3 is text only, while Ox Alpha accepts images and video.

Microsoft, in the Phi or MAI lineage. One analyst published a three-probe token count table reporting an exact match to the cl100k_base encoding. Against it: the table contains no GLM row, a direct reply asserted the same fingerprint also matches GLM-5.3, and no reproduction package has been published.

A different model sharing GLM tokenization or serving infrastructure. Serving-layer signals identify a stack rather than a checkpoint, which is what the tool’s own author says. This absorbs the modality mismatch and covers unreleased variants and other labs, including Xiaomi’s MiMo family, which some observers have named. It is also the least falsifiable of the three.

Underneath all three sits a measurement problem. None of the analyses FSR reviewed cites a published tokenizer vocabulary specification or a published video token accounting formula for the model being compared against. The comparisons are made against measured behavior rather than against documentation.

The cl100k reading carries a second caveat. That encoding is still in general use as a counting standard rather than only as a model’s native vocabulary: Artificial Analysis defines the document lengths in its long-context evaluation in cl100k_base tokens. A reported token count matching cl100k therefore establishes what some counting layer produced, and it becomes evidence about the model’s own vocabulary only once the count is shown to come from the model rather than from a router or wrapper. The fingerprinting tool’s own documentation flags routing as exactly that kind of confound.

Treat all of this as infrastructure evidence, not authenticated model identity.

Sources: modelprint README, GitHub, read 25 August 2026 · Artificial Analysis long context reasoning evaluation, read 25 August 2026 · TechCrunch, 23 August 2026 · SiliconANGLE, 23 August 2026 · Robert Lukoszko on X, 21 August 2026 .

Export control, conditionally

Sources: Federal Register, 90 FR 4617, 16 January 2025, read 25 August 2026 · OpenRouter, read 25 August 2026

Three gates before approval

A team can decide this without waiting for a reveal.

Gate one, data class. Public, synthetic, or fully sanitized material containing no secrets, personal data, customer content, private source code, or controlled technical data can proceed to a limited evaluation. Internal non-confidential material needs a security or legal decision. Confidential, customer, regulated, or export-controlled material should not proceed until the receiving legal entity is named and binding data terms exist.

Gate two, continuity. The Stealth EULA permits removal at any time, with or without notice, and the terms of service allow a provider to modify Model Terms with continued use counting as acceptance. A one-off evaluation tolerates that. An internal tool needs a tested fallback. A production dependency needs a provider pin, a version identifier, a notice period, and a migration path, none of which is currently available.

Gate three, capability. No independent leaderboard has scored this model, so a single screenshot or aggregate figure is not a basis for approval. Run representative tasks repeatedly, record tool-call failures separately from reasoning failures, measure human correction time, and compare the same commits and acceptance tests against a named fallback model.

One more clause belongs in a procurement file. Section 5.5 states that OpenRouter may suspend or terminate access at a model provider’s request, that each provider retains sole control over access to its model, and that if access is suspended it is the user’s responsibility to contact the provider to resolve it. The Stealth EULA states that OpenRouter will not disclose the name or origin of Stealth Providers. The public documents do not explain how a user reaches a provider whose name is withheld.

Sources: OpenRouter Terms of Service, updated 29 July 2026, read 25 August 2026 · Stealth Program EULA, updated 6 July 2026, read 25 August 2026

FAQ

Sources: OpenRouter, read 25 August 2026 · Stealth Program EULA, read 25 August 2026 · OpenRouter provider logging documentation, read 25 August 2026

Methodology and source status

This is a document-first briefing. FSR did not send a request to Ox Alpha, did not create an Ox Alpha API key, and did not run a benchmark. No performance figure on this page is an FSR measurement.

Read directly in a browser on August 25, 2026 and captured: the Ox Alpha model page and its FAQ answers, the Stealth provider page, the Stealth Program End User License Agreement, the Stealth Program Supplemental Terms page, the OpenRouter Terms of Service, the OpenRouter provider logging documentation, the OpenRouter account privacy settings page, the OpenCode Zen documentation and product page, the Artificial Analysis Intelligence Index and long context reasoning evaluation pages, the third-party site oxalpha.org, and the Federal Register entry of January 16, 2025.

Recorded but not read at source, and labeled as such in the body: the OpenCode Go documentation and OpenCode terms of service, the $10 Go subscription figure, the 113-task run log and its failure decomposition, and Z.ai developer documentation referenced in the identity section.

Five verification tasks remain outstanding: the eligibility preview differential test in section 05, direct reading of the OpenCode Go and OpenCode terms documents, direct inspection of the 113-task run log, a query against the Artificial Analysis model list rather than the visible chart, and a check of whether Ox Alpha appears on LMArena.

One dating note. The model page header displayed a release date of August 21, 2026 when read from a browser set to Japan Standard Time, while the FAQ on the same page states August 20, 2026. The header most likely renders in the reader’s local timezone from a timestamp late on August 20 UTC. This briefing uses August 20, 2026.

Volatile fields, meaning price, provider classification, supplemental terms listings, availability and serving telemetry, are dated wherever they appear and require rechecking before use.

Corrections policy: FSR retracts errors publicly with the original wording quoted, numbered and logged, rather than editing them away.

Affiliate disclosure: this is a Tier C briefing. FSR does not place affiliate links in Tier C briefings. This page carries none, and FSR receives nothing from OpenRouter, OpenCode, Nous Research, or any Ox Alpha access route.

Verdict

Third-party users and one public full run indicate material coding capability. No independent leaderboard has published a score, and FSR did not test the model, so this briefing takes no position on how good it is.

The procurement position is separate and it does not close. No route names the legal entity that receives a request. OpenRouter’s model page, its provider classification table, and the incorporated Stealth EULA describe the treatment of user content differently, and the terms of service disclaim liability for errors in exactly that kind of statement. The endpoint can be withdrawn without notice, and there is no published version identifier to pin.

Approve sanitized, non-sensitive evaluation. Do not approve confidential, customer, regulated, or export-controlled workloads, and do not build a production dependency, until a named processor, binding data terms, and endpoint continuity are established. The unresolved conditions are themselves the disqualifier, not a reason to wait and see.

Future Stack Reviews is an independent publication and is not affiliated with OpenRouter, Inc., OpenCode, Nous Research, or any party discussed here. Nothing on this page is legal, tax, or export control advice. Pricing, availability and contract terms for preview models change without notice and should be verified at source before any decision. This page carries no affiliate links.

Last updated: 25 August 2026. Volatile fields rechecked: 25 August 2026, 00:46 and 10:08 JST.