I Ran a Week of Real Open Source Work on Ox Alpha, the Internet's Mystery Free Coding Model

Last week my coding agent started answering me from a model that officially does not exist. No company name, no launch blog, no system card. Just a slug on a router and a bill of exactly zero dollars.

This is the story of how I ended up running a full week of real open source work on that mystery model, what it handled well, where it fell flat, and why the strangest part was not the model at all. It was everything happening around it.

Ox Alpha is a reasoning model that appeared on OpenRouter on August 20, 2026 under the identifier stealth/ox-alpha, described as built for coding, sustained agentic work, and production workloads. Nobody has claimed it. The listing says only that a third party provider chose to stay anonymous during the preview.

The headline specs are unusual for something free:

OpenCode integrated it the next day as x-preview-f-free

, and reporting picked up a claim that the provider had provisioned capacity of around 100 trillion tokens per day for the preview window. That number came from the OpenCode announcement coverage, and honestly I still cannot fully wrap my head around it.

If you enjoy internet detective work, this launch was a gift. Within days researchers had pulled the system prompt with a word counting trick (dejan.ai wrote it up), matched tokenizer fingerprints, and caught a Java stack trace pointing toward Zhipu AI and the GLM family (explainx has the forensic timeline). Others argued for Microsoft MAI or a Xiaomi MiMo variant. Mainstream outlets joined fast, with TechCrunch framing it exactly right: a frenzy of speculation with no confirmation.

My working position is simple. I treat it as an anonymous, capable, free preview model. The GLM theory is plausible. It is also unproven, and I am not going to build anything load bearing on a rumor.

Because the price made curiosity cheap. I maintain a large open source contribution operation: at this point I have crossed 350 merged pull requests in other people's repositories, and every day there are stale branches to rebase, CI failures to diagnose, dependency alerts to clear, and maintainers waiting on answers. That workload eats tokens the way my laptop eats RAM during a TypeScript build.

A frontier class model with a million token context, free, sitting behind an agent I already use daily? That is not a benchmark question. That is a let us just try it question.

There was also a second reason, less flattering and more fun. I wanted to know whether a model this anonymous could survive contact with boring, repetitive, unglamorous engineering work. Benchmarks are theater. Rebase day is truth.

My setup runs a daily open source workflow that fans out subagents for triage and fixes. During the Ox Alpha window, that machinery chewed through a genuinely mixed bag of tasks, and I kept notes.

The clearest win was bulk branch maintenance. Upstream moved under me and left thirteen pull requests against lobe hub conflicted in one go. The agent worked through them sequentially, resolving each conflict set and pushing updated branches, and I reviewed diffs afterward instead of hand merging. Thirteen rebase jobs in one sitting is exactly the kind of thing I used to postpone until a PR collected dust for a week.

CI rescue duty went similarly well. Several pull requests sat red across different projects: regression fixes in KiroCrew, a wrong usage total calculation in langfuse, missing tests on lobe hub issue 16505, and a stubborn OpenHands pipeline that needed actual diagnosis rather than a retry button. None of these produced heroic commits. They produced small correct ones, which is what maintainers actually want.

Security review time was more interesting because the stakes were higher. Over the same stretch I wrote up seven separate vulnerability reports, covering things like SSRF in a website crawling service, a race condition in crawl status polling, insecure deserialization in a dataset embeddings path, missing authorization checks on internal endpoints, and a JWT parsing quirk involving trailing whitespace. Two additional reports went through private disclosure channels for another project and are sitting in maintainer triage, so those details stay sealed for now. The model helped me structure reproducers and draft reports, and every technical claim in those reports traces back to code I read myself. I would not want an anonymous model to be the only set of eyes on a security finding, and it was not.

And yes, writing counts as agentic work too. The August contributions recap that went up on my dev.to profile was researched, drafted, and published through this same setup, using the dev.to API with a key the agent read from local storage at runtime. Including this post. A model with no public name just formatted and shipped its own follow up essay, which is either the most efficient thing here or the most absurd, depending on how much coffee I have had.

I fed our entire backend FastAPI repo with 142 files into OpenCode, and it accurately diagnosed a race condition between our Redis lock and Celery workers without dropping variable names.

That quote, reported by aggregators from r/LocalLLaMA, matches my experience with long context work. When I threw whole repository histories and long CI logs at it, it kept track of names and state far better than the 128k models I normally rent by the token. The million token window is not a gimmick. It changes how much evidence you can simply leave in the room.

Honesty section, as promised to myself before I wrote a word.

Speed is the first tax. Community measurements put it around 40 tokens per second, and my subjective experience agrees. Long agentic loops feel noticeably slower than snappier paid models. On structured evaluations it lands mid table rather than on top: AI Coding Daily's leaderboard scored a medium effort configuration at place 26 with 8.9 of 20 points and an average of 12 minutes 36 seconds per prompt, and Benchable placed it around the 51st percentile across eight benchmarks. Meanwhile the viral screenshots claiming it beat Anthropic's Fable by a huge margin on SWE style tasks remain unverified. I read those threads, I enjoyed those threads, and I did not reproduce those numbers.

Knowledge freshness is the second tax. One hands on reviewer found it scored zero on an exploit involving a recent React Server Components vulnerability, which smells like an older training cutoff rather than incompetence. Treat its knowledge of anything from recent months as suspicious until proven otherwise.

Habits are the third tax. Left alone it will not write tests unless you insist, and on a multi tenant app exercise documented by DevShift it treated tenant isolation as a convention rather than an enforced mechanism. Nothing there was disqualifying. Everything there required a human paying attention, which is the correct default assumption for any model you got for free from an organization that will not tell you its name.

Then there is the fine print worth reading twice. The New Stack flagged that OpenRouter's model page and the underlying stealth terms describe data handling differently, one saying prompts are retained but not trained on, the other granting broader rights. For European users the anonymity itself is a compliance problem, since you cannot assess a processor you cannot identify (TNW covered this angle). My rule ended up being blunt: no secrets, no client code, no credentials through the stealth route. Everything sensitive stayed local or went through providers with named legal entities.

Here is my honest scorecard after a week.

For high volume, low secrecy chores like rebases, changelog drafts, CI archaeology, dependency bumps, and first pass reviews, it was excellent, and the price makes the decision trivial while the preview lasts. For novel security work, architecture decisions, and anything touching private data, I kept a named frontier model in the loop, and you should too. Switching is one line in OpenCode's model config, which means your fallback should always be one keystroke away.

{
  "$schema": "https://opencode.ai/config.json",
  "model": "opencode/x-preview-f-free"
}

Stealth previews end. This one was advertised as a limited window, so build your habits so that losing it costs you a config edit, not a workflow.

Who actually built Ox Alpha? Nobody knows officially. The strongest public evidence points to Zhipu AI and the GLM family, based on tokenizer matches, a leaked system prompt, and serving layer quirks, but there has been no confirmation from any lab, so I keep the word theory attached.

Is it really completely free? During the preview, yes, listings show zero dollars in and out, and roughly seventeen third party resellers mirrored it. Previews end though, so check the live model page before you plan anything around that price.

Can it replace Claude or GPT for serious coding? For my money it replaces them for chore tier agentic work and does not replace them for hard design or security calls. Mid table structured scores with top tier economics is a fair one line summary.

Is sending code to an anonymous provider risky? Yes, in specific ways: unclear retention, conflicting terms between the model page and stealth agreements, and no way to run vendor diligence on an entity you cannot name. I routed nothing confidential through it and recommend the same line in the sand.

The strangest takeaway from this experiment is not about the model. It is that the infrastructure around anonymous models has gotten so good that anonymity barely slows you down. Router, agent, API keys, publishing pipeline, everything just worked, right up until the privacy fine print reminded me that convenient and accountable are different words.

Try it while the window is open: point OpenCode at the free model, give it one boring maintenance task you have been avoiding, and judge it on that. If you want to see what else comes out of this setup, my dev.to feed and GitHub are where the receipts land.

I am Aniruddha Adak, a final year CSE student and open source contributor from Kolkata who writes about agentic workflows, AI tooling, and the occasional model with no last name.