A model with a 1,048,576-token context window landed on OpenRouter on August 20, 2026, reportedly with an allowance of up to 100 trillion free tokens per day. Nobody knows who made it.
Those two facts sitting next to each other should bother you more than they seem to bother the developer community. I spend my days looking at how AI systems get attacked and abused, and the reaction to Ox Alpha has been an interesting study in how fast curiosity overrides caution. The model ID is stealth/ox-alpha. The word “stealth” is right there in the namespace, and thousands of engineers pointed their agents at it anyway.
What we actually know
The verified picture is thin, which is part of the story. Ox Alpha is an anonymous model released in August 2026 with a 1M-token context window and free access. It accepts text, image, and video inputs. It handles complex reasoning and coding tasks. It appeared on OpenRouter and OpenCode. There is no known developer behind it.
That’s it. Everything else circulating is inference, vibes, or guesswork about which lab is running a stealth test. Maybe it is a frontier lab doing anonymous benchmarking before a launch. That’s the most likely explanation and I’d probably bet on it. But “most likely” is not the standard I’d want to apply to a pipe that has my source code flowing through it.
The security math nobody is doing
Let’s talk about what a 1M-token context window means from an attacker’s perspective, because the framing in most coverage has been purely about capability.
A million tokens is roughly an entire mid-sized codebase. When developers say they’re using Ox Alpha for “sustained software engineering tasks,” what they mean in practice is: I pasted my repository into an endpoint operated by an unknown party. Not a function. Not a file. The repository. Config files, environment variable names, internal service topology, auth patterns, the comments where someone wrote TODO: this validation is weak, fix before launch.
The large context window is exactly what makes the exposure meaningful. Small-context models forced people to send fragments. Fragments leak less. A model that can hold your whole project invites you to send your whole project, and free access removes the friction that would normally make you think twice about volume.
Then add the multimodal surface. Text, image, and video inputs mean three separate paths for content to reach the model. In my work, image and video channels are consistently the weakest link in prompt injection defense, because the sanitization that teams apply to text often doesn’t exist for pixels or frames. An agent that reads screenshots is an agent that will happily read instructions someone embedded in a screenshot.
The trust question is not paranoia
I want to be careful here. I have no evidence Ox Alpha is malicious. None. The anonymity is unusual, not damning, and stealth releases for evaluation purposes have precedent.
But security posture isn’t built on evidence of harm. It’s built on the ability to answer basic questions:
- Who processes the data I send, and under what jurisdiction?
- Is my input retained? For how long? Used for training?
- What happens to my data if this project quietly disappears next month?
- Who do I contact when something goes wrong?
- Is there any commitment I could point to if it were breached?
With Ox Alpha, the answer to all five is the same: unknown. And “free” means there is no contract, no vendor relationship, no service agreement, and no accountability structure. You’re not a customer. You’re a participant in something, and you don’t know what.
What I’d tell a security team
Not “block it.” That advice gets ignored and drives usage underground, which is worse. Instead:
- Treat it as an untrusted third party in your data flow diagrams, because that’s precisely what it is. Same category as a random npm package with no maintainer listed.
- Assume anything sent is public. Test it with code you’d be comfortable seeing on a paste site.
- Keep secrets, credentials, and customer data out of context entirely. The convenience of dumping a whole directory is the trap.
- Don’t wire it into agentic workflows with write access, shell execution, or production credentials. An unknown model with tool access is an unknown actor with tool access.
- Log the traffic. If attribution surfaces later and you don’t like the answer, you’ll want to know what left your network.
The pattern matters more than the model
Ox Alpha will likely be identified soon enough, and the whole thing may look unremarkable in hindsight. What concerns me is the precedent it sets. We just watched a large developer population adopt an anonymous inference endpoint at scale because the context window was big and the price was zero. That is a reusable playbook, and it does not require the model to be good, only free and capable enough to feel like a bargain.
Capability is easy to measure. Trust isn’t. Right now the industry is very good at benchmarking the first thing and comfortable ignoring the second.
đź•’ Published: