ox-alpha vs deepseek-v4-flash: what a stealth model hides
stealth/ox-alpha launched with a 1M context window, $0 pricing and no vendor name; deepseek-v4-flash-vision-exp launched the same day with nine benchmarks and a full price sheet. Both work. We compare the two listings on the four fields a router needs before either can enter a production routing table: identity confidence, retention policy, free-window expiry, and price-sheet completeness.
Within about a day of each other, two new rows appeared in the model listings most of us
route through — the table a router (the gateway layer that decides which model gets which
request) is allowed to send traffic to. One is deepseek-v4-flash-vision-exp: a named vendor, a changelog entry
with nine benchmark numbers and the harness settings behind them, an image-token formula,
and a price sheet down to the cache-hit rate. The other is stealth/ox-alpha, a stealth model: listed without its maker’s name,
free for a preview window. It comes with a 1M-token context window, text, image and video
input, a price of $0, a note that the provider “who has chosen to remain anonymous” keeps a
copy of your prompts, and a community that spent the next twelve hours fingerprinting it.
Both models run. Both are, by early accounts, usable. Only one of them has the four fields a router needs before it can put a
row into a production table — identity confidence, retention policy, free-window expiry,
and price-sheet completeness. This post reads the two listings side by side, then makes the
case that those four fields should be first-class metadata, not footnotes.
The listing with a name
DeepSeek’s API changelog for 2026-08-21 adds
deepseek-v4-flash-vision-exp, an experimental multimodal variant of V4-Flash.
The entry publishes nine self-reported scores (Terminal Bench 2.1 at 83.9, DeepSWE at 59.3, NL2Repo at 57.7, among others) and — less common — the evaluation settings for the code-agent text tasks: its own agent harness in minimal mode, max reasoning effort, and the sampling parameters. Vendor numbers are vendor numbers, but disclosed settings are what let someone else try to reproduce them. (The fuller comparison table DeepSeek posted alongside the release runs to eleven benchmarks; the changelog lists nine.)
The framing claim is that the model brings “multimodal agent capabilities close to Opus-4.8,” Anthropic’s current-generation model. TNW’s read of the same table is the calibration I’d use: across the eleven benchmarks DeepSeek compares, the new model beats Opus-4.8 on three (DeepSWE by 1.3, Agents’ Last Exam by 1.6, ZeroBench by 1.0) and trails on eight, twice by a wide margin (NL2Repo 57.7 vs 69.7; DSBench-Hard 63.6 vs 71.7).
TNW also flags DeepSeek’s own footnote: on two of the multimodal benchmarks the text-only V4-Flash “ignores multimodal elements,” so part of the headline “leap” over V4-Flash is the difference between a model that can see the test and one that can’t. The footnote is the kind of thing you can only reason about because the listing told you.
The part that matters most for anyone routing images is on the Vision guide. Images are billed as input tokens by a stated rule: anything above roughly 800×800 total pixels is scaled down to that budget, anything below roughly 384×384 is scaled up, and the result is a hard ceiling of 384 tokens per image, each image counted independently in a multi-image request. A 2000×2000 screenshot and a 5000×5000 one cost the same.
And there is a knob. If you don’t need fine detail, detail: "low" downsamples to 512×512
before inference:
{
"type": "image_url",
"image_url": { "url": "https://example.com/screenshot.png", "detail": "low" }
}Pricing is the same sheet as V4-Flash:
- Off-peak: $0.22 per million input tokens, $0.66 per million output.
- Peak (Beijing business hours — 01:00–04:00 and 06:00–10:00 UTC): double both.
- Cache hits — the part of a prompt the provider has already seen and stored, typically a stable system prompt or tool list re-sent on every call: $0.007 off-peak, $0.014 peak.
- Concurrency: capped at 2,500 requests.
We wrote about the peak/off-peak structure itself
earlier this week; the point here is narrower. Before
I send a single request, I can compute what an image-heavy agent loop will cost at 3 a.m.
versus 9 a.m. Beijing time, and whether detail: "low" is worth the quality trade. That is what a
complete listing buys you.
The listing without one
stealth/ox-alpha went live on OpenRouter on
August 20. The listing’s own facts:
- a 1,048,576-token context and 131,072-token max output;
- text, image and video in, text out;
- “Free” on both input and output;
- served by exactly one backend — necessarily an anonymous one — so a request has nowhere else to go if it fails;
- 28 tokens per second and 4.06 s of latency at P50 (the median) when captured.
The banner at the top is the important sentence:
Prompts and completions for this model are retained by the provider and are not used for training; all other use is governed by the Stealth Model Terms.
“Retained but not used for training” is a real, specific policy — it is also the opposite of a no-retention policy, and it is held by a party whose name you don’t know. The Hacker News thread (182 points and 140 comments when captured) circled exactly that: one commenter recommending “feeding all your proprietary data and confidential personal information into this model” as quickly as possible, another asking what happens to GPL code that passes through, and a running argument about whether the model’s answers on politically sensitive questions told you anything about its origin (they contradicted each other; one user’s Tiananmen refusal was another user’s frank answer).
Capability reports were mixed in the way early reports always are — strong on creative and reasoning tasks, weak on CSS and front-end work, long and occasionally indecisive reasoning traces.
None of that is a complaint about OpenRouter, which labels the model as stealth, surfaces the retention terms, and has run this playbook many times. It is a description of what the row lacks.
How a crowd fingerprints a model
What happened next is, to me, the most interesting part, because it is a routing problem being solved by hand. Within hours people were doing the work a model registry should do for them. The basic trick: every model family splits text into tokens its own way, so if an anonymous model counts tokens exactly like a known one across enough odd inputs, they very likely share a vocabulary — and probably a lineage.
On r/LocalLLaMA, one user ran a tokenizer comparison across 60 distinct strings — runs of emoji, which he singled out as the distinguishing set — and reported 60/60 exact matches against GLM-5.2, against 8/60 for the next-closest candidate.
Another pointed out that the API error returned for an out-of-range top_p looks like
Z.ai’s — Z.ai being the lab behind the GLM models. A third asked the capacity question
out loud: which lab can serve a claimed 100 trillion tokens a day for
free — a figure that, if real, is implausibly large for anything but a fairly small
active-parameter model?
A separate report by independent tester Ben Davis, summarized by BigGo, stacks more signals:
- video inputs consumed tokens at the same ~147 tokens-per-second rate as GLM-5V-Turbo across four controlled clips;
- 25 prompts matched GLM-5.3’s token counts exactly, give or take a constant 75 tokens of hidden system wrapper;
- audio input was rejected the way GLM-5V rejects it;
- emoji frequency in outputs sat near GLM/Qwen territory and far from Claude/GPT/Grok.
His coding numbers — 8 of 10 DeepSWE tasks on first pass — come with his own caveat, posted with the run table: “there could be a ton of variance in its real score, this is a subset.”
On X, the account teortaxesTex, a long-time close reader of Chinese labs, landed in the same place: “pretty convinced that ox alpha is GLM,” probably a 5.x-generation model with vision rather than a new trillion-parameter flagship.
Three lines from three different people — a Reddit tokenizer test, a tester’s multi-signal report, and an analyst’s behavioral read — converge on the GLM-5.x family. That is a strong prior and I’d bet on it. It is not a confirmation: nobody has claimed the model, the LocalLLaMA thread still has people arguing for Xiaomi’s MiMo v3, Tencent’s Hy4 and Alibaba’s Qwen on the basis of reasoning style, and every signal above is a behavioral fingerprint that a lab could, in principle, share or spoof. “Probably GLM, unconfirmed, free until about August 27 per one tester’s read” is the honest state of knowledge — and the precedents are worth a paragraph.
This has happened before
The stealth-then-claim pattern is now routine. In March, a model called Hunter Alpha appeared on OpenRouter on the 11th and was claimed by Xiaomi as MiMo-V2-Pro on the 18th, after a week in which most of the community had confidently attributed it to DeepSeek. Owl Alpha ran for months as a top-three model globally by volume before Meituan revealed it as LongCat-2.0 in July. Pony Alpha was later tied to GLM-5. The arc is the same each time: anonymous listing, free window, community fingerprinting, then either a branded paid listing or a quiet removal.
One LocalLLaMA commenter put the meta-lesson bluntly: stealth launches have become “the new meta — bench it, let the community reverse engineer the architecture, and by the time it’s actually announced everyone already knows everything.” That is a reasonable strategy for a lab. It also means that for the length of the free window — five days to months, going by the precedents — a popular free model sits in production configs with unknown provenance and an expiry that nobody has written down.
Four fields a router should treat as first-class
Put the two listings next to each other and the gap is not in the numbers — it is in what the listing can tell you before the first request.
| Field | deepseek-v4-flash-vision-exp | stealth/ox-alpha |
|---|---|---|
| Identity confidence | Named vendor, vendor-published changelog | Community inference only; three lines point to GLM-5.x, none official |
| Retention policy | Vendor’s published API terms (which permit service-improvement use) | “Retained, not trained on” — by an unnamed party |
| Free-window expiry | n/a — paid from day one, effective date published | Unstated; one tester says ~Aug 27; precedents range from 5 days to months |
| Price-sheet completeness | Text + image tokens, cache tiers, peak/off-peak | $0 / $0, nothing about what follows |
A ✓ in that table means the field is filled, not that its contents are favorable.
Each of these is routinely treated as a disclaimer paragraph. Each is actually a routing input. Identity confidence decides whether a model is eligible for workloads with provenance requirements at all. Retention policy decides whether it can see customer data. Free-window expiry is a scheduled price change with an unknown date — exactly the kind of event a cost-aware route should anticipate rather than discover when the $0 becomes something else. And price-sheet completeness is the difference between a cost estimate and a guess; a listing that prices text but not images, or lists a rate but not its cache tier, leaves the router to fill in numbers it has no right to fill in.
What to actually do when a field is blank:
- Identity unknown → keep the row out of any route with provenance or compliance requirements; allow it only for evaluation traffic.
- Retention unclear or by an unnamed party → no customer data; synthetic or public inputs only.
- Free-window expiry unstated → treat the price as “unknown, changing soon”: set a cost alert, and pin a priced fallback model for the day the $0 disappears.
- Price sheet incomplete → don’t estimate what the vendor hasn’t published; route only the modalities that are priced.
What we do with this
Our position is the unglamorous one: a router’s model table should carry these four fields alongside price and context length, and a row that lacks them should be routable only where the caller has explicitly opted in — an explicit allow-list per route, not a default. That is a design stance, not a feature announcement, and I’m not going to describe anything as shipped until it is.
The demand side is already visible: a Juejin post this week, written after DeepSeek’s announced price increase, walks through putting DeepSeek V4 Flash, Qwen3.8 Max, Kimi K3 and GLM-5.2 behind one key and switching between them with a single command. The moment switching is that cheap, the listing is the product — and every row in it has to be trustworthy.
Where this leaves the two rows
By the end of next week we will probably know who built Ox Alpha, what it costs, and whether the row survives. Until then, the evidence supports a guess and not a decision, and a guess is fine for experiments and wrong for a production route. The DeepSeek row can be costed to the token today; the Ox Alpha row cannot be costed at all beyond “zero, for now.” If you take one thing from the pair, take this: the next time a free, anonymous, very capable model appears in your listing, the right first question is not “which lab?” It is “which of the four fields is blank?” — and the answer, for a stealth model, is all of them, or as good as blank.