Compression Tests and 44 Tokenizer Matches Exposed the Mystery Model Ox Alpha
A free, unbranded model showed up on OpenRouter on August 20, 2026, with a one-million-token context window, multimodal input, and no lab attached to it. Three days later it had moved roughly 11.6 trillion tokens and was tied for the top spot on the platform's weekly chart. Within a week the community had worked out who built it, and the methods they used are worth stealing. They did not need the weights. They did not need a leak. They needed a prompt injection and a compression test.
The model was listed under the slug stealth/ox-alpha, and its operator "chose to remain anonymous." When you asked it who it was, it returned the same line every time: "I am ox-alpha, developed by an undisclosed organization." That answer turned out to be the least useful thing in the whole investigation.
Feed the model its own instructions
The first move was a prompt leak. Instead of asking the model to name itself, researchers got it to repeat the instruction block that had been injected ahead of the user message. What came back was telling:
You are "ox-alpha", an LLM developed by an undisclosed organization. Identify yourself strictly as the model "ox-alpha". Do not identify yourself as any other model.
That single block changes what counts as evidence. A model can read the text sitting in front of it far more reliably than it can introspect its own weights. "Who are you?" interrogates the deployment persona, not the checkpoint. Once you accept that the persona is a wall, every direct answer becomes useless, and you have to go after signals the model cannot choose to hide: how its tokenizer splits text, which upstream errors leak through the gateway, where its context actually breaks, and how it behaves against known models.
There are really four layers in play, and most people only ever see the first one. The persona in the system prompt. The gateway, which normalizes the schema and the API. The provider, whose infrastructure produces the errors and the content filtering. And the weights underneath, where the tokenizer and the capabilities actually live. A system prompt can rename the persona, and a gateway can reshape the interface. Neither one erases tokenizer behavior or error codes.
Does it compress like GLM?
The second technique is the one I would copy first. It is called Normalized Compression Distance, or NCD, and it comes out of information theory and plagiarism detection. The intuition is simple: two texts from the same "author" compress together better than two unrelated texts, because they share the same habits. You feed two texts into a compressor, then compare how each one compresses on its own against how the concatenation compresses. The closer the two texts, the lower the distance.
In practice you can lean on gzip as a stand-in for the compression that Kolmogorov complexity describes, which is exactly how the original writeup ran it. Take a handful of Ox Alpha's responses, take a handful of responses from Claude, Gemini, DeepSeek, and GLM-5.3, and score every pair. Ox Alpha's prose compressed most tightly against GLM-5.3 and consistently lost to it against the rivals. That is a style fingerprint. On its own it is suggestive, not proof. But it points at a specific generation, not just a lab.
The boring measurements that actually proved it
The NCD result gave the community a target. The proof came from unglamorous, reproducible checks that all pointed the same way. The tokenizer matched the GLM-5-generation tokenizer on 44 of 44 discriminating strings, where GLM-4.x hit 42, Qwen3 hit 38, and DeepSeek-V3 hit 28. The API metadata was a near-exact match to GLM-5.3: the same defaults (temperature 1, top_p 0.95), the same context and output ceilings, and the same unusual mandatory-reasoning block with low, high, and max efforts defaulting to max. GLM-5.2 differed on all of it. Video-encoder behavior matched the GLM-5V line, and the uptime graph tracked the GLM listing almost beat for beat.
None of those was a confession. Across hundreds of identity and injection attempts (role-play, fake system tags, Mandarin and Japanese overrides, base64, ROT13, Morse, homoglyphs, image-based injection) the model held. The truth came from measurements that agreed, not from a single dramatic jailbreak.
Why the name is the least trustworthy part
On August 26, Z.ai confirmed the model was GLM-5.3-Flash, a 320-billion-parameter mixture-of-experts with 18 billion active per token, and released the weights under the MIT license. The free endpoint disappeared and the slug changed to z-ai/glm-5.3-flash.
The takeaway for anyone wiring up against LLM APIs is uncomfortable but practical. Do not trust the model string, and do not trust the model's own answer to "what are you." A name is a label an operator can change, and the stealth listing even hid parameters that the real endpoint later exposed. Budget and code for the endpoint vanishing without notice, and treat a self-reported spec as a starting hypothesis rather than a fact. If you want to know what you are actually talking to, fingerprint the tokenizer and the error surface, run controls against known models, and keep the raw captures so the result is a reproducible finding instead of a memory.
Comments