Ox Alpha Matches Zhipu’s GLM Tokenizer in 95 of 95 Tests

On August 23, Joseph W. Elstner returned to a set of token-counting experiments he had begun the day before. Elstner, identified in his paper as Founder and Principal Architect, had sent strings from multiple languages, code samples, and Unicode edge cases through the anonymous Ox Alpha model, then compared the results with public vocabularies from major AI labs. The first pass had pointed toward Zhipu's GLM family. A follow-up added the released GLM-5 vocabulary and produced a result that was harder to explain away.

Ox Alpha matched it on 95 of 95 probes.

Ox Alpha arrived on OpenRouter on August 20, 2026, free and anonymous, with an unusually large context window and a pitch aimed at coding agents. Elstner's tests establish the lineage of its vocabulary, while separate serving-layer evidence points to Z.ai infrastructure, but no company has confirmed who operates it or named the exact model tier. Developers can send valuable or proprietary code to an anonymous provider that OpenRouter says retains prompts and completions.

The tokenizer match

A tokenizer breaks text into the smaller units a model processes. Different model families split languages, punctuation, code, and unusual characters in slightly different ways, leaving a measurable signature even when the model's weights and system instructions are hidden.

Elstner recovered that signature from the prompt-token count returned with each API call. He measured a fixed base prompt, added one probe string, and subtracted the base count. On August 22, his original battery used 95 probes, compared fourteen candidate vocabularies, and required 126 API calls at zero cost during the free preview. GLM's older vocabulary matched 84 probes exactly. The best non-GLM candidate matched 46.

The August 23 follow-up changed the finding. Zhipu's released GLM-5 vocabulary matched all 95 probes, with a mean absolute error of 0.00. A second battery then compared Ox Alpha, Zhipu's served GLM-5.2 endpoint, and a generic local implementation across 29 inputs chosen to expose differences. The three stacks agreed on 25 inputs. All four differences came from inputs that included actual system-only marker strings, which Ox Alpha handled with an added input-hardening policy.

Ox Alpha and Zhipu's served endpoint also used the same chat-template grammar, including the same rejection of empty user content. The local implementation supplied a control using the shared vocabulary without all of those endpoint rules. That three-way comparison separated what came from the tokenizer from what appeared in the serving stack.

That establishes vocabulary identity, not ownership. A third-party host can use a public vocabulary.

The operator trail

Researcher Chetaslua went after the serving layer instead. On August 22, Chetaslua sent malformed input through the Ox Alpha route and received a Java stack trace containing the internal class path com.wd.paas.api.domain.v4.chat.ChatCompletionRequest, which maps to Zhipu's documented API structure.

A separate bad-role test produced the same code 1214 error envelope returned by Z.ai-hosted GLM models, with the matching structure and code acting like a fingerprint of the system serving the model. The control mattered: GLM-5.2 weights served by a different host returned a different validation format. That makes the error dialect an operator-layer signal rather than a property of the model weights. Chetaslua assigned 0.98 confidence to the inference. That figure is the researcher's assessment, not a probability established by an independent audit.

The evidence still does not name the exact SKU. Zhipu, OpenRouter, and the anonymous provider have not confirmed the operator. The parameter count, training history, model card, long-term price, and availability after the preview are also undisclosed.

The benchmark correction

Developers were also testing whether the anonymous model was actually good. Developer Ben Davis first ran a ten-task subset of DeepSWE on August 21, 2026 and reported an 80 percent result. In a sample that small, one task changes the score by 10 percentage points.

By August 23, Davis had completed the full 113-task set and reported roughly 63 percent. He said the lower result “makes way more sense.” It is a broader community measurement, but it is still not an official audited leaderboard score.

AI analyst Andrew Curran documented how fast the identity theory was moving in the other direction. On August 22, he wrote that GLM had been the leading theory on Friday night, but by Saturday morning “people seem less sure of anything.” Elstner's later tokenizer match strengthened the lineage finding. It did not erase the distinction between lineage and operator.

Free traffic, retained prompts

At its August 20 release, Ox Alpha was listed as free, with a 1,048,576-token context window, up to 131,072 completion tokens, and text, image, and video inputs. OpenCode relayed the provider's claim that it could serve 100 trillion tokens per day during a week of near-unlimited use. That capacity claim has not been independently audited.

OpenRouter's August 23 listing showed coding agents and developer tools actively using the endpoint. It identified a single provider and said requests were forwarded directly to it. Stripe Chief Executive Patrick Collison tried the model and called it “very impressive.”

The listing says the third-party provider retains prompts and completions but does not use them for training. That is narrower than a promise that nothing is stored or used for any other purpose. Developers sending proprietary code are therefore relying on terms issued for an unnamed counterparty while the free preview, future price, and endpoint identity can all change.

No company had publicly claimed Ox Alpha as of August 23. Who will put a name on the endpoint, and under what terms?

OpenAI Pauses Some Astra Work After Flagging Possible Critical Cyber Capabilities

OpenAI said Friday it could not rule out that its unreleased Astra model could autonomously develop zero-day exploits or execute novel cyberattacks from a high-level goal, and it paused internal activ

The Implicator

OpenAI Models Ran a Hack in Hours That Takes Skilled Humans Weeks

OpenAI's advanced models breached Hugging Face's internal systems in hours, an attack that would typically take a skilled human a couple of weeks. People familiar with the matter gave that account to

The Implicator

The White House Is Asking Anthropic for the Impossible

A government can stop a risky AI model from reaching foreign users. But perfect jailbreak resistance is not a compliance standard any lab can reliably meet, and that is the direction officials now app

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai