Ox Alpha was GLM-5.3
Updated September 1, 2026 · first published September 1, 2026
Between 20 and 26 August 2026, a model listed on OpenRouter as stealth/ox-alpha was served free of charge. It has since been identified as GLM-5.3-Flash: 320 billion total parameters with 18 billion active, hybrid linear and sparse attention, native text, image and video input, a 1,048,576-token context window, 131K maximum output, and MIT-licensed weights.
The uptake was not marginal. Within three days of the listing, OpenCode reported roughly 16 trillion tokens processed, 221,000 unique users, more than five million sessions, and the number two position by recent usage. That is production traffic, not evaluation traffic — and for six days it cost nothing.
Free is a rate, not an absence
The finance problem with a free stealth endpoint is that most cost telemetry treats a $0 line as no line at all. Requests that were routed to Ox Alpha during that week appear in usage dashboards as zero-cost, so they carry no weight in any spend forecast, budget alert, or per-feature unit-economics view. Then the window closes, the model is renamed, a rate is applied, and the same traffic reappears as a step change nobody modelled.
The fix is to price every call at a shadow rate, including the free ones. Record the token counts as normal and multiply by the list price of the model you would otherwise have used. Your dashboard then shows what the promotion is worth per month, and what the bill becomes the day it ends. Sixteen trillion tokens at a typical flash-tier rate is not a rounding error.
The rate is no longer hypothetical. GLM-5.3-Flash now lists at $0.15 per million input tokens and $0.50 per million output. Sixteen trillion input tokens at that rate is roughly $2.4 million — that is what six days of free tokens were worth, and the size of the step if that traffic simply stayed where it was.
The three exposures to check
| Exposure | Question to ask | Control |
|---|---|---|
| Rate cliff | What does this traffic cost at list price tomorrow? | Shadow pricing on free endpoints, with the same budget alerts. |
| Identity drift | Which model is behind the alias this week? | Pin model IDs; never route production to a stealth alias without a fallback. |
| Quality coupling | Did prompts get tuned to a model you cannot keep? | Run evals against the named replacement before the window ends. |
MIT weights change the buy-versus-build maths
The identity reveal matters for a second reason. GLM-5.3-Flash ships under an MIT licence, which means the self-hosting option is real rather than theoretical. With 18 billion active parameters out of 320 billion total, serving cost is closer to a mid-size dense model than the headline count suggests — but only if you have consistently high utilisation. Below roughly 40–50% GPU utilisation, per-token API pricing usually still wins, because idle accelerators bill at full rate while an idle API call bills nothing.
So the decision is not open-weights versus API. It is a utilisation threshold. Measure your sustained tokens per second over a full week, including nights and weekends, and only then compare a reserved-capacity quote against the same volume at list API rates. Include engineering time for serving, evaluation, and upgrades in the self-hosted column; that is the line most build cases forget.
What to do when the next stealth model appears
Treat every free window as a fixed-term contract with an unnamed counterparty. Evaluate the model properly — free tokens are a genuinely cheap way to run an eval suite. But route production traffic to it only behind a fallback, keep the shadow price in your dashboards, and diary the end of the window as a forecast event. The model was excellent and the price was zero; only one of those two facts was durable.
Related
Related
Want this applied to your own LLM spend? FinOps LLM runs a free audit of your AI costs and shows where the savings are. Book free audit →