What is a stealth AI model?

A stealth model is an unannounced model published on a public router under a codename rather than a lab's name, usually free during an evaluation window. Labs use the pattern to collect real-world usage data and benchmark signal before an official launch. Ox Alpha, listed on OpenRouter as stealth/ox-alpha on August 20, 2026 with a 1M-token context, is the most prominent 2026 example — and as of August 25 no lab had claimed it.

Is it safe to send company code to a free anonymous model?

No. With an unattributed endpoint there is no named counterparty, so there is no data processing agreement, no published retention window, no stated position on training use and no identified jurisdiction. You cannot obtain those answers after the fact because there is nobody to ask. Anything covered by a customer contract, NDA, GDPR obligation or trade-secret protection must not go to a stealth endpoint.

What do I actually get from a named provider that a stealth model does not offer?

Five concrete things: a data processing agreement defining retention and training use, a named legal entity you can hold to it, a stated jurisdiction and subprocessor list, a deprecation policy with notice before the model disappears, and published pricing you can forecast against. A stealth endpoint offers none of these, which is why score comparisons between the two categories miss the point.

When is it acceptable to use a stealth model?

When the input is already public or worthless if leaked. Open-source repositories, synthetic test data, public documentation, throwaway prototypes and personal experiments are all fine. The test is simple: if the prompt appeared in a public dataset tomorrow, would anything bad happen? If the answer is no, use it freely. If you hesitate, do not.

Quick Answer

Stealth AI Models vs Named Providers: Data Risk

Published: August 25, 2026

The Short Answer

A stealth model gives you capability without accountability. That is a fine trade for public code and an unacceptable one for anything a customer, regulator or contract touches.

The decision is not about benchmark scores. It is about whether you can name the counterparty.

What You Are Comparing

	Stealth / anonymous model	Named provider
Operator identity	Unknown	Named legal entity
Data processing agreement	None	Yes
Retention window	Undisclosed	Published
Training use of prompts	Undisclosed	Stated, usually opt-out
Jurisdiction	Unknown	Stated
Subprocessor list	None	Published
Deprecation notice	None	Policy with notice period
Pricing forecast	None — free window	Published rates
Recourse if breached	None	Contractual
Cost	$0	Metered

The right-hand column is not bureaucracy. It is the entire reason a model can be used on data that belongs to someone else.

Why Free Is Not Free

A stealth listing is a lab paying real inference costs to serve strangers anonymously. That spend buys something. The most probable purchases, in order:

Evaluation data — how the model behaves on real tasks at real scale, which is expensive to simulate
Benchmark signal — public reaction before committing to a launch narrative
Training data — prompts and, in coding cases, code

None of these are sinister; the first two are ordinary product development. But you cannot distinguish between them from the outside, and the third is the one that matters if the code you paste is not yours to give away.

Assume prompts are retained and used for training. That is the conservative reading and, for a free unattributed endpoint, the most likely one.

The Continuity Problem

Data risk gets the attention, but the operational risk is more likely to bite an engineering team.

A stealth model has no availability commitment. The August 2026 pattern is instructive: stealth/ox-alpha appeared on OpenRouter on August 20, ran free for roughly a week, and had no announced future. A model that can be withdrawn without notice cannot be a dependency.

If you wire one into a workflow and it disappears, you have an outage with no vendor to call, no status page and no incident timeline. A free model is not a fallback tier — see the difference between a real cross-provider failover chain and a hopeful endpoint.

The Test That Settles It

One question resolves nearly every case:

If this exact prompt appeared in a public dataset tomorrow, what breaks?

Answer	Verdict
Nothing — it’s public code or synthetic data	Use it freely
Mild embarrassment	Probably fine, use judgment
A customer contract is breached	Stop
A regulator gets involved	Stop
A trade secret is disclosed	Stop

There is no middle position. The reason is that you cannot remediate after the fact — with a named provider you can invoke a deletion right; with an anonymous endpoint there is no address to send the request to.

Legitimate Uses

This is not an argument that stealth models are bad. They are useful, and dismissing them entirely is over-correction:

Evaluating a capability class. Want to know what a 1M-token multimodal context feels like before paying for one? Ideal.
Public open-source work. The code is already public; nothing is lost.
Personal projects with no customer data.
Prompt technique experiments on synthetic inputs.
Benchmark curiosity — running your own evaluation set on public tasks.

The pattern is consistent: use them where the input has no confidentiality value.

If Cost Is Why You Are Tempted

Teams reach for free stealth endpoints to cut inference spend. Almost always, the cheap named tier solves the same problem with none of the exposure. Verified August 2026, on a 30K-input / 5K-output reference task:

Model	Input / Output per MTok	Cost per task
GPT-5.6 Luna	$0.20 / $1.20	~$0.012
Gemini 3.7 Flash	$0.75 / $3.75	~$0.041
GLM-5.3	$1.40 / $4.40	~$0.064
Grok 4.6	$2 / $6	~$0.09

At just over a cent per task, GPT-5.6 Luna makes “free” a rounding error against the risk. If your volume is high enough that a cent per task matters, your volume is also high enough that a data incident is expensive.

Self-hosting an open-weight model is the other real answer: full data control, no third party, and a genuine licence — a fundamentally different proposition from an anonymous hosted endpoint that merely feels similar because both are free at the point of use.