On August 20, 2026, an unnamed AI model appeared on OpenRouter with no press release, no corporate branding, and no creator. Within days, it climbed to the top of every usage chart, outperforming GPT-5 and Grok 4 on complex coding tasks. The internet gave it a name:
Ox Alpha. Millions of developers and researchers began asking the same question:
who made this?
We conducted a deep OSINT investigation — combining WHOIS forensics, DNS analysis, tokenizer fingerprinting, error-code tracing, and corporate registry searches across multiple countries — to answer that question. Here is what we found.
The Two Layers of Mystery
The first trap in this investigation is conflating the
website with the
model. They are controlled by completely different entities.
Layer 1: oxalpha.com — The Anonymous Wrapper
The website
oxalpha.com appeared almost simultaneously with the model, offering a free, no-login chat interface. Our WHOIS investigation revealed:
| Field | Detail |
| Domain | oxalpha.com |
| Registered | February 21, 2022 (4 years before the AI appeared) |
| Expires | February 21, 2028 |
| Registrar | NameCheap, Inc. |
| Owner | Withheld for Privacy ehf (Reykjavik, Iceland) |
| DNS | fastdns24.com (FastVPS infrastructure) |
| Contact | hello@oxalpha.com |
The domain was originally a speculative registration — likely parked since 2022 — then reactivated in August 2026 to capitalize on the buzz. The site's own About page confirms the separation:
"oxalpha.com is not affiliated with, endorsed by, or operated by whoever built the model. We're enthusiasts who wanted a fast, free way to use it."
Its Terms of Use contain no company name, no registration number, and a deliberately vague jurisdiction clause. No match was found on OpenCorporates, Companies House (UK), or any corporate registry.
Verdict: The website is a third-party fan project. Not the creator.
Layer 2: The AI Model — Digital Forensics
If the website is a dead end, how do you identify the real creator? The same way digital forensics experts catch criminals: by examining
fingerprints.
Every AI model carries unique signatures — in its tokenizer, error messages, and multimodal pipeline — that are as identifiable as human DNA.
Evidence #1: Identical Tokenizer (95/95 Match)
Researcher
Joseph Elstner, using the open-source
modelprint tool, ran Ox Alpha through 95 probe tests comparing its tokenizer against known model families. The result:
95 out of 95 perfect matches with Zhipu AI's GLM-5 family. A systematic +75 token offset per prompt was detected, attributed to a hidden system prompt wrapper — a known Zhipu engineering practice.
Evidence #2: Proprietary Error Codes
When Ox Alpha encounters invalid parameters, it returns error codes
1210 (invalid reasoning_effort) and
1214 (internal configuration error). These codes are
documented exclusively in Zhipu AI's official API documentation. No other AI provider in the world uses these identifiers.
Evidence #3: Video Processing Pipeline
Ox Alpha's multimodal video encoding — how it segments and consumes video tokens per frame — is an
exact match with the
GLM-5V-Turbo pipeline, including identical per-frame token budgets.
Evidence #4: The "Pony Alpha" Precedent
Zhipu AI previously deployed a model under the anonymous codename
"Pony Alpha" using the exact same playbook: an "Alpha" name, no attribution, third-party platform distribution, and free unlimited access during stealth testing. The pattern is identical.
The Suspect: Z.AI (Zhipu AI) — Full Corporate Profile
All forensic trails converge on a single company:
Z.AI Co., Ltd., formerly known as
Zhipu AI.
| Field | Detail |
| Legal Name | Beijing Zhipu Huazhang Technology Co., Ltd. |
| International Brand | Z.AI Co., Ltd. |
| Founded | 2019 (Tsinghua University spin-off, Beijing) |
| Headquarters | Haidian District, Beijing, China |
| Stock Exchange | Hong Kong Stock Exchange — HKEX: 2513 (IPO January 2026) |
| CEO | Zhang Peng |
| Chairman | Liu Debing |
| Chief Scientist | Prof. Tang Jie (Tsinghua University) |
| Key Investors | Alibaba, Tencent, Meituan, Xiaomi, Sequoia China (HongShan) |
| Flagship Products | GLM-5 (LLM), CodeGeeX (code), Zhipu Qingyan (AI assistant) |
| Suspected Model | GLM-5.3 Flash (unreleased variant) |
Z.AI became the
first major Chinese LLM developer to go public in January 2026. Its co-founders Liu Debing and Tang Jie are now billionaires (Forbes).
Why a Stealth Launch?
The strategy is deliberate. By deploying GLM-5.3 Flash anonymously, Zhipu AI achieves three goals:
- Unbiased Real-World Benchmarks: Without a brand attached, testers judge the model on merit alone — not reputation.
- Organic Viral Buzz: Mystery generates more media coverage than any traditional press release.
- Production Stress Testing: Free unlimited access during stealth means millions of diverse real-world prompts — the ultimate quality assurance pipeline.
Theories We Investigated and Eliminated
| Theory | Why It Doesn't Hold |
| Microsoft | No tokenizer match, incompatible architecture |
| Xiaomi (MiMo) | Different tokenizer, inadequate model size |
| Google DeepMind | Unrelated infrastructure and response styles |
| Unknown Startup | The GPU infrastructure required (1M tokens + multimodal) rules out any modest player |
The Complete Chain
User (You)
│
▼
oxalpha.com (Anonymous enthusiast chat UI)
│ API calls
▼
OpenRouter (Distribution platform — not the creator)
│ GPU Inference
▼
Z.AI / Zhipu AI (Beijing, China — HKEX: 2513)
Model: GLM-5.3 Flash (probable)
Important Disclaimer
As of August 25, 2026,
Zhipu AI has not officially confirmed being behind Ox Alpha. Our conclusion rests on converging technical forensic evidence — tokenizer matching, proprietary error codes, multimodal pipeline analysis, and historical deployment patterns. If history follows the "Pony Alpha" precedent, an official announcement from Z.AI could come within days or weeks.
What This Means for You
- If you use Ox Alpha: Your prompts likely transit through servers controlled by Zhipu AI in China. Keep this in mind for sensitive data.
- If you're a developer: The model is accessible via the OpenRouter API while it remains in stealth. It's free — for now.
- If you're an investor: The Z.AI stock (HKEX: 2513) may react to any official confirmation.
Investigation conducted using OSINT multi-source analysis on August 25, 2026. Sources: WHOIS, DNS records, Wayback Machine, OpenCorporates, OpenRouter, Reddit, Hacker News, Business Insider, Forbes, community tokenizer analyses.
Besoin d'un accompagnement technique ou d'un audit SEO ?
Expert PrestaShop freelance et activateur officiel FranceNum, j'optimise la performance, la sécurité et la visibilité de votre e-commerce.
🚀 Échanger sur votre projet