OpenRouter free models — week of 2026-08-23

Verdict

Point oxbox at stealth/ox-alpha this week, and do it before roughly Aug 27 — the free window was stated as about one week from the Aug 20 listing. Its self-audit against oxbox's own source is the strongest evidence either of us has about its review quality, and it is better evidence than any benchmark in this report. Keep z-ai/glm-5.2:free as the standing fallback: it is the strongest named free model on agentic coding, it is not on a countdown, and it is not going to vanish mid-review.

Stealth tier

1. Ox Alpha — stealth/ox-alpha · USE (expiring)

Observed behavior (oxbox logs, not benchmarks):

• Review quality: pointed at oxbox's own source in --mode review, it produced ten containment findings. Four were verified by direct experiment and all four were real. It labeled two as UNCERTAIN, and both turned out to be removable outright — so the uncertainty was calibrated, not hedging. That is a better result on a review task than anything in the named tier has demonstrated.
• Output hygiene: poor. Emitted a hunk header with zero trailing context (@@ -1,4 +1,7 @@) despite an explicit instruction for three lines; both git apply and GNU patch reject it, and oxapply had to fall back to --recount -C1. The underlying fix was correct and byte-identical to a hand-written reference once applied. So: trust the content, distrust the packaging.
• Reasoning traces: inconsistent. Short calls returned reasoning_chars=0 despite advertised mandatory reasoning; a long review returned 52,656 characters. Do not build parsing that assumes one.
• Availability: two distinct failure modes, and they need different responses.
  • 404: No endpoints available matching your guardrail restrictions and data policy — account-wide, reproduced across two keys. Fix is enabling prompt logging in OpenRouter privacy settings.
  • 429 ... "limit_source": "upstream_provider_shared_pool" — transient, not your key or account, no settings change clears it. Two attempts 150s apart both failed on a 72KB review; 10-minute spacing is the saner floor.

The caveat that matters most: OpenRouter's Ox Alpha listing says prompts and completions are retained by the provider and not used for training, under separate Stealth Model Terms. But the endpoint only resolves at all if prompt logging is enabled account-wide — the toggle that makes it free is the toggle that hands over the prompts, and is_moderated is false. Treat the "not used for training" line as the provider's assertion, not as a property you can verify. Under the public-code-only constraint this is tolerable; it would not be otherwise.

Nothing else is live. The stealth page lists exactly one model. This tier is intermittent by nature.

Recent attribution history — useful as a prior on the GLM-5.3 guess, and on how often these guesses are wrong:

Zhipu has done this before and said publicly that it worked, which is the real support for the GLM-5.3 theory. The Hunter Alpha row is the reason to hold it loosely.

Named free tier

Ranked for sandboxed review of public code. Every benchmark below is vendor-reported unless noted.

1. GLM 5.2 — the strongest of the five on the axes that resemble the job. It leads Inkling 82.7 to 63.8 on Terminal Bench 2.1, 62.1% to 54.3% on SWEBench Pro, and 40.1% to 30.0% on HLE text-only. MIT licensed. Also the family most likely to be the thing behind Ox Alpha, which makes it a useful control: if a GLM 5.2 review and an Ox Alpha review of the same file look alike, that is a fingerprint data point you generated yourself.

2. Laguna S 2.1 — 118B MoE, 8B active (~6.8% per token), open weights under OpenMDW-1.1, and small enough for a single DGX Spark if the free endpoint annoys you enough to self-host. The DeepSWE v1.1 result (40.4% against DeepSeek-V4-Pro-Max's 9.0% at a sixth the active parameters) is the eye-catching one, though it is Poolside's own leaderboard and TNW's read is that it sits 10–15 points behind closed leaders on Terminal-Bench. Free tier trains on your inputs and outputs — under public-code-only, acceptable; worth stating out loud rather than forgetting.

3. Nemotron 3 Ultra — the 1M free context and 65,536 max output are the reason it is here; it is the only entry where a very large review fits in one request, which matters more than benchmark position when the cap is requests per day. Temper the agentic pitch: BenchLM has it #152 of 218 overall with Agentic as its weakest category at #117 and Instruction Following its strongest at #4. That profile — follows directions well, plans poorly — is arguably fine for review mode, where you want it to do what you asked and not to run an agenda.

4. North Mini Code — 30B/3B-active, Apache 2.0, runs on one H100 at FP8. Interesting for a specific reason: it was trained against multiple harnesses deliberately, and Cohere reports that 6% OpenCode-harness data in the second SFT stage gave a 10% gain on the OpenCode eval without hurting SWE-Agent, plus 61.0% pass@1 on mini-SWE-Agent that emerged from cross-harness transfer. If oxbox's prompt shape is unlike anything in a model's training mix, this is the one most likely to cope. Self-hosting needs vLLM main plus Cohere's melody library for correct response parsing.

5. Inkling — 975B/41B active, Apache 2.0, text+image+audio in. Controllable thinking effort from 0.2 to 0.99, and it matches Nemotron 3 Ultra on Terminal Bench 2.1 at roughly a third of the tokens. Under a request-capped free tier, token efficiency converts into fitting more review into fewer calls. Score-wise it is mid-pack.

Caveats

• Every score above except the BenchLM ranking is vendor self-reported and unaudited. Cross-vendor tables compare different harnesses.
• None of these benchmarks measure code review. SWE-Bench and Terminal-Bench measure patch generation. The thing you care about — real findings, few false positives, calibrated uncertainty — has no public benchmark. Your oxbox logs are the only real instrument you have, which is why they rank above this whole table.
• Free endpoint context is often below the model card. GLM 5.2 and Laguna S 2.1 both advertise 1M and both serve 256K/262K free. Budget against the endpoint.
• Roster churn is fast. Eight :free endpoints were delisted in recent weeks. Don't hardcode a model ID in anything scripted; keep an ordered fallback list.
• Two independent rate limits. OpenRouter's account limits are 20 req/min always, 50 req/day unfunded or 1,000/day after a one-time $10 credit purchase that never expires. The stealth shared upstream pool is separate and neither is affected by the other.
• Pipelines hide ox's exit code. ./ox … | tail reports tail's status. Use set -o pipefail before treating a scripted run as successful — otherwise a 429 looks like a clean run with a short review.
• The Ox Alpha window closes around Aug 27. If the self-audit is worth repeating on a second file, this week is the week.

Churn since last report

First run — no baseline. Next week's report diffs against this one.

Generator review

Triggers checked: 8. Fired: 0.

No revision proposed. The rules are one week old and have processed one landscape snapshot; there is not yet enough signal to justify moving a weight. Specific non-events worth recording so next week has a baseline:

• Ox Alpha remains unclaimed as of Aug 23 — the attribution trigger has not fired, but it is the most likely one to fire next week, since past reveals have landed roughly 5 days to 2 months after listing.
• The 50/1,000 per-day and 20/min structure is unchanged.
• No new cloaked venue observed. LMArena is running anonymous image checkpoints (mona-lisa-1, luna-lisa-alpha) but those are not API-callable, so they stay out of scope. If a text model appears there callable, that widens scope and fires trigger 3.
• Axis 1 vs axis 6 weighting is untested — it needs a week where the logs and the benchmarks disagree.

The one thing I would watch in the rules themselves: axis 2 (output hygiene) may be underweighted. Ox Alpha's malformed hunk headers are a small annoyance in --mode diff and a non-issue in --mode review, but if the mix shifts toward diff mode, a model that needs --recount on every patch is worse than its finding quality suggests. Not proposing a change yet — flagging it so that if it bites next week, the trigger is already written down.

---

This edition is published from its source file. The evidence behind it, the catalog snapshots and the manifests, is in oxbox-survey, and nothing from there is edited on the way here.