What models are good this week?

Short answer

Point oxbox at stealth/ox-alpha, and raise --max-tokens to 100,000 first.

On oxbox's own ox it produced five findings, four confirmed by hand and one untested, with zero false positives — including a real credential leak that had been in the tool since before the venue work. One file, one prompt: a small sample, and the strongest run-backed result in the survey so far.

A second corpus from this period is held back from the public edition; the figures below are what it is possible to show.

Raise the budget before you start. Reasoning is billed against max_tokens, and at oxbox's 32,000 default one batch spent 122,707 characters reasoning, emitted four findings, and was cut off mid-sentence. The same files at 100,000 gave fifteen findings and finished clean.

Three venues joined the survey since issue 0.1 — ZenMux, Requesty, OpenCode Zen — taking the free tier from 22 models to 46. None of them displaced Ox Alpha.

The models

Cloaked (or stealth) models are listed under a codename with no lab attached — a vendor testing an unreleased model in public, usually free while the window lasts. You get no name, no card, no promises, and it can vanish without notice. Named models say who made them and what they are, which is most of the free tier.

Stealth

stealth/ox-alpha — USE. The only cloaked listing on OpenRouter this week.

Terms belong to the venue, not the model. On OpenRouter it returns 404: No endpoints available matching your guardrail restrictions and data policy until prompt logging is enabled account-wide. On OpenCode Zen it answered a minutes-old key with no privacy toggle at all.

Attribution. Community fingerprinting points at Zhipu's GLM-5.3. This week ran the matched experiment issue 0.1 asked for — same file, prompt, mode, parameters:

Evidence against, held loosely: the calls went through different venues, and a venue may translate reasoning: {"effort": "high"} differently before the model sees it.

big-pickle (OpenCode Zen) — HOLD. Cloaked, no OpenRouter equivalent, and the reason this venue was added. Every call returns 503 from its upstream provider while its siblings answer in the same minute.

Named — OpenRouter, 22 free

Plus google/gemma-4-{26b,31b}, nemotron-3-super-120b, nemotron-3.5-content-safety, inkling-small, laguna-xs-2.1, nemotron-3-nano-omni, two Lyria audio previews, and openrouter/free.

Three endpoints expire today and may be gone already; next week's diff will catch them.

Named — ZenMux, 8 free

All eight are free nowhere else.

Free here needs a funded account. An unfunded one gets 402 reject_no_credit — "your account must have a balance greater than $0 — no credits will be deducted". Any balance clears it, and calls genuinely cost nothing after that.

Named — Requesty, 12 free

Five are free nowhere else, and this is the only venue publishing data terms as structured fields.

mistral/leanstral-1-5 has the cleanest data profile in the survey, on a model OpenRouter does not offer free at all. No card; 200 requests/day.

Named — OpenCode Zen, 64 models, prices not published

The catalog returns id, object, created, owned_by and no pricing, so every row's free is unknown. Reachable and confirmed free by calling them: x-preview-f-free (Ox Alpha under another name), nemotron-3-ultra-free, mimo-v2.5-free. A community catalog surfaced seven free models absent from OpenRouter — but also listed 20 models that do not exist in the live roster, so it is a discovery tool and never a source.

What we ran

Four models. This is the only section that can justify a USE.

stealth/ox-alpha — USE

• Reliability splits by evidence type, not subsystem. Locally checkable defects — bounds errors, integer underflow, inverted conditions, sizeof on a pointer — confirmed at a far higher rate than system-level concurrency claims, because judging the latter needs dispatcher topology and caller trees no file set contains. That predicts verification cost before it is spent.
• Impact claims were wrong more often than defect claims — repeatedly a real defect with a fabricated trigger, which is the most expensive output to handle because it reads as already verified. Check defect and impact separately.
• It declined to invent findings, returning "No findings" with an account of why each defect class did not apply, under a prompt explicitly asking for breadth.
• Findings. On oxbox's own ox: five findings, five real, zero false positives — including a credential leak. urllib follows 3xx while keeping every original header, so a 302 from any provider hands the API key to whatever host the Location line names, and oxbox prints that host's reply to the operator as the model's answer. Reproduced locally, then fixed.
• Line numbers drift +4 to +9, in both directions — no fixed offset corrects them. Requiring each finding to quote its anchor line verbatim turns verification from an eyeball into a grep. (Issue 0.1 rated hygiene "poor" on malformed diff hunks in --mode diff; --mode review is a different story.)
• 429s cleared reliably at 120-second spacing. Concurrency is the trigger: three batches launched together all refused immediately; the same work run serially completed, mostly first try. This corrects issue 0.1's 10-minute guidance, which came from a two-attempt sample.

z-ai/glm-5.3-free (ZenMux) — AVOID for review

Scope: one file, one prompt, two runs. AVOID for review is this reviewer's verdict for this task on this evidence — not a general claim about the model or about ZenMux as a venue.

Given Ox Alpha's 13.6 KB file, it returned empty content at both 8,000 and 32,000 token budgets — 99.9% and 99.98% of the budget spent on reasoning, finish_reason set, no error. The 127,380-character trace is coherent, then spirals into Python 2 urllib trivia and ends mid-sentence, circling the exact defect Ox Alpha reported without ever closing on it. An output problem, not a quality one — and invisible in the catalog, which shows 1M context and response_format support.

mistral/leanstral-1-5 (Requesty) — HOLD

Scope: the same single file and prompt, n=1. HOLD means the evidence is too thin to recommend either way, not that the model was found defective.

Same file, same prompt: 6 findings, 0 real defects. Four are titled BUG: and then concluded to be non-defects in the body. One is factually wrong about Python semantics. Three are the same observation with three contradictory verdicts. It found none of the four real defects in that file.

Roughly 10× cheaper and 15× faster than Ox Alpha, and nothing actionable came out — acting on its one confident claim would mean "fixing" a guard that already works. Its data profile is the best in the survey, so: HOLD, worth retrying on a different corpus.

nemotron-3-ultra-free, mimo-v2.5-free (OpenCode Zen) — TRY

Reachability confirmed. Not reviewed on anything yet.

Churn since last report

• Scope widened from one venue to four: ZenMux (8 free), Requesty (12 free), OpenCode Zen (64 rows, prices unpublished) joined OpenRouter's 22. 46 distinct free models, up from 22.
• big-pickle appeared and is unreachable — 503 from its upstream provider.
• Three OpenRouter endpoints expire today; dots-3-note-preview on 2026-09-30.
• Ox Alpha remains unclaimed, five days after listing.
• No repricing. No new cloaked venue beyond OpenCode Zen.

How far to trust this

• The catalog and the runs are different evidence. Every table above is Measured, straight from snapshots/; everything under "What we ran" is one reviewer's oxbox logs. The catalog says what is on offer, never whether it is any good.
• These are case studies, not a benchmark — a handful of runs, one reviewer. No public benchmark measures review quality; SWE-Bench and Terminal-Bench score patch generation, a different skill.
• The model-to-model comparison is one file each. Matched on input and prompt, but n=1 per model.
• Prices are published by three venues and not the fourth. OpenCode Zen's 64 rows record free: null — unknown, not zero, and not inferable from a -free suffix.
• Endpoint context is frequently below the card (GLM 5.2 advertises 1M, serves 256K). Budget against the endpoint figure.
• expiration_date is what the venue published, not what is true — Ox Alpha's 2098-12-31 against a free window issue 0.1 described as about a week.
• Two venues gate on money differently. ZenMux needs a funded balance; OpenRouter's 50 requests/day becomes 1,000 after a one-time $10. Whether OpenCode Zen requires a card at signup is unresolved — its signup page describes a $20 balance and never mentions free models, while third-party write-ups say free models are exempt.
• Pipelines hide ox's exit code. set -o pipefail before trusting a scripted run.

Generator review

Triggers checked: 10. Fired: 2.

T3 — a new venue for cloaked models. Fired, and had been fireable since issue 1, which recorded Ox Alpha as "also on OpenCode" without scoping it in. Acted on: the fetcher is multi-venue, and the class A/B distinction exists because OpenCode publishes a roster without prices.

T6 — a tried model contradicted the catalog. Fired twice. glm-5.3-free reads as a capable 1M-context model with structured output and cannot complete a review at any budget tested; big-pickle is listed and returns 503. Both are invisible in every snapshot here. Proposed, not applied: an opt-in access probe that records whether a model answers, turning free from a price claim into a tested property.

Not fired: T1 (Ox Alpha still unclaimed), T2 (rate-limit structure unchanged), T4 (no delistings yet — three endpoints expire today), T5 (no review-specific benchmark), T7 (stealth tier occupied), T9 (no repricing), T10 (part 2 is the largest it has been).

One rule worth revisiting. Axis 5, token efficiency, needs qualifying: this week the cheapest and fastest model returned nothing usable while the most expensive returned 63 real defects, and the rule as written could be read as favouring the former. Proposed edit — efficiency counts only among models that clear a findings-quality bar, never as a substitute for one. Not applied: one week, one comparison, and the rule has not yet cost anything.

---

This edition is published from its source file. The evidence behind it, the catalog snapshots and the manifests, is in oxbox-survey, and nothing from there is edited on the way here.