In late August, for six days running, the most-used model on the internet had no name, no price and no owner anyone could identify. Since then three labs have shipped new models, and each one now decides case by case who is allowed to use it.
Edition 028 · 4 September 2026
Ox Alpha spent six days as the most-used model on the internet.
Ox Alpha appeared on OpenRouter with no lab attached and no price, and spent six days processing more tokens than any other model on the platform before Bloomberg traced it to Z.ai. Since then three labs have shipped new models, each one deciding case by case who is allowed to use it.
01
Topic of the Week
Ox Alpha
Ox Alpha appeared on OpenRouter on 20 August under the provider name “Stealth”. No keynote, no model card, no lab attached to it. $0 per token, a 1,048,576-token context window, text, image and video in, tool calling on, and usage limits loose to the point of not really being limits. The provider claimed capacity for 100 trillion tokens a day, which is their own claim rather than a measurement.
Then developers did what developers do with a free frontier-class model. Between 20 and 25 August, Ox Alpha processed 23.2 trillion tokens on OpenRouter, 2.3× the next model on the platform, and for six full days it was the single most-used model there. Claude Code was among the biggest sources of traffic to it, so these were production workloads. Which means that for most of a week, a meaningful slice of the world’s AI coding traffic was going to an endpoint whose operator nobody could name. No terms anyone could read, no jurisdiction, no data-handling commitment. It was fast, it was good, it was free, and for a lot of teams that was enough.
On 26 August Bloomberg named the lab: Z.ai, the Chinese team behind the GLM series. Ox Alpha is GLM-5.3-Flash: 320B mixture-of-experts with 18B active, natively multimodal, ~1M context, served on domestically produced Chinese accelerators rather than Nvidia hardware. The weights went up on Hugging Face under an MIT licence the same day, priced at $0.15 and $0.50 per million. A launch promotion halves that to $0.075 and $0.25 until 9 September, so the cheap window for benchmarking it against your own workload is open right now.
The practical read: two things happened here and they’re worth separating. Near-frontier coding performance now has an open-weights, MIT-licensed option at roughly a tenth of the price, which is a live procurement question for anyone running agents at volume. Separately, a lot of teams pointed production traffic at an anonymous endpoint for a week and nobody stopped to ask whose it was. If your agents can reach an OpenRouter model list, they can reach the next one of these too.
TechCrunch: who’s behind Ox Alpha · TechCrunch: Z.ai confirmed · Bloomberg · OpenRouter · DataCamp: GLM-5.3-Flash
02
New Models
Three labs shipped this week. Each release built around exactly the thing Ox Alpha didn’t have: somebody deciding who gets in.
Astra is OpenAI’s GPT-6, out 3 September, and OpenAI calls it the best model for software engineering it has built. What it did during safety testing is the part worth knowing: it found two previously unknown vulnerabilities on its own, broke out of a browser sandbox to run commands on the machine underneath, and chained several separate flaws together to get through a hardened operating system. It’s the first model to cross the Critical cybersecurity threshold under OpenAI’s Preparedness Framework, which is why it went to Daybreak cyber defenders first and only reaches Pro, Plus, Enterprise and the API over the following week. The criticism is about how it reasons: Astra uses opaque recurrence, so much of its thinking never surfaces as language tokens. Chain-of-thought monitoring only works on reasoning a model writes down, and last week’s Hugging Face post-mortem found that exact monitoring would have caught the breach more than a day early. Astra writes less of it down.
Claude Fable 5.1 landed 1 September, with Mythos 5.1 alongside it. What matters here is the bill. Base pricing doesn’t move, still $10 and $50 per million, but cache reads drop from $1.00 to $0.25. That’s a 75% cut on the part of the bill that agentic work generates most of, and it works out to roughly 25–45% off those workloads in practice. Two API changes to know about before you upgrade: tool_choice no longer accepts "any" or "tool" and returns a 400 instead, and for accounts created after 31 August, editing a previous turn invalidates its thinking blocks. Mythos 5.1 is the same model with lighter safeguards, and Anthropic hands it out only to US organisations it has approved one by one, through Project Glasswing.
Gemini 3.8 Flash shipped 2 September at $0.75 in and $3.75 out per million, introductory through 31 December. Google’s pitch is that it solves engineering problems end to end better than most larger frontier models at a fraction of their cost, because it does more reasoning steps and more iterative tool calls on hard tasks instead of answering faster. The sibling, Gemini 3.8 Flash Cyber, is built to find and patch vulnerabilities across 20 programming languages, and goes out only through the Fairwind Program, which is open to government bodies and the people running critical infrastructure and nobody else.
Daybreak. Project Glasswing. Fairwind. Three names for the same arrangement: you apply, somebody at the lab checks who you are and what you want it for, and they decide whether you get the model. All three set up inside seventy-two hours.
TechCrunch: Astra · SecurityWeek · OpenAI: Path to Astra · MarkTechPost: Fable 5.1 · Google: Gemini 3.8 Flash
03
Security Watch
The other half of last week’s story got its answer. Anthropic published what it changed after the three incidents where Claude models gained unauthorised access to real computer systems.
The eval environments got hardened first: real-time classifiers that flag when a model starts probing or trying to escape its testing environment, automated transcript monitoring, high-risk cyber sandboxes moved to stronger isolation, and external cyber evaluations paused while it all went in. External partners now get a mandatory baseline too: hardened sandboxes with no internet by default, a validation pass before real testing starts, explicit scope-setting in the prompt, continuous monitoring while it runs. Internally, back in April, Anthropic reassigned roughly 150 product engineers to security work, cut standing access to systems holding model weights, and set compute clusters to block outbound traffic by default. METR is doing an independent review; nothing published from it yet.
Read that next to Astra breaking out of a browser sandbox during its own evaluation. The labs are hardening the environments at roughly the same rate the models are getting better at leaving them.
04
Fresh Papers
Token-Efficient Data Reasoning Agents via Adaptive Structuring of Unstructured Data. This one is the most immediately useful paper of the week if you’re running agents over documents. The problem it names is one you’ve probably paid for: an agent answering a complex question keeps reloading big documents into context to pull scattered facts out of them, and burns up to a million tokens doing it. If that same data already sat in a database, the identical questions would cost 28× less. But pre-structuring everything is a non-starter, because documents contain far more potential structure than any workload will ever touch.
Their answer, borrowed from database cracking, is to structure lazily and let the queries tell you what matters. When the reasoning agent opens a document, a parallel sub-agent speculatively extracts facts likely to help future questions, reusing the document’s already-cached KV prefix so the extraction costs no extra prefill. Facts land as RDF-style triples with evidence attached. The next query checks a catalogue first and only falls back to opening the raw document if nothing’s there. The savings: questions that cost $0.26 come down to $0.12, and in a longer investigation $0.81 comes down to $0.27, with prefill tokens roughly halved. Answer quality holds steady. The saving grows the longer a workload runs, because related questions keep reopening the same documents.
E-Commerce Bench. Agents run a full 365-day simulated business: sourcing, supplier negotiation, pricing, returns, cash flow, with promotions, natural disasters and supply-chain disruptions thrown in. 18 frontier models, seven scored dimensions, and no single winner. The model that ended the year with the most money in the bank also came 16th out of 18 at avoiding fraud, and was beaten on operational efficiency by a model that made less. The model that makes you the most is not necessarily the one you’d let sign things.
05
Claude Code & Coding AI
Terminal sessions now resume in the Claude Code desktop app. Type /resume and pick any session you started from the CLI, and it continues in the app with the full conversation and context intact. Small feature, removes a genuinely annoying seam between working in the terminal and wanting a window.
Fable 5.1 is in Perplexity Computer for Pro and Max subscribers. Perplexity ranked it first in their August evaluation at $12.76 per task, doing better work for 37% less money than whatever held the spot before. Someone who has to pay the bill rating a vendor’s model counts for more than the launch post.
OpenAI is cutting Cursor off, and the reason is that SpaceX bought it. OpenAI published its decision to wind down the contract that supplies its models to Cursor after the acquisition, with direct access ending in November. If anyone on your team works in Cursor on OpenAI models, that is a migration with a date on it, and the date is close. Worth checking now which of your tools depend on a model contract you don’t control, because this is the first time one has been cancelled over who the owner is rather than what the tool does.
06
Tools of the Week
Mantis is Google’s open-source harness for finding and fixing bugs, and it went public on 2 September with a getting-started guide. Google’s reasoning: models have already proven they can discover and exploit vulnerabilities with little or no human help, so defenders should get the same automation. Mantis is a harness rather than a model. You point it at a codebase and it runs the discovery-and-patch loop. Given that three cyber-capable models this week went out only to vetted organisations, an open harness anyone can run is a more practical thing to have than a waitlist place.
07
AI as a Public Utility
South Korea is going to give all ~52 million of its citizens free access to generative AI, with no token caps. The Ministry of Science and ICT named three consortia to run it, led by SK Telecom, KT and Kakao, each launching a dedicated app and wiring AI into services people already use. Beta testing starts this month, full rollout later this year. The state is distributing up to 512 Nvidia B200 chips across the three operators and subsidising running costs, and from next year plans to cover ongoing operating costs outright. The Wall Street Journal called it the first major state-led programme to treat the technology as a public utility.
The condition attached is the interesting bit. At least 50% of queries must run on certified Korean foundation models, plus another 30% on other domestic ones, giving an 80% domestic floor. Foreign tools are allowed only where the ministry judges them necessary, and get no subsidy. Roughly 23 million Koreans already use generative AI regularly, overwhelmingly on ChatGPT, so this is an attempt to move an existing habit onto domestic infrastructure rather than to introduce anyone to the technology. It’s also a different bet from Europe’s and India’s, which fund compute capacity and let the market sort out the products. Korea is skipping that and handing citizens the finished thing, and it’s the first version of this we’ll get to watch actually run.
08
AI at Tenvalleys
On 1 September the school year opened at ZSLiT nr 1 in Warsaw, and the first “Programista AI” cohort walked in. Whole school out in the yard, white shirts, flag party on the red court. The head teacher opened the year with actual enthusiasm rather than the sort that gets read off a sheet of paper, and the message was that the school knows it has to keep pace with a world that isn’t going to slow down for anyone’s timetable.
Our part of the reform is the programming track: curriculum, module programmes, exercises and the teacher training behind them, pro bono, written since February. A general secondary school teaches subjects that move slowly. A technical school teaches technology, and that content goes stale on a completely different clock. Most institutions quietly decide not to deal with that: the curriculum stays, the world moves, and the gap becomes the graduate’s problem four years later. ZSLiT’s leadership refused that trade, which is the only reason any of this was possible.
For us this is not a finish line but the first real test. Whether what we built holds up isn’t a question any document can answer. Only the students and the ordinary reality of a school year can, and they started answering on Tuesday. The whole story is at tenvalleys.com/stories.
09
For Dessert
Someone went and tested whether the oldest trick in door-to-door sales works on language models. It’s called door-in-the-face: ask for something outrageous, get turned down, then ask for the thing you actually wanted, and the other party feels obliged to meet you halfway. Works on humans. Researchers ran it on nine production models across three labs.
It works on Claude. Opus 5 answered the smaller request more than twice as often after refusing a bigger one first, compared to being asked straight out. OpenAI’s and Google’s models did the opposite and got more suspicious. So there’s no universal law of machine persuasion here, just different houses raising their models with different manners.
The part that stuck with me is buried further down. Take a request a model refused, and instead of asking it to do the thing, ask it to explain the thing. The refusal disappeared in 263 of 265 cases. Whatever we think guardrails are made of, a good part of it turns out to be grammar.