Ox Alpha Revealed as GLM-5.3-Flash: What Changed?

Back

Kevin Riedl

10 min read · 23 Aug 2026
Last reviewed October 20, 2026

Next

Ox Alpha was the stealth preview of Z.ai GLM-5.3-Flash. The preview ID is historical. For new work, choose a named route: paid providers on OpenRouter, or OpenCode’s separately listed paid and limited-time free GLM-5.3-Flash routes. A free promotion is not a continuing availability commitment.

The official display name is Ox Alpha, with the letter O. Many people search for 0x Alpha or 0xAlpha. This guide owns the model-specific setup, privacy and pilot decision. For tool economics, read our Claude Code versus OpenCode team-cost comparison. For portfolio architecture, use the multi-model coding-agent buying guide.

Ox Alpha at a glance

The historical Ox Alpha record now says the model was developed and operated by Z.ai and revealed as GLM-5.3-Flash. The current GLM-5.3-Flash record lists the named model, providers, public weights, current prices and a 1,048,576-token context window.

Which route should replace the old Ox Alpha preview?

OpenCode’s current model and pricing list names both routes. The former x-preview-f-free ID remains historical. OpenCode states zero retention and no training for its named free route; this does not describe OpenRouter providers or the old preview.

Is Ox Alpha private enough for company code?

Not by default. A repository can contain credentials, customer identifiers, private issue text, proprietary algorithms and licensed code. A zero-dollar model invoice does not transfer permission to disclose those assets.

The historical preview page says Ox Alpha prompts and completions were retained by the provider and not used for training. The broader OpenRouter Stealth Program agreement governed other uses. Preserve those terms with past evaluation records. For new GLM-5.3-Flash calls, review the current named-model provider policy instead of assuming the old stealth terms still apply.

When a product page and a general agreement appear to differ, a cautious buyer should follow the stricter boundary until counsel or the platform confirms the applicable terms in writing. For OpenRouter, do not send private repositories, personal data, health data, financial data or customer material. For OpenCode Zen, verify the current policy again at pilot start, record it in the evaluation, and still remove secrets. Our PII-redaction guide for LLM prompts provides the preprocessing pattern.

How to use the named GLM-5.3-Flash model in OpenCode

1. Choose the route first. Decide whether the OpenCode Zen or OpenRouter terms fit the data classification of your test.
2. Create a separate pilot key. Give it the lowest practical budget and no access to unrelated environments.
3. Connect the provider. In OpenCode, run /connect, choose OpenCode Zen or OpenRouter, and paste the matching API key.
4. Run /models. For OpenRouter select openrouter/z-ai/glm-5.3-flash; for OpenCode use opencode/glm-5.3-flash or its separately listed opencode/glm-5.3-flash-free route. Record the provider and selected ID.
5. Start with a sanitized repository. Use a copy with secrets removed, synthetic fixtures and no customer data.
6. Constrain permissions. Require approval for network access, package installation, destructive shell commands and writes outside the worktree.
7. Verify independently. Run deterministic tests and have a separate reviewer assess correctness and security.

The official OpenCode provider setup guide documents the /connect and /models flow for both Zen and OpenRouter. Do not paste API keys into project configuration or commit them.

Is Ox Alpha really free, or are there hidden costs?

Free depends on the route. OpenRouter is paid; OpenCode currently advertises a limited-time named free route. Tool charges and human review still belong in the budget.

For example, the OpenRouter PDF-input documentation lists a paid Mistral OCR option alongside free Cloudflare parsing and native processing. If no engine is selected, routing can choose a parser for you. A zero-cost model can therefore coexist with a non-zero request.

What is Ox Alpha good for?

• Long-repository exploration: compare its architecture map and cited file paths against a trusted baseline.
• Multi-file implementation: test whether it keeps requirements, tests and local instructions aligned across a bounded change.
• Visual bug triage: combine a sanitized screenshot with code and a reproducible error report.
• Cost-controlled evaluation: build an internal task set with explicit model, provider and tool budgets.

A 1M window is capacity, not evidence of perfect recall. Test buried constraints at different positions, conflicting instructions, tool recovery and completion quality. If your real question is whether long context should replace retrieval or adaptation, use our RAG versus fine-tuning versus long-context decision guide.

Who should not deploy Ox Alpha?

• Teams without an approved provider, recorded terms, a fixed artifact where needed, or an acceptable availability and support arrangement.
• Workloads containing secrets, regulated data, customer repositories or data you cannot lawfully share with the selected route.
• Production automation without strict tool permissions, output validation, rollback and a fallback model.
• Buyers choosing from screenshots, self-reported identity answers or unrepeatable benchmark claims.

A proposed seven-day GLM-5.3-Flash evaluation plan

1. Day 1, contract and data gate: archive the current route terms, classify the test data and remove secrets.
2. Day 2, baseline: freeze 15 to 25 representative tasks, repository commits and acceptance tests.
3. Days 3 and 4, repeated runs: run the selected GLM-5.3-Flash route and one approved fallback at least three times per task class.
4. Day 5, adversarial review: test denied files, prompt injection, tool errors, stale documentation and ambiguous requirements.
5. Day 6, commercial scorecard: calculate accepted changes, serious defects, latency, reviewer minutes and total non-model charges.
6. Day 7, decision: approve a narrow use, keep it in experimentation, or reject it. Define the exit trigger if pricing, identity, terms or model behavior changes.

Recommendation: retire the Ox Alpha preview ID and evaluate the named GLM-5.3-Flash model as a fresh dependency. Pin the provider, archive current terms and pricing, rerun acceptance tests and keep a fallback. If the pilot succeeds, ask Wavect to turn the results into a governed AI-agent rollout.

Sources and research boundary

Reviewed on 20 October 2026 against the linked provider records. This is a source review and a proposed evaluation, not a Wavect model benchmark. Provider policies, pricing, context limits and promotions can change; record them with each pilot.