This Stealth Model Makes Claude Code Free. Here's How.

Claude Code is a harness, not a model. Point one environment variable somewhere else and the whole thing keeps working: your skills, your CLAUDE.md, your subagents, your MCP servers. Right now the somewhere else that people are pointing it at is Ox Alpha, an anonymous model that appeared on OpenRouter on August 20, 2026 at $0 per million input tokens and $0 per million output tokens, with a 1,048,576 token context window. On OpenRouter's own Apps dashboard, Claude Code is the second largest consumer of that model's tokens, behind one other agent harness and ahead of everything else.

So yes, a claude code free model setup works. It is also slow, temporary, and logged by a provider whose name nobody knows. Here is the exact configuration, followed by the exact list of what you give up.

What is the Ox Alpha stealth model?

Ox Alpha is an anonymous "stealth" model listed on OpenRouter under the ID stealth/ox-alpha, released on August 20, 2026, with free pricing during a preview window. OpenRouter is upfront that it did not build it:

"Ox Alpha is developed and operated by a third-party provider who has chosen to remain anonymous during this preview. OpenRouter routes requests to it and is not its developer, owner, or provider." OpenRouter, on the Ox Alpha model page

The specs are real and they are unusual for something free. The same listing gives it a 1,048,576 token context window, a 131,072 token maximum output, text, image and video input, and support for tool calling and structured outputs. Reasoning is not optional on this model, and it defaults to maximum effort, which turns out to matter a lot for how long your sessions take.

OpenRouter announced it with a one line pitch and a note that surprised people who follow these releases:

"Notes for this stealth model: It is free. This time, the provider does not train on your prompts or completions." OpenRouter, official account on X

OpenRouter co-founder Alex Atallah added his own framing when the listing went live:

"Ox Alpha, a new frontier model is live on OpenRouter! This is our first stealth launch in a while, and we expect it to be a big one. Expect SOTA performance and decent throughput." Alex Atallah, co-founder of OpenRouter

Not everyone was reverent about it. "The model is three Gemini flashes wearing a trenchcoat," replied Brian Sparker of You.com, under the same announcement.

The detail that says the most about who this is for is the Apps tab on the listing itself, which ranks the applications sending the model the most traffic. As of August 22, every single entry in the top five is an agent harness: Hermes Agent at 685 billion tokens, Claude Code at 413 billion, omp at 347 billion, DeepSeek Harness at 331 billion, and pi at 163 billion. The ordering has moved around since launch, and the figures a day earlier were an order of magnitude lower, which tells you how fast the volume is climbing. Nobody is using this thing to chat.

Why can Claude Code run a model that isn't Claude?

Because the model and the harness are separate things. Claude Code sends Anthropic-format requests to whatever address ANTHROPIC_BASE_URL names, and OpenRouter speaks that format. Anthropic's documentation is explicit that once you are behind a gateway, the name checking stops: "your provider or gateway defines the model names, so Claude Code passes any string through without checking it."

That separation is why the swap is less disruptive than it sounds. The harness is the part that reads your files, runs your hooks, spawns subagents, and calls the web. A different model sitting behind it still reads the project instructions you wrote, still invokes your skills, still uses the built in search and fetch tools. This is the same property behind every story about pointing the same harness at outside infrastructure, and it cuts both ways: the flexibility is real, and so is the fact that the safety controls become yours.

That said, the model still has to be good at being an agent. OpenRouter's own integration docs put the warning in plain text: "Claude Code is optimized for Anthropic models and may not work correctly with other providers." Their tutorial goes further and tells readers to keep the models Anthropic: "Claude Code is built around Anthropic request semantics, and the integration is only guaranteed to work with the Anthropic first-party provider." Take that seriously. It is the vendor telling you the thing you are about to do is unsupported.

How do I point Claude Code at OpenRouter?

A base URL, a credential, one deliberately empty value, and a model slug in every role variable. The whole change takes about five minutes.

1. Get an OpenRouter key. Sign up at openrouter.ai, open your account settings, go to API keys, and create one. It starts with sk-or-. No card required to begin.

2. Pick where the config lives. ~/.claude/settings.json applies everywhere. A project level .claude/settings.json applies to one folder. There is a documented catch with the project scoped version. Anthropic's gateway documentation notes that an env block in a project settings file "applies only after the first-run wizard and trust prompt," so if Claude Code asks you to log in even though your key is fine, that is why. Put the credential in ~/.claude/settings.json or a shell export instead.

3. Set the connection. Three values, and the third one trips almost everyone:

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://openrouter.ai/api",
    "ANTHROPIC_AUTH_TOKEN": "sk-or-v1-your-key-here",
    "ANTHROPIC_API_KEY": ""
  }
}

ANTHROPIC_API_KEY has to be an empty string, not deleted. OpenRouter's integration docs call this out specifically: blank it out explicitly to prevent conflicts, or Claude Code can fall back to authenticating against Anthropic directly. The two credential variables also travel in different HTTP headers, so a key in the wrong one returns a 401 rather than an obvious error message.

4. Set the model, in every slot. This is the part most walkthroughs get half right.

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://openrouter.ai/api",
    "ANTHROPIC_AUTH_TOKEN": "sk-or-v1-your-key-here",
    "ANTHROPIC_API_KEY": "",
    "ANTHROPIC_MODEL": "stealth/ox-alpha",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "stealth/ox-alpha",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "stealth/ox-alpha",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "stealth/ox-alpha",
    "ANTHROPIC_DEFAULT_FABLE_MODEL": "stealth/ox-alpha",
    "CLAUDE_CODE_SUBAGENT_MODEL": "stealth/ox-alpha"
  }
}

You fill every slot because Claude Code resolves models per role, not per session. Anthropic's model configuration reference spells out what each one governs: the ANTHROPIC_DEFAULT_* variables control what the opus, sonnet, haiku and fable aliases resolve to, ANTHROPIC_DEFAULT_HAIKU_MODEL also covers background functionality, and CLAUDE_CODE_SUBAGENT_MODEL sets the model "for all subagents, agent teams, and agents in a workflow," overriding both the per-invocation parameter and a subagent's own frontmatter. Miss one and a chunk of your session quietly routes to a model that is not there.

One correction worth making, because older guides still repeat it: ANTHROPIC_SMALL_FAST_MODEL is now deprecated in favour of ANTHROPIC_DEFAULT_HAIKU_MODEL, per the same reference. Setting the old one is not harmful, it is just no longer the variable that does the work.

5. Verify it took. Open a new session and run /model. The status line should show the model you set. For a harder check, the same gateway documentation includes a curl test against the base URL: a response starting {"id":"msg_ means the address and credential both work. An error about an unknown model still counts as a pass, since the gateway had to authenticate you before it could reject the name.

6. Optional. Set CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 and Claude Code queries the gateway for its catalogue at startup, adding those names to the /model picker with a "From gateway" label.

How do I swap in a different free model?

Copy any model slug from OpenRouter and replace it in every slot. That is the whole procedure. But free models rotate off the platform without warning, so hardcoding one slug means your setup breaks on a schedule you do not control.

The more durable option is openrouter/free, a router that picks for you. OpenRouter describes it as one that "selects free models at random from the models available" and "smartly filters for models that support features needed for your request such as image understanding, tool calling, structured outputs and more." Put that in every slot and each request lands on whichever free model can handle it. You lose consistency between requests, which matters more than it sounds like it should. You gain a config that survives a model disappearing.

Why doesn't this work in the Claude Code desktop app?

Because the desktop app does not read these settings at all. Anthropic's gateway documentation states it directly: "The desktop app reads gateway routing from its third-party inference configuration, not from ANTHROPIC_BASE_URL or settings.json."

There is a path to it, and it is buried. Open Help, then Troubleshooting, then Enable Developer Mode, which restarts the app with a Developer menu. From there, Developer, then Configure Third-Party Inference, then enter your gateway base URL. If your organisation has already distributed a configuration, that one wins and the form is read only.

Turning it on costs you things. With a gateway configuration active, the desktop app runs sessions on your local machine only: the environment picker stops offering SSH sessions and Anthropic-hosted cloud environments, and Remote Control is unavailable. Running the CLI in a terminal or in VS Code is the simpler path, and it is what most people testing this actually do.

What breaks when Claude Code runs on a free model?

More than the speed, which is the part everyone warns about. Working through it honestly:

Features that go dark. Remote Control and voice dictation both depend on a claude.ai identity and stop working the moment a gateway credential is active. Remote Control is disabled outright when your base URL points at a non-Anthropic host. Fast mode gets confused too, because its availability check goes straight to api.anthropic.com and does not follow your base URL.

Automatic compaction stops being automatic. When a gateway enforces a smaller context than the model advertises, it rewrites the error in its own words, so Claude Code does not recognise it as a too-long error and does not compact and retry on its own. Your session just dies. The documented recovery is /compact, and the prevention is setting CLAUDE_CODE_AUTO_COMPACT_WINDOW to the gateway's real limit plus CLAUDE_CODE_MAX_OUTPUT_TOKENS below its output cap. A million token window on paper turns into a context budget you have to manage yourself.

Timeouts on long tasks. "Upstream idle timeout exceeded" is the error you will meet, and it is not your fault or the model's. As one explanation in r/openrouter puts it, it "almost always means the provider stopped sending tokens for long enough that the router gave up on the connection." The practical fix reported by people running this setup is to tell the agent to work in smaller chunks, which keeps tokens flowing and the connection alive. On the client side, raising your timeout to 120 seconds or more and honouring Retry-After headers is the standard mitigation.

Tool calling gets shakier. OpenRouter's dashboard reports a roughly 4.45% tool-call error rate for Ox Alpha on a three-day average. That is not catastrophic, but across a long agent loop with dozens of tool calls it compounds. The general pattern holds across the category: tool calling is unreliable on non-Claude models, with some handling multi-step MCP calls cleanly and others breaking on complex flows.

Speed. This is the real tax, and the numbers are not close. In a hands-on walkthrough of the setup, a landing page build with verification passes took six hours, and a YouTube analytics report took another six. "I know for a fact this would not have taken that long with regular Claude," the creator says. "It's just right now it feels very, very slow." A task that normally finished in five minutes ran 44 minutes before hitting a block. OpenRouter's dashboard puts throughput at around 50 tokens per second, and mandatory maximum-effort reasoning on every request does the rest.

How many free requests do you actually get?

Twenty per minute, and either 50 or 1,000 per day depending on whether you have ever put money into the account. OpenRouter's free tier caps free-variant models at 20 requests per minute and 50 requests per day for accounts that have purchased under $10 in lifetime credits. Buy $10 once, and the daily cap rises to 1,000 permanently. The credits never expire and free models do not consume them.

Two details that bite. The per-minute cap does not move no matter how much you spend, so $10 buys daily headroom and nothing else. And failed requests can still count against the daily allowance, which means a session that keeps timing out is burning quota while producing nothing. For free models specifically, OpenRouter's own platform quota is what stops you first, before any upstream provider limit gets a chance to.

So the cheapest route to a usable free setup costs $10. Worth knowing before you plan a weekend around it.

Is it safe to send your code to an anonymous provider?

No, not if the code belongs to someone else. The retention story has two halves and they do not quite agree.

The model page says prompts and completions are retained by the provider and are not used for training, then adds that "all other use is governed by the Stealth Model Terms." Read those terms and the framing shifts. OpenRouter's Stealth Program EULA describes the entire programme as existing "for purposes of collecting User Content for use in Stealth Model training and improvement," and says your content "may be collected by us and shared with the Stealth Provider." It also states that any personal data you put in an input "will be provided to the Stealth Provider." Both documents are on OpenRouter's own site. The per-model promise is narrower than the programme it sits inside.

Then there is the question of who is on the other end. Nobody has confirmed it. Community fingerprinting has been unusually thorough: a thread in r/opencode reports the tokenizer matching GLM-5.2's published tokenizer on 15 of 15 test strings, an invalid reasoning_effort value returning GLM-5.3's error text verbatim, and the backend emitting Chinese-language image parse errors. Independent researcher Ben Davis said he is 99% certain it belongs to Zhipu's GLM-5.x series, citing video encoder token consumption identical to GLM-5V-Turbo. Context: Ox Alpha is the fifth anonymous stealth release in about six months, and the previous four all turned out to be Chinese labs.

None of that is confirmation, and treating it as such is the mistake. The clearest statement of the actual risk comes from a guide on evaluating these releases:

"Everything you send lands in a logged corpus, at a provider you have not identified, under a retention policy you cannot audit, for an endpoint that may be gone next week." Jonathan Reed, on evaluating stealth models

The working rule is simple. Sanitised repositories, open source work, throwaway experiments, personal projects: fine. Client code, credentials, customer data, anything under an NDA: no. Sending someone else's data to an unnamed vendor is a procurement decision, and there is no vendor name to put on the form.

Is Ox Alpha any good?

Good enough to be interesting, and nowhere near proven. The benchmark that made it go viral deserves less weight than it got.

Ben Davis ran the model through a 10-task subset of DeepSWE and got roughly 80%, against 65% for Claude Fable and 52% for GPT-5.6 Sol. That spread is what travelled. What travelled less is that it is ten tasks. Coursiv's write-up puts the caveat plainly: the claim "came from a 10-task user test, not an audited leaderboard, treat it as preliminary." Critics in the same thread noted that DeepSWE's harness only supports bash, that ten tasks is far too few to rank anything, and that the model underperformed much smaller models on simple real-world tasks, which is the classic shape of benchmark tuning.

Hands-on reports split along a cleaner line than any score. Front-end scaffolding and knowledge work held up: the same walkthrough produced a working multi-page storefront with correct brand colours, typography, product pages, a functioning cart, and generated nutrition tables, and separately pulled a year of YouTube analytics into a structured report by finding and reusing API scripts scattered across other projects. It also correctly found and ran a custom skill, which is a decent sign that the skills you built to check its own work survive the model swap.

Deep technical work did not hold up. The creator's own conclusion, after a day of testing:

"If you wanted to build an app, build software, if you wanted to do some deep deep deep technical stuff, these models, these free models, these small local models are not going to do it nearly as well as Claude or GPT. It's just not. That's the truth. But for knowledge work, it will do stuff for you very well." Spoken in the walkthrough video

Should you actually do this?

Do it if you have burned through your usage limits and need to finish light work, if you want to evaluate an unfamiliar model inside a harness you already know well, or if your current project is sanitised or open source. Those three cases are genuinely well served.

Skip it if you are shipping production code, working under a client agreement, or doing anything where six hours instead of thirty minutes changes the outcome. Skip it entirely for anything involving credentials or customer data.

And build the config assuming it expires. The free window was announced as roughly one week from August 20 and is expected to close around August 27, 2026. The Stealth EULA is blunter than that: OpenRouter reserves the right to remove a stealth model "at any time upon request of the Stealth Provider or at OpenRouter's sole discretion, with or without notice." Every model slug in your settings file should be one find-and-replace away from pointing somewhere else.

That is the part worth keeping. Ox Alpha will be gone or renamed and priced soon enough, and the fingerprint sleuths will find out whether they guessed right. The settings block you save today outlives all of it, because there is always another free model, and now you know exactly which six slots to paste it into.