Registry · stealth aliases
Labs test unreleased models in public under invented names. This is the record of which codename turned out to be which model — and, just as deliberately, which ones nobody has actually established.
New codenames are added by hand, not detected. Two reasons, both checkable. OpenRouter’s terms forbid scraping its site and its data API is not offered for re-serving, so this product makes no automated request to it and will not until that has had a legal review. And the LMArena leaderboard we are licensed to read (CC BY 4.0) carries no codenames at all — anonymous entries are withheld from it until they are revealed, so by construction it can never carry one.
So the honest description of this page is a curated registry with its sources shown, not a live monitor. The detector itself is written and tested; only the venues are switched off, and turning one on is a single reviewed line.
Confirmed
Every row here rests on a statement published by the venue that hosted the endpoint, or by the lab that made the model. Nothing on this page is confirmed by resemblance, timing, or a benchmark score.
The reveal post names both alpha endpoints as tests of the large GPT-4.1 model, and retires them the same day.
OpenRouter(opens in a new tab)Revealed in the same post as Quasar Alpha, as the second of two tests of the large GPT-4.1 model.
OpenRouter(opens in a new tab)The GPT-5 launch post states that earlier iterations of the model had been available as Horizon Alpha and Horizon Beta, and that both endpoints are retired.
OpenRouter(opens in a new tab)Supplementary signals. Recorded because they were part of the public record, never relied on. No published false-positive rate exists for any of these techniques, so nothing here alone would establish a mapping.
The endpoint claimed OpenAI origins when asked. It named the right lab, and said nothing about which model — the reveal is what settled that.
Community reportsNamed alongside Horizon Alpha in the GPT-5 launch post as an earlier iteration of the released model.
OpenRouter(opens in a new tab)The model page states the Sonoma endpoints were early test versions of Grok 4 Fast.
OpenRouter(opens in a new tab)The model page states the Sonoma endpoints were early test versions of Grok 4 Fast.
OpenRouter(opens in a new tab)Supplementary signals. Recorded because they were part of the public record, never relied on. No published false-positive rate exists for any of these techniques, so nothing here alone would establish a mapping.
Testers mapped Sky to the reasoning configuration and Dusk to the non-reasoning one. The venue confirms the model, not the split, so the split is recorded here and not asserted in the mapping.
Independent testersThe model page states this was an early snapshot of GPT-5.1 with reasoning effort set to minimal, and directs to the GPT-5.1 launch.
OpenRouter(opens in a new tab)Supplementary signals. Recorded because they were part of the public record, never relied on. No published false-positive rate exists for any of these techniques, so nothing here alone would establish a mapping.
Writing-eval outputs were observed clustering nearest the GPT-5 family before any reveal. Suggestive of the family, silent on the snapshot.
Community evaluationsThe model page states this was an early snapshot of Grok 4.1 Fast with reasoning disabled, and directs to the Grok 4.1 Fast launch.
OpenRouter(opens in a new tab)The model page states this was an early snapshot of Grok 4.1 Fast with reasoning enabled, and directs to the Grok 4.1 Fast launch.
OpenRouter(opens in a new tab)Supplementary signals. Recorded because they were part of the public record, never relied on. No published false-positive rate exists for any of these techniques, so nothing here alone would establish a mapping.
Both Sherlock endpoints told some users they were built by xAI. That named the right lab — while the confident readings built on it, "Grok 4.20" and "Gemini 3", were both wrong. It is why this kind cannot confirm a version.
Community reportsUnresolved
Some have a name attached to them in public. None of those names came from the venue or the lab, so none is stated here as fact. The evidence is shown so you can judge it yourself — which is the whole reason it is shown at all.
No confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
Listed under an invented provider name rather than a real one, which tells you the listing was deliberately anonymised and nothing else. No reveal has followed.
OpenRouter(opens in a new tab)No confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
The endpoint appeared days before that model was announced. Suggestive, and exactly the reasoning that misidentified Quasar Alpha as an early GPT-5.
Community analysisNo confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
The advertised parameter count and context window line up with what has been reported about a forthcoming DeepSeek release.
Community analysisAn independent benchmarker reports token-behaviour and architectural differences that argue against the attribution. Recorded beside the claim it contradicts; neither is adopted.
Independent benchmarkerNo confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
Listed as an omni-modal stealth endpoint alongside Hunter Alpha, with no provider attributed. Nobody has claimed it.
OpenRouterNo confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
A long-context, agentically-tuned stealth endpoint. The common reading is that it is a cloaked frontier snapshot, which is a guess about a category rather than a mapping to a model.
OpenRouterNo confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
Reported to have been acknowledged as part of the GLM-5 system days after it appeared. We could not reach a primary record of that acknowledgement, so it is carried as an inference rather than as a confirmation.
Secondary reportingExcluded
Mappings that circulate but do not survive a check of their source. Listing them is more use than a shorter page that leaves you to find them somewhere else and believe them.
Traced to a single social-media post with no primary record behind it. The claim may well be right; it is not checkable, so it is not carried.
No confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
Reported to have named its own creator in arena responses. The report survives only as a second-hand post; the underlying exchange is not retrievable, so nothing about it can be checked.
Social-media reportSame single unverifiable source, and never resolved by anyone since.
No confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
Reported to have declined to identify itself. No primary record, and no reveal has followed.
Social-media reportSame single unverifiable source, and never resolved by anyone since.
No confirming evidence. Neither the venue nor the lab has stated a mapping. Nothing below is sufficient to name a model on its own, and none is asserted here.
Reported to have declined to identify itself. No primary record, and no reveal has followed.
Social-media reportEvery mapping links to the record it was read from. Where that record is a vendor’s own announcement or model page, the link goes to the vendor. Nothing here is reproduced from those pages — the statements are ours, the words are theirs, and the link is how you get them.