We tested DeepAI Code’s free models: every response carried a free stealth model’s label
On November 7–8, 2026, responses from all nine of DeepAI Code’s free models named OpenRouter’s Crouton Alpha as their endpoint. By November 10 that had changed. Here is what we found, what it does and does not show, and how to check it yourself.
In short
- Freebuff competes with DeepAI Code. We ran these tests ourselves, and you should read them with that in mind.
- On November 7–8, 2026 (UTC), every successful response we got from DeepAI Code’s nine free models (33 of 33) carried the endpoint label of Crouton Alpha, a free, anonymous "stealth" model on OpenRouter. The model name in each response changed with the picker. The endpoint label did not.
- A separate test the next morning points the other way: three of those models counted tokens differently from each other, which usually means different models. So the label shows the requests went through Crouton Alpha’s endpoint, but it does not prove Crouton Alpha wrote every answer.
- By November 10, after DeepAI required an app update, the stealth label was gone. DeepSeek, GLM and Qwen each counted tokens like the real model of that name, and premium models showed their own vendors’ formats.
- We have not heard DeepAI’s explanation. We will add it here if they give one.
DeepAI Code is a free desktop coding agent that with a picker of free and premium models, from GLM 5.3 Flash to GPT-6 Astra. Since we make a competing product, we were curious how a free app could serve that lineup, so we looked at what its responses actually contain. This post reports what we saw, with dates, because the answer changed while we were looking.
What we tested, and how
Between 23:34 UTC on November 7 and 00:04 UTC on November 8, we sent requests to the endpoint DeepAI Code’s desktop app uses for its models, signed in with a DeepAI Pro account. We used DeepAI Code’s nine free ("unmetered") models: GLM 5.3 Flash, DeepSeek V4.1 Flash, GPT-6 Luna, MiMo 2.6 Flash, MiMo 2.6 Pro, Solar Mini 4, DeepAI Cyber, Glyph Cluster and Crouton Alpha, which DeepAI lists under its own name. Each got the same five prompts: a question about its identity, a short arithmetic problem, a request it should refuse, a contradictory instruction and a small coding task. 33 requests completed.
This post covers the free models only.
What every response carried
All 33 responses had the same shape. The id looked like an OpenRouter generation id (gen-<timestamp>-<random>). The reasoning came back encrypted, in a format called openrouter-stealth-v1, and the end of that encrypted blob is readable: it is a small piece of base64 that decodes to the endpoint the request ran on. In every response, it decoded to the same thing:
{"endpoint_slug":"stealth/crouton-alpha|stealth"}The model field in each response, by contrast, followed whatever was picked:
- GLM 5.3 Flash:
zai/glm-5.3-flash - DeepSeek V4.1 Flash:
deepseek/deepseek-v4.1-flash-1017 - GPT-6 Luna:
openai/gpt-6-luna - MiMo 2.6 Flash / Pro:
xiaomi/mimo-v2.6-flash,xiaomi/mimo-v2.6-pro - Solar Mini 4:
upstage/solar-mini4 - DeepAI Cyber:
deepai-cyber - Glyph Cluster:
stealth/glyph-cluster - Crouton Alpha:
stealth/crouton-alpha
In every case the endpoint label read stealth/crouton-alpha. Crouton Alpha was a stealth model on OpenRouter: listed on November 3, 2026, free per token, with its lab kept anonymous. OpenRouter has since ended it.
Two other things were the same across all nine models. Response times clustered between about 4.0 and 5.5 seconds, whichever model was picked. And the reasoning summaries for every model used the same distinctive phrasing about a "presentation name" and "provenance disclosure", which suggests one shared system prompt about how to describe its identity.
What points the other way
Different models split text into tokens differently, so the same pair of nearly identical prompts costs a different number of tokens on each. On the morning of November 8 (10:04–10:12 UTC), we sent 24 such pairs to three of the free models: Crouton Alpha, GLM 5.3 Flash and Glyph Cluster, each three times.
Each model gave exactly the same counts every time it was asked, but the three models gave different counts from each other. One model behind three names would count the same way under each name. So by this test, at least three different models were answering, even though their responses all carried Crouton Alpha’s endpoint label. The test does not tell us which models they were.
What we can and cannot say
What the evidence shows for November 7–8:
- Every free-model response we received was labelled as having run on OpenRouter’s free Crouton Alpha endpoint, while its
modelfield named the model the user picked. - At least three of the free models tokenized differently from each other, so they were not simply one model under several names.
What it does not show:
- Which model actually wrote each answer.
- Why the Crouton Alpha label was there. We can think of explanations that range from routine plumbing to substitution, and we cannot tell them apart from outside.
- Whether answers were worse than the named models would have given. We did not run a benchmark.
- Anything about DeepAI Code before November 7 or after November 8, or about its premium models on those dates.
What we see now (November 10)
On November 10, DeepAI Code required an app update before it would answer again. We then used the updated app normally, through its own interface, and read the session logs it keeps on disk.
- No stealth labels. None of the responses we checked carried an
openrouter-stealth-v1blob or a Crouton Alpha label. - Free models count tokens like their names. We sent a message with 50 twenty-digit numbers and compared how much it grew the prompt against the same text sent to the real models on OpenRouter. DeepSeek V4.1 Flash grew by 354 tokens (the real model: 399), GLM 5.3 Flash by 670 (real: 663) and Qwen 3.8 Flash by 1,076 (real: about 1,048). The small gaps come from DeepAI’s system prompt, which changes slightly from chat to chat.
- Their answers differ. Asked to translate the same English sentence into French, the three gave three different translations.
- Premium models show their vendors’ formats. Claude Opus 5.5 and Claude Fable 5.2 returned Anthropic-style reasoning signatures, Gemini 4 Argon Google’s and the Muse models Meta’s. GPT-6.1 Sol and GPT-6 Astra returned no reasoning block, so there was less to check on those two.
We could not test the November 8 setup again: OpenRouter had ended Crouton Alpha by then.
Check it yourself
On a Mac, DeepAI Code keeps a log of every chat under ~/.deepai-code/userdata/deepai/pi/deepai/sessions/, one JSON line per message. Each assistant message records the model, a responseId, token usage and, for reasoning models, a thinkingSignature. Things to look for:
- A blob starting `orsr1_` in
thinkingSignature: its text after the last dot is base64 that decodes to anendpoint_slug. If that slug does not match the model you picked, the request ran on a different endpoint. - The `format` field in
thinkingSignature:anthropic-claude-v1,google-gemini-v1,meta-responses-v1andopenai-responses-v1are each one vendor’s format. - The response id:
gen-<timestamp>-…comes from OpenRouter, andgen_01…from the Vercel AI Gateway.
Questions for DeepAI
We would like to know why responses from every free model carried Crouton Alpha’s endpoint label on November 7–8, which models were answering under each name, and when the routing changed. If DeepAI answers, we will add its response to this post.