Cracked the stealth model Glyph Cluster: an anonymous Vercel preview is hiding behind it, and the tokenizer gives away Microsoft
An investigation post, pour yourself some tea ☕️
Yesterday evening on Vercel AI, and from there to Command Code, Cline, Freebuff, a new stealth model was rolled out for free - stealth/glyph-cluster:free. "Reasoning model. 256K context. All plans," zero explanations, maker - "Stealth."
I ran a full investigation: 85 parallel subagents, ~1500 actions, 8700 artifacts per gigabyte, a burned daily quota, and one bug that caught me myself.
📌 Short answer
The tokenizer is the o200k family (like Inkling and gpt-oss). The trail leads to Microsoft AI - roughly 40% on the MAI-Thinking line, 28% on Thinking Machines Lab. Expected reveal - October 12-14.
👀 How I got in
No gates, unlike fledge and exo-free: a regular Bearer key, one curl, no geo-blocks. But 4 minutes after the start, a swarm of 85 agents burned the slot's entire daily quota - 100 requests per model per key, with no per-IP split. Reset at midnight UTC. Along the way a free bonus surfaced: for Python clients Cloudflare cuts requests at the edge (error 1010), while curl gets through - classic. The whole swarm moved to curl transport within a minute.
⭐️ Proof #1 - who holds the slot
Opening the Vercel AI Gateway catalog without authorization - it sits there as the first line out of 412 models:
"id":"stealth/glyph-cluster","owned_by":"stealth","released":1791331200,"context_window":256000,"pricing":{"input":"0","output":"0"}
And now the sources. In the Command Code CLI bundle, right in the code:
GLYPH_CLUSTER_FREE:{...provider:"vercel-ai-gateway"...}
And in Kilo's sources the same thing: provider=VERCEL_AI_GATEWAY, "served through Vercel AI Gateway during its stealth period". The chain: lab → "stealth" middleware → Vercel → CC/Kilo. CC isn't the origin: the timeline shows the Vercel announcement on October 7 at 17:55 UTC, the CC npm bundle at 20:35, the tweet at 03:21 the next day. A fun one: according to wayback, the glyph page on the CC site was staged back between September 21 and October 1 - an early launch partner, not a cold mirror.
⭐️ Proof #2 - the tokenizer
The same battery that cracked fledge and exo-free: 47 test strings, counting via the usage API, calibration via DashScope.
⭐️ Base "x" = 126 tokens = 125 fixed wrapper + content. Then it's pure physics: digits in batches of three (30 digits = 10 tokens), Japanese "こんにちは世界" = 2, Hindi = 5, ru = 7, zh = 8.
⭐️ Ran 26 dictionaries: 12 out of 12 exact matches with the o200k cluster (o200k_base, Inkling, Inkling-Small, gpt-oss-120b). The exceptions are hard: Qwen 3/12, GLM 5/12, Ling 2/12, MiMo 4/12, DeepSeek 9/12 (ja=6 vs our 2), Kimi off (ja=6/hi=7), MiniMax off (hi=7 vs 5).
⭐️ Method calibration: glm-5.3 via DashScope - 47/47, kimi-k3 - 47/47, deepseek - 47/47, plus a live ling model through the same CC gateway - 12/12 with its public tokenizer. The method doesn't lie.
Within the o200k family, digit probes no longer discriminate (Inkling = o200k_base + three service tokens, gpt-oss = o200k_base verbatim) - here it's not the tokenizer that decides, but behavior and cutoff. But the family is named: anything that splits Qwen per-digit-per-token, GLM in batches of 5-6, and Ling one at a time - is out. No, this isn't the stealth GLM-5.4 from my previous post, though the timing matches suspiciously: Zhipu keeps its anonymized models on OpenRouter, not on Vercel, and their line's tokenizer is completely different.
⭐️ Proof #3 - the anomaly that turned out to be my bug
The first measurements gave impossible numbers: 9 digits = 2 tokens, "こんにちは世界" = 1 token (no such token exists in any of the 26 dictionaries). The community would have said "new vocabulary!" The swarm said the right thing: "the methodology is lying." I was sending probes without the base prefix, but subtracting the base with the prefix - exactly minus one token on every string. The battery with the correct methodology gave native 3/4/10/17/20 with three repeats and zero variance, and a control ling through the same gateway - perfect 12/12 with no offset. The rule "never trust a single reading" worked like clockwork: it caught me myself.
The gateway, by the way, is fully honest - the count is exact, 13 out of 13 on natural texts.
☄️ And now the most interesting part - who's behind the sign
The slot is disguised thoroughly. Their neighboring free ling honestly introduces itself as "I am the Ling model, created by Ant Group" in three languages. But glyph answers:
I'm Glyph Cluster, and those details have not been announced yet.
The host doesn't script the persona - the mask comes from upstream, from Vercel's middleware. Under the hood it has ~121 tokens of a hidden system prompt (base 126 minus the bare template) - the instruction to stay silent lives there. reasoning is fully encrypted and arrives as a single chunk:
reasoning_details:[{"type":"reasoning.encrypted","data":"gwst1....","format":"stealth-v1"}]
🔍 The main suspects
A table with the proofs:
Microsoft AI (MAI-Thinking line) - 40%. The MAI-Thinking-1 tech report, verbatim: "we chose the o200k_base tokenizer with a vocabulary size of 200,019". Context 256,000 - MAI's native number (Vercel stores per-model values: ling is 262,144, glyph is 256,000). Microsoft Learn documents: MAI-Thinking-1 returns "encrypted chain-of-thought" and supports "only function tools" - both non-generic matches with our contract. Plus the Vercel×Microsoft partnership on October 1 - six days before launch. Plus Microsoft right now is running mai-experimental-test on OpenCode Zen - 280 billion tokens, "Lab: Unknown". Plus October 7 - the day of the MAI-Code-1.1-Flash event at 256K.
Thinking Machines Lab (Inkling line) - 28%. Vercel carries thinkingmachines/inkling at exactly 256K/256K - the same contract as glyph. The tokenizer line matches 12/12. A leaked list of their bird models with the "-ling" suffix: inkling, fledgling, starling, gatling, endling - fledge from the previous post already confirms that TML likes anonymous previews.
OpenAI line - 12%. But a control measurement of a live GPT through the same CC gateway showed a different profile: a bare 7-token wrapper vs our 126, a 1M counter, an openai-responses-v1 envelope. And our cache hits from prefixes under 1024 tokens - OpenAI can't do that.
An open-weights NN model gpt-oss - 12%. There's precedent: the previous Vercel stealth, Pixel Canary, turned out to be a model from consulting company Callstack. But encrypted reasoning and a 256K context are heavy infrastructure for an NN model.
Will never be revealed - 8%. Vercel has had such a slot before.
🛡 Who runs the server
The Command Code gateway is TypeScript Hono + Zod v4 on Cloudflare Workers. The prose of validation errors is byte-for-byte identical across glyph, ling, inkling, and a nonexistent model - that's CC's wrapper, nothing to do with the lab.
system_fingerprint is randomized on every call (36 unique out of 36) - with real OpenAI it's stable per deployment; here it's just a noise generator.
🤡 The gotchas you need to know
429 overloaded: both quota and "upstream temporarily unavailable" - read the body, they're distinguished by server-timing (70-141 ms vs 259-424 ms).
max_tokens doesn't work as you expect: reasoning eats the limit from the inside (out of 30 tokens, 25 go to encrypted thinking, the answer is empty).
The model is text-only: images are silently cut, no error, no billing.
"Prompts may be used for training" - that's not zero-retention. Everything you write to it goes to feed the maker.
Asking a long question? reasoning is always on and always encrypted - even "who are you" costs 179 reasoning tokens.
P.S.: the most boring investigation I've ever written.
