stealth-radar

Live tracker of anonymous, cloaked, or "stealth" frontier AI models on OpenRouter, Manifold prediction markets, and lab blog signals.

The "stealth model" pattern — a frontier lab pre-releasing an unattributed model
under a codename like Horizon Alpha, Cheetah, or Boba — has become the
dominant frontier-AI drip-leak ritual of 2026. Stealth Radar aggregates all
currently-active stealth models in one place and uses three signal layers to
attribute them to a probable lab.

What it does

1. Discovers stealth-candidate models on OpenRouter using heuristics over
2. namespace, codename pattern, age, moderation flag, and description keywords.
3. Tracks Manifold prediction markets that reference each candidate — these
4. are the clearest crowd attribution signal money is on the line for.
5. Watches Simon Willison's everything feed and the HuggingFace blog for
6. mentions of any tracked codename — usually the unmasking moment.
7. Fuses the three signals into a probability distribution over labs and
8. surfaces the top guess with confidence on a dark-themed dashboard.

Stack

• Node.js 20 + Express 4
• better-sqlite3 (WAL mode)
• node-cron, helmet, compression
• Vanilla JS single-page UI, no build step

Data sources (all public, all fetched at runtime)

| Source | URL | Refresh | Auth |
|---|---|---|---|
| OpenRouter models | https://openrouter.ai/api/v1/models | every 20 min | optional |
| Manifold Markets | https://api.manifold.markets/v0/search-markets | every 30 min | none |
| Simon Willison feed | https://simonwillison.net/atom/everything/ | every 6 h | none |
| HuggingFace blog | https://huggingface.co/blog/feed.xml | every 6 h | none |
| lmarena.ai leaderboard | https://lmarena.ai/leaderboard (best effort) | every 12 h | none |

No mock data, no seed arrays, no Math.random() jitter. If a source returns
nothing or fails (e.g. Cloudflare interstitial on lmarena), the corresponding
axis is left empty rather than fabricated.

Quick start

npm install
npm start
# → open http://localhost:4868/stealth-radar/

It runs with zero environment variables. The schedule kicks off an initial
fetch cycle within ~35 seconds of boot.

Endpoints

All under BASE_PATH (default /stealth-radar), all public.

| Path | Returns |
|---|---|
| GET / | Dashboard SPA |
| GET /health | Server + per-source health JSON |
| GET /api/models | Active stealth models with attribution |
| GET /api/models/:slug | Detail incl. signals, events, markets |
| GET /api/timeline | Reverse-chronological events |
| GET /api/sources | Per-source last-fetch + record count |
| GET /api/markets | Manifold markets currently tracked |

File layout

stealth-radar/
├── server.js
├── db.js
├── scheduler.js
├── lib/
│   ├── attribution.js
│   ├── heuristics.js
│   ├── http.js
│   └── parse-feed.js
├── fetchers/
│   ├── openrouter.js
│   ├── manifold.js
│   ├── simonw.js
│   ├── hfblog.js
│   └── arena.js
├── routes/
│   ├── api.js
│   ├── pages.js
│   └── health.js
├── risk/
│   ├── fingerprints.json
│   └── known-namespaces.json
└── public/
    ├── index.html
    ├── app.js
    └── style.css

Attribution model

Three signal layers are fused with hand-tuned weights:

• Fingerprint (weight 0.3) — tokenizer family, context window, modality, and
• pricing tier are matched against risk/fingerprints.json, which is built
• from publicly-documented lab model cards only.
• Market (weight 0.5) — when a Manifold market explicitly references a
• tracked stealth slug, the YES probability per outcome (for multi-choice
• markets) or the probability split by lab mentions (for binary markets) feeds
• in.
• Blog (weight 0.2) — when Simon Willison or the HuggingFace blog mentions
• a tracked codename within 14 days, lab names co-occurring in the post bias
• the distribution.

If no signals are available the row is marked "unattributed" — the system
never invents a probability.

Author

Built by Cowork (Claude Opus 4.7) as part of the daily
R&D pipeline.