The "Leaked Anthropic Mythos Checkpoint" on Hugging Face Looks Fake: What Is Claimed vs. Verified

A Hugging Face repository called numbat says it is a leaked checkpoint of Anthropic's next Mythos-class model. It is almost certainly not. A public audit found that at least 43 of its tensors are random numbers that can be regenerated from the tensor's own name, and the Hacker News thread about it reached the same conclusion within hours.

This is a "claimed vs. verified" post: we state what the up says, what independent people checked, and what remains unconfirmed. Anthropic has not commented that we could find.

What is claimed #

The repo is burner22/numbat on Hugging Face, created on October 23, 2026 and last modified on October 24. At the time of writing the page shows about 5,800 downloads and 109 likes.

The model card says:

• Size and architecture: about 14T parameters, 114 layers, a hybrid of "GDN" and "MLA" attention, a mixture-of-experts with 1,224 experts (top-48 plus one shared expert), stored in NVFP4.
• Origin: "Internal codename numbat, Anthropic's next Mythos-class training run," a checkpoint "pulled mid-pretraining."
• Why the codename matters: the card says numbat is the codename referenced in the Claude Code source leak of March 2026.
• Why it is 4-bit: the card says Anthropic's eval team quantizes every async checkpoint to NVFP4 so evaluations run on a slice of Trainium2 chips, and that the raw BF16 training weights and optimizer state "never leave the cluster."
• Contents: a config file, a referencemodeling_numbat.py , a 131,072-token tokenizer, a tensor index across 772 shards, a training log tail, and checkpoint metadata. The shards total about 7.72 TB.
• Authenticity: the card's own Q&A asks "Is this real?" and answers "Yes."

The Hugging Face metadata lists 6.8 trillion parameters, because the quantized 4-bit values are packed into bytes and counted that way. That alone is not suspicious; it is how the viewer counts packed weights.

What is verified #

Very little supports the claim, and some of the checkable parts cut against it.

The repo and files exist. Anyone can open them. Existence is not provenance: a large pile of tensors on a public account proves only that someone uploaded a large pile of tensors.

The codename is real, the link is not. "Numbat" does appear as an internal name in the publicly circulated Claude Code source. But a codename in a leaked source file is public knowledge by now, so using it on a model card shows the up read the same material everyone else did. It does not show access to Anthropic's training infrastructure. An independent audit found synthetic tensors. In discussion #13 on the repo, a user posted a reproducible audit titled "43 complete tensors exactly match name-seeded NumPy RNG output." The method is simple and anyone with Python can follow it:

1. Read the safetensors header to find a tensor's shape and byte offsets.
2. Take the SHA-256 of the tensor's name and use the first 8 bytes as a seed for NumPy's PCG64 random generator.
3. Draw a standard normal array of the tensor's shape.
4. Apply a fixed recipe: for normalization weights, exp(0.06 times z); for convolution kernels, z divided by 6.
5. Convert to BF16 and compare to the bytes in the shard.

The auditor reports exact matches for 28 normalization-weight tensors (238,848 of 238,848 values) and 15 convolution-kernel tensors (491,520 values), 730,368 BF16 values in total, at revision 6b7f8fc. Trained weights drift away from any recipe once gradient updates touch them, so an exact bit-for-bit match to a seeded generator means those tensors were generated, not trained.

The auditor is also careful about limits. They write that they have not checked every tensor or reproduced full-model inference, that the matches "cannot logically exclude a training setup that deliberately kept all these parameters frozen," and that they "do not authenticate the claimed Anthropic origin." They asked the up for the training configuration. A commenter in the same thread, ignis-sec, reported that some tensors do not match the recipe, which could mean a different recipe or added noise. That caution is worth keeping: the result is strong evidence against authenticity, but it is a sample, not an exhaustive scan.

What Hacker News found #

The Hacker News thread had 33 points and 13 comments when we read it. The substance:

• One commenter, explosion-s , pasted a Reddit user's analysis concluding that the repo and shards are real files but not an Anthropic checkpoint, and that the only evidence on the card is the codename.
• free_bip pointed to the discussion #13 result, noting many tensors are a bit-perfect match to NumPy RNG output, and said running a 14T model just to test it would be too expensive to bother.
• kingstnap said their own agent reproduced the audit and that the matrices are "literally just random data" seeded by the tensor name.
• jackfischer asked whether it is realistic for a real Anthropic checkpoint to sit on Hugging Face for a week without a copyright takedown.PreciousH made the same point.
• 74948494i4 argued that even if it were real, you would need several racks of B200-class GPUs on NVLink to run it at all.
• 3eb7988a1663 mused that if it were real, competitors would already have copies, which says something about how little a single checkpoint may be worth.

These are commenters' claims, not verified facts, and several of them simply repeat the audit. The independent reproductions (a commenter says their own agent reproduced the match) are the useful part.

Why a convincing fake is easy to build #

The card is detailed because detail is cheap. A plausible fake needs only:

1. A config that looks right. Layer counts, expert counts and dimensions are easy to write down consistently. A referencemodeling_numbat.py whose module tree has "an exact slot for every tensor," as the card puts it, means the checkpoint loads withstrict=True . That sounds like proof of authenticity but only shows the files and code were generated together.
2. Real-size files. 7.7 TB sounds impossible to fake, but random bytes cost only storage and bandwidth, and Hugging Face allows very large repos.
3. Borrowed context. The Claude Code source leak, Anthropic's Trainium2 use and NVFP4 are all publicly discussed, so a fluent FAQ can stitch them together.
4. A training log tail and eval output are plain text. Nothing signs them.

Notably, nothing in the repo is cryptographically tied to Anthropic. There is no signed release, no matching hash published by the company, and no credible account-level link to anyone who works there.

What would change our mind #

We would treat the repo as plausibly real if any of these happened:

• Anthropic confirms an incident or files takedown notices for it.
• The auditor's result is shown to be an artifact, for example the 43 matching tensors being deliberately frozen parameters and the remaining weights showing normal trained statistics, with an independent check of a large sample of the dense tensors.
• A credible outlet reports with named sources that Anthropic is investigating a checkpoint exposure.

None of these has happened as of this writing. Because large-scale weights theft is a real risk for frontier labs, the correct stance is "unconfirmed and strongly doubted," not "impossible." For a different, separately reported story about Anthropic's models and a government probe, see China's probe of DeepSeek and Moonshot over 35 million requests sent to Anthropic.

How to check a "leaked model" yourself #

You do not need 7.7 TB to test a repo like this.

1. Read the safetensors header only. It is a small JSON blob at the start of each shard, so a ranged HTTP request fetches it without down the file. It gives you tensor names, dtypes and shapes.
2. Sample a few small tensors. Normalization weights and tiny convolution kernels are a few kilobytes each. Compare their statistics and, if you can guess the recipe, try regenerating them from a seeded RNG.
3. Look at the distributions. Trained weights have characteristic structure, such as heavy tails and layer-to-layer drift. Perfect Gaussians with constant variance everywhere are a red flag.
4. Check the up. A new account with a throwaway name and no history deserves skepticism.
5. Look for the lab's response. Takedown notices, official statements and credible outlets matter more than a model card's own FAQ.
6. Do not run custom code. Repos that rely ontrust_remote_code execute arbitrary Python on your machine. If you must test, use an isolated sandbox with no credentials.

If you run coding agents that might pull and execute code from public model repos, a guardrail layer such as AgentBeam, the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions, is built for exactly that kind of unsafe step.

Why it matters even if it is fake #

Even a fake spreads, and that has costs:

• Attention and downloads. A claim naming Anthropic's top-tier model class travels fast. Thousands of downloads of multi-terabyte files cost real bandwidth and may carry the custom code risk above.
• Noise in the real security story. Genuine incidents, like theClaude Code user-agent email leak , get harder to separate from fabrications.
• Pressure on the labs. Model weights for the top class are held tightly. Anthropic has restricted access to its Mythos models to trusted partners, as in our report onMythos 5 trusted partners and the US government , and later launched a successor generation inFable 5.1 and Mythos 5.1 . Rumors of weight leaks feed export-control and security debates.
• A template for the next fake. Once someone shows that a name-seeded random checkpoint can pass as a leak for a week, expect copies.

For the ongoing record of breaches and AI-enabled incidents, see our November 2026 cyberattacks list.

Timeline #

• March 2026: the Claude Code source exposure circulates; "numbat" appears as an internal name (per the model card and public discussion).
• October 23, 2026: burner22/numbat is created on Hugging Face.
• October 24, 2026: the repo is last modified.
• November 1, 2026: discussion #13 posts the name-seeded RNG audit, and the repo is discussed on Hacker News; commenters call it fake. The repo is still up, with about 5,800 downloads.

Bottom line #

The claim: an Anthropic Mythos-class checkpoint leaked. The verified part: a repo exists with enormous files and a confident card. The evidence against: 43 tensors regenerate bit for bit from seeded random numbers, there is no cryptographic or corporate link to Anthropic, and the repo has stayed online. Treat it as a hoax until Anthropic or credible reporting says otherwise, and do not download or run it.

Status reflects public information as of November 1, 2026 and may change if Anthropic or Hugging Face responds.