Since October 23, 2026, an anonymous account on Hugging Face, burner22, has been hosting a repository named numbat: 772 weight files, 7.72 terabytes in all, presented as a checkpoint from “Anthropic’s next Mythos-class training run.” On Sunday, November 1, the repo spread across Reddit and the Hugging Face discussion threads, with its page showing 5,846 downloads. At 3:46 p.m. UTC, a user of the platform posted a statistical analysis concluding that the weights had been drawn at random by a script and never trained. At 4:29 p.m., a second user posted a reproducible check: 43 of the repo’s tensors can be regenerated exactly from their names alone.
As of November 1, 2026, at 4:40 p.m. UTC, neither Anthropic nor Hugging Face had responded, and no one had shown that these weights produce anything at all. Update: new information will be added here with its date and time.
At Anthropic, Mythos is a model tier larger and more capable than Opus. On October 23, the UK’s AI Security Institute and Anthropic detailed a test in which Claude Mythos 5 hounded a real developer. A freely downloadable copy of one of these models would be a first, which explains Sunday’s frenzy.
A 7.72-terabyte repo and its FAQ
The burner22 account, opened on October 16 and displayed as “burner,” holds only this repo. Its 772 safetensors files weigh about 10 GB each and were uploaded one by one on October 23 and 24.
The model card claims about 14 trillion parameters across 114 layers, with a hybrid design that combines two recent attention mechanisms, Gated DeltaNet and Multi-head Latent Attention. It describes a mixture-of-experts model with 1,224 sub-networks, 48 of them active for each token (a word fragment), plus one shared expert. The weights are stored in NVFP4, a 4-bit format designed by Nvidia. The files are presented as a checkpoint “pulled mid-pretraining,” at step 1,830,000 of a training run planned for about 1.96 million steps, with no post-training.
The FAQ is terse. “How did you get this? Can’t say more than what’s already in the repo.” “Is this real? Yes.” It adds: “Mirrors welcome. Do not DM me asking for the source.”
Two text files serve as supporting evidence. The first credits the model, in an evaluation dated October 8, with 88.49% on the MMLU general-knowledge test, 72.01% on the ARC-Challenge reasoning test and 88.96% on HellaSwag (normalized score). The second reproduces about 400 lines of a training log from the same day.
Running the model would mean holding 7.7 TB in accelerator memory. The repo itself mentions about 85 Trainium2 chips from Amazon Web Services “just to hold these weights.”
The only verifiable link to Anthropic
That link is the codename. On March 31, 2026, Anthropic mistakenly published version 2.1.88 of Claude Code to the npm registry with a debugging file that exposed its source code, about 512,000 lines. VentureBeat reported several internal codenames in it: Capybara, Fennec (mapped to Opus 4.6) and Numbat, an unreleased model “still in testing.” The repo quotes a comment from that code, “Remove this section when we launch numbat,” which several analyses of the leak also reproduce.
According to Fortune, the March 31 leak “did not expose the weights of the Claude model itself,” and Anthropic called it “a release packaging issue caused by human error, not a security breach.”
The two other Mythos episodes did not involve weights either. In late March, close to 3,000 internal files, including a draft blog post about Mythos, were made public by mistake. In April, according to Fortune, citing Bloomberg, a group on Discord used Mythos Preview through the environment of one of Anthropic’s vendors.
Doubts piled up within hours
In the repo’s discussion tab, three reports were filed between 2:36 p.m. and 4:08 p.m. UTC, one of them with the note “This appears to be malware.”
At 3:01 p.m., one user flagged the gap between Hugging Face’s counter, which shows 6.8 trillion parameters (6.85 trillion through its API), and the 14 trillion claimed. The same user also questioned the use of NVFP4 on Trainium2 chips, noting that AWS’s documentation does not list native support for it, and called a 72% ARC-Challenge score low for a frontier model.
That parameter gap has a simple explanation. Hugging Face counts 6,832 billion bytes of 4-bit weights, and the NVFP4 format packs two weights into each byte. Our math gives about 13.67 trillion parameters, close to the 14 trillion claimed, so the number proves nothing either way.
At 3:46 p.m., rairenter posted the most detailed analysis. The author says they read fragments of the files through partial requests, without downloading the 7.72 TB. According to the analysis, parts of the network that receive exactly the same input carry scaling factors with no relation to each other, spread as if they came out of a random generator between 0.05 and 0.4.
The normalization weights, it says, follow a pure normal distribution, without the extreme values and cross-layer correlations seen in a trained model, and the tensor names copy those of the DeepSeek-V3 implementation published on Hugging Face. Its conclusion: a well-crafted hoax that trades on the codename leaked in March.
At 4:29 p.m., FloxUnder went further in another thread. FloxUnder reports regenerating 43 complete tensors, 730,368 values, bit for bit from their names alone, using the SHA-256 hash of each name as the seed for the NumPy library’s random number generator. The post says the values of 21 more tensors were predicted before being read, all confirmed, and shares a verification script that downloads only about 90 KB. FloxUnder notes that the test does not cover every tensor and cannot rule out parameters deliberately frozen during training, but calls it strong evidence against an authentic checkpoint.
We have reproduced neither analysis, since both require reading fragments of the weight files. We did check the supplied training log. Its seven evaluation lines all give the same ARC-Challenge score, 0.7083, computed on only 24 questions, a tiny sample for tracking a training run of this scale, as rairenter also pointed out.
On Reddit, the r/accelerate thread opened at 2:59 p.m. UTC quickly turned skeptical. “This is likely an elaborate fake,” u/ConstantinSpecter wrote at 3:06 p.m., citing an architecture that looks like “a mashup of DeepSeek and Qwen” and training logs that “appear to be faked.” On r/ClaudeAI, u/HearMeOut-13 posted at 3:47 p.m. that Claude, shown a few downloaded files, judged them fake. Other users quickly questioned the method, since an Anthropic model was being asked to judge an alleged copy of itself.
trust_remote_code, an old way in
To load the model, the repo page tells users to go through the Transformers library with the trust_remote_code=True option. That option runs two Python files supplied by the repo, modeling_numbat.py and configuration_numbat.py, on the user’s machine. Hugging Face’s documentation warns that it “should only be set to True for repositories you trust and in which you have read the code, as it will execute code present on the Hub on your local machine.”
That was the first argument raised on r/accelerate, at 3:05 p.m. and 3:06 p.m. UTC: a repo that asks strangers to run its Python code is the classic way to get malware executed. On Hugging Face, a user replied at 3:55 p.m. that the modeling file is “very simple,” with nothing malicious in it, and that the safetensors format means malware cannot be put directly into the weights. Our own reading of the file as published at 4 p.m. UTC, without running it, points the same way: besides two standard Python modules, its 22 KB of code imports only PyTorch and Transformers, with no visible network calls or system commands.
The code that runs is whatever the repo contains at load time, and the account holder can change it at any time. Hugging Face runs files under 2 GB through a malware scanner on every commit, but a scanner looks for known signatures and does not understand what a script is meant to do. In late October, a backdoored version of the Claude Code extension reached up to 5,000 Cursor users through a channel developers considered safe.
What it means
As of publication, we consider it very unlikely that these files are Anthropic’s weights: the most likely reading is a carefully built fake, tied to Anthropic only by a codename that has been public since March. The account is anonymous, and the supporting evidence is a pair of text files. The strongest signals are the two analyses posted Sunday afternoon, the second of which lets anyone regenerate part of the weights from their names. No one had challenged them as of 4:40 p.m. UTC.
A few signals point the other way: files that are consistent with each other, a parameter gap the format explains, and a compiler setting that targets exactly the problem this format would raise on Trainium2, a sign of “substantial effort” according to one participant. They show careful work. They say nothing about where the files came from.
The motive remains unknown. The theories floated on Reddit and Hugging Face range from a trap for developers to an attempt to hurt Anthropic’s IPO, whose filing went public on October 26, two days after the last files were uploaded. A takedown by Hugging Face would not settle the question, since its content policy covers both “intentionally deceptive” content and content that infringes someone else’s intellectual property.
Three developments could settle it for good in the coming days: an explanation from the uploader for these reproducible values, someone loading part of the model and showing either coherent text or noise, or a statement from Anthropic. So far, no one has shown a single line of text produced by these 7.72 terabytes.
Sources
- burner22/numbat (model page), Hugging Face, November 1, 2026
- some question and concerns (discussion #8), Hugging Face, November 1, 2026
- 43 complete tensors exactly match name-seeded NumPy RNG output (discussion #13), Hugging Face, November 1, 2026
- Beware of this model (discussion #6), Hugging Face, November 1, 2026
- Auto Classes, trust_remote_code parameter, Hugging Face Transformers documentation, November 1, 2026
- Claude Code’s source code appears to have leaked: here’s what we know, VentureBeat (Carl Franzen), March 31, 2026
- Anthropic mistakenly leaks its own AI coding tool’s source code, Fortune (Beatrice Nolan), March 31, 2026
- Supposed Anthropic Mythos-class model leaked on HuggingFace, r/accelerate thread, November 1, 2026
Header image: screenshot of the burner22/numbat repository page, Hugging Face, November 1, 2026.
