# The alleged Anthropic Numbat leak is likely fake

*Excession blog · 1 November 2026 · Research*

> The alleged Anthropic Numbat leak on Hugging Face is likely fake. Parts of the model match randomly generated numbers exactly, which means they were never trained. We tested it ourselves. Don't fall for it.
>
> In short: the repo `burner22/numbat` claims a 14T-parameter "Mythos-class" Anthropic checkpoint. With about 90 KB of HTTP range reads and no repo code run, six of its tensors regenerate bit for bit from their own names with a seeded random number generator. Do not load it with `trust_remote_code=True`.

## What the Numbat leak claims

The repo [burner22/numbat](https://huggingface.co/burner22/numbat) appeared on Hugging Face in late October 2026. The account had no other models. On 1 November the repo reached the Hacker News front page and spread on X. The model card says that the files are an eval copy of a checkpoint from "Anthropic's next Mythos-class training run":

- About 14T parameters, 114 layers, hybrid Gated DeltaNet / Multi-head Latent Attention, a mixture of experts with 1,224 experts (top-48 routing plus 1 shared expert).
- Step 1,830,000 of a run of about 1.96M steps, with no post-training.
- NVFP4 weights in 772 safetensors shards, about 7.72 TB, for evals on "~85 Trainium2 chips".
- A training log tail and a `ckpt_metadata.json` that reports 88.49% on MMLU.

"numbat" is a real codename. It appeared in the Claude Code source that an npm source map exposed on 31 March 2026. That only shows that the uploader read about that leak.

## Why the Numbat leak is likely fake

1. **The weights do not look trained** ([sysnote](https://sysnote.net/news/the-alleged-anthropic-numbat-checkpoint-on-hugging-face-doesn-t-look-trained-eve)). Every sampled numbat RMSNorm, at layers 0, 56 and 113 and the final norm, has mean 1.0, std 0.06 and kurtosis 3.0, the same at every depth. Trained models (Qwen3-8B, DeepSeek-V3) show means far from 1.0, layer-to-layer change and kurtosis from 4.5 to 157.
2. **The tensors regenerate from their own names** ([discussion #13](https://huggingface.co/burner22/numbat/discussions/13)). 43 tensors (730,368 BF16 values) match this recipe bit for bit:
   - Take SHA-256 of the tensor name and read its first 8 bytes big-endian as the seed.
   - Seed NumPy PCG64 and draw `standard_normal`.
   - Norms are `exp(0.06·z)`; convolutions are `z/6`.
   - Round to BF16 with round to nearest, ties to even.
   21 tensors were predicted before they were read, and all matched.
3. **We tested it ourselves.** At revision `6b7f8fc5`, all six layer-0 norm and convolution tensors in shard 1 match. The hashes `13bd9e147c4d3754…` and `d0f5f7ad83727da9…` are the same as in the audit. We used HTTP range reads only and ran no repo code.
4. **The packaging does not add up.** The Hub counts about 6.8T parameters, not 14T. AWS documentation does not list native FP4 support on Trainium2. The files are Hugging Face style and need `trust_remote_code=True`.

## What is not proven

- The 4-bit expert weights (almost all of the 7.7 TB) have not been checked.
- A seeded match cannot rule out frozen parameters.
- Anthropic had not commented when we wrote this. We have no relationship with Anthropic. Excession runs DeepSeek models.

## Don't fall for it: do not load the model

The Hacker News link was removed "for malware concerns". `trust_remote_code=True` runs whatever is in the repo when you load it. Pin a revision and read the code first.

## How to check the next AI model leak in 90 KB

1. Read the safetensors headers with range requests, not whole shards.
2. Check the norms, biases and small convolutions across depth against an open model.
3. Test for name-seeded or index-seeded generators, and write down predictions first.
4. Make sure the parameter counts, formats and hardware claims fit together.
5. Never run remote code to answer a question about where a model came from.

## Questions

**Is the Anthropic Numbat leak real?** Very likely not. The repo burner22/numbat claims to hold an Anthropic checkpoint, but its tensors match a seeded random number generator bit for bit. Training cannot produce weights that a generator predicts from the tensor's name.

**What is Numbat?** Numbat is a real Anthropic codename. It appeared in the Claude Code source that an npm source map exposed on 31 March 2026. A public codename does not show that the files are real.

**How do you know the weights are random?** 43 tensors regenerate exactly from SHA-256 of their own names used as a NumPy PCG64 seed. We repeated the test on the layer-0 tensors of shard 1 and all six matched. The normalization weights are also identical in shape at every depth, which a trained model does not show.

**Is it safe to download or run burner22/numbat?** Do not run it. Loading it needs trust_remote_code=True, which runs the uploader's Python code, and the uploader can change it at any time. The Hacker News link was removed for malware concerns.

**Has Anthropic commented?** Not when we wrote this on 1 November 2026.

## Sources

- https://huggingface.co/burner22/numbat (discussions #13 and #6)
- https://sysnote.net/news/the-alleged-anthropic-numbat-checkpoint-on-hugging-face-doesn-t-look-trained-eve
- https://fourweekmba.com/ai-anthropic-leak-on-hugging-face-has-random-number-tensors/
- https://explainx.ai/blog/alleged-anthropic-mythos-checkpoint-numbat-hugging-face-fake-random-weights-2026
- https://thenewstack.io/claude-code-source-leak/