The alleged Anthropic Numbat leak is likely fake
The alleged Anthropic Numbat leak on Hugging Face is likely fake. Parts of the model match randomly generated numbers exactly, which means they were never trained. We tested it ourselves. Don't fall for it.
In short. The repo burner22/numbat says it holds a 14-trillion-parameter checkpoint from Anthropic's next "Mythos-class" model. We downloaded about 90 KB of it with HTTP range requests, ran none of its code, and regenerated six of its tensors bit for bit from their own names with a seeded random number generator. Trained weights cannot do that. Do not load the repo with trust_remote_code=True.
What the Numbat leak claims
The repo burner22/numbat appeared on Hugging Face in late October 2026. The account had no other models. On 1 November the repo reached the Hacker News front page and spread on X. The model card says that the files are an eval copy of a checkpoint from "Anthropic's next Mythos-class training run":
- About 14T parameters, 114 layers, a hybrid of Gated DeltaNet and Multi-head Latent Attention, and a mixture of experts with 1,224 experts (top-48 routing plus 1 shared expert).
- Step 1,830,000 of a run of about 1.96M steps, with no post-training.
- NVFP4 weights in 772 safetensors shards, about 7.72 TB, "to run evals on ~85 Trainium2 chips".
- Supporting files: a training log tail, and a
ckpt_metadata.jsonthat reports 88.49% on MMLU.
The main argument for authenticity is the name. "numbat" is a real codename: the Claude Code source that was exposed through an npm source map on 31 March 2026 contained the comment @[MODEL LAUNCH]: Remove this section when we launch numbat. That only shows that the uploader read about that leak. A public codename is the cheapest part of a fake.
Why the Numbat leak is likely fake
1. The weights do not look trained
RMSNorm weights are a good first test, because they are small and stored unquantized (BF16). In trained models they move far from 1.0, change from layer to layer, and have heavy-tailed outliers. sysnote read them over HTTP range requests and compared them with Qwen3-8B and DeepSeek-V3:
| Tensor | Mean | Std | Max | Kurtosis |
|---|---|---|---|---|
| Qwen3-8B, layer 35 input norm | 3.454 | 0.978 | 17.625 | 64.9 |
| DeepSeek-V3, layer 30 input norm | 0.071 | 0.005 | 0.185 | 154.1 |
| numbat, layer 0 input norm | 1.003 | 0.060 | 1.273 | 3.05 |
| numbat, layer 56 input norm | 1.001 | 0.061 | 1.242 | 2.98 |
| numbat, layer 113 input norm | 1.002 | 0.060 | 1.234 | 3.08 |
| numbat, final norm | 1.002 | 0.060 | 1.266 | 3.00 |
Every numbat norm has the same shape at every depth: mean 1.0, standard deviation 0.06, kurtosis 3.0. A kurtosis of 3.0 is a plain normal distribution. That is not a fresh initialization (exactly 1.0), and it is not a model that is 93% of the way through pretraining.
2. The tensors regenerate from their own names
On 1 November, Hugging Face user FloxUnder posted a reproducible audit. 43 complete tensors (730,368 BF16 values) match this recipe bit for bit:
- Take the SHA-256 of the tensor name. Read the first 8 bytes as a big-endian integer.
- Seed NumPy's PCG64 generator with it and draw
standard_normal(shape, float32)asz. - Norm weights:
exp(0.06 · z). Convolution kernels:z / 6. - Round to BF16 (round to nearest, ties to even).
Training cannot produce values that a seeded generator predicts from the tensor's name. The auditor also wrote down predictions for 21 tensors before reading them, and all 423,168 predicted values matched. Other users reproduced the result in the same thread.
3. We tested it ourselves
We ran our own check at the revision the audit pinned (6b7f8fc5). The script reads the safetensors header of shard 1 with HTTP range requests, fetches only the bytes of each layer-0 norm and convolution tensor, and compares them with the generator. It needs Python and NumPy. It does not import or run anything from the repo.
MATCH model.layers.0.input_layernorm.weight [12288] sha256=13bd9e147c4d3754…
MATCH model.layers.0.post_attention_layernorm.weight [12288] sha256=0eb5ddb7873674e8…
MATCH model.layers.0.self_attn.k_conv1d.weight [6144, 1, 4] sha256=d0f5f7ad83727da9…
MATCH model.layers.0.self_attn.o_norm.weight [256] sha256=37ece752d51e89ef…
MATCH model.layers.0.self_attn.q_conv1d.weight [6144, 1, 4] sha256=37ead0a17dfa8b32…
MATCH model.layers.0.self_attn.v_conv1d.weight [12288, 1, 4] sha256=fa0e1e553820b63a…
total 6 matched 6The hashes of the two tensors that the audit named are the same as in the audit.
4. The packaging does not add up
- The Hub counts about 6.8T parameters, not 14T. Packed 4-bit values can explain part of that, because the Hub counts them as bytes.
- A commenter pointed out that AWS documentation does not list native FP4 support for Trainium2, so "NVFP4 for Trainium2 evals" needs a software path that the card does not explain.
- The files are Hugging Face style (
configuration_numbat.py,modeling_numbat.py) and needtrust_remote_code=True. - The README says "every tensor in every shard is internally consistent". That shows careful file generation. It says nothing about training.
What is not proven
- Nobody has checked the 4-bit expert weights, which are almost all of the 7.7 TB. Trained structure there would reopen the question. Seeded norms and convolutions at every sampled depth make that very unlikely.
- A seeded match cannot rule out a run in which those exact parameters were frozen. Frozen norms at seeded random values would still not explain an MMLU score of 88.5%.
- Anthropic had not commented when we wrote this. We have no relationship with Anthropic and no inside information. Excession runs DeepSeek models.
Don't fall for it: do not load the model
The Hacker News link was removed "for malware concerns". sysnote read the two Python files without running them and found only torch, math, typing and transformers imports, with no network, process or file access. That was true at one revision. trust_remote_code=True runs whatever is in the repo at the moment you load it, and an uploader can change it later. Pin a revision, and read the code before you run it.
How to check the next AI model leak in 90 KB
- Read headers, not shards. A safetensors file starts with an 8-byte length and a JSON header. Two HTTP range requests give you every tensor name, dtype, shape and offset.
- Check the cheap tensors. Norm weights, biases and small convolutions are unquantized and tell you a lot. Compare their mean, spread and kurtosis across depth with an open model of a similar design.
- Test for generators. Try seeds derived from tensor names, indexes and file positions with common generators (NumPy PCG64 and MT19937, torch). Write down predictions before you read new tensors.
- Compare the claims with the files. Parameter counts, quantization formats and hardware claims must fit together.
- Never run remote code to answer a provenance question. Pin a revision, read the code, and run nothing.
This is the kind of evidence-first triage that we build Excession for: a claim, a reproducible test, the exact bytes that prove it, and a clear statement of what the test does not show.
Questions
Is the Anthropic Numbat leak real?
Very likely not. The repo burner22/numbat claims to hold an Anthropic checkpoint, but its tensors match a seeded random number generator bit for bit. Training cannot produce weights that a generator predicts from the tensor's name.
What is Numbat?
Numbat is a real Anthropic codename. It appeared in the Claude Code source that an npm source map exposed on 31 March 2026. A public codename does not show that the files are real.
How do you know the weights are random?
43 tensors regenerate exactly from SHA-256 of their own names used as a NumPy PCG64 seed. We repeated the test on the layer-0 tensors of shard 1 and all six matched. The normalization weights are also identical in shape at every depth, which a trained model does not show.
Is it safe to download or run burner22/numbat?
Do not run it. Loading it needs trust_remote_code=True, which runs the uploader's Python code, and the uploader can change it at any time. The Hacker News link was removed for malware concerns.
Has Anthropic commented?
Not when we wrote this on 1 November 2026.