A 7.72 TB "Leaked" Anthropic Checkpoint Was Seeded Random Noise. Here Is the 5-Minute Check Before You Download Anything Like It.
A Hugging Face repository called burner22/numbat claimed to hold a mid-training checkpoint of Anthropic's next Mythos-class model: roughly 14 trillion parameters, 7.72 TB across 772 shards. A post about it on X passed 231,000 views. By November 1, community members had shown that the tensors they checked were seeded random noise, not trained weights. The repo's own page reported 5,846 downloads in the last month, so a lot of people pulled at least part of it first.
What the repo claimed
According to CellCog's write-up, the repo was created on October 23. The README described 114 layers, a mixture-of-experts design with 1,224 experts and 4-bit storage, and called "numbat" an internal Anthropic codename, citing a comment from the March 2026 Claude Code source leak. The write-up notes that it could not verify that comment. The uploader's own answer to "Is this real?" was "Yes." Anthropic had not commented by the time CellCog published, and no first-party page mentioned the repo.
How the noise was caught
The recipe is short, and that is the useful part. Each tensor's values are generated from a seeded random number generator, with the seed taken from the tensor's name. In practice that means: hash the tensor name with SHA-256, use the first 8 bytes as the seed for NumPy's PCG64 generator, draw normally distributed values in the tensor's shape, apply a simple scale, and round to bfloat16. If the result matches the file, nothing was trained.
Hugging Face users posted the recipe in the repo's discussions. One reproduced 43 tensors (730,368 values) from names alone. CellCog reran it on the first shard and reported all 9 tensors matching exactly, 147,968 values, while a wrong seed matched none. I have not rerun the recipe myself, and the CellCog account comes from a company that sells AI employees, so treat the numbers as reported. The logic, though, is easy to check on any suspicious repo: trained weights do not regenerate from a hash of their own labels.
Why a solo operator should care
Nobody reading this needs a 14T model. The cost shows up elsewhere. At 1 Gbps, 7.72 TB is about 17 hours of saturated downloading, assuming nothing throttles you and you have the disk. A lot of us pulled things we could not even load.
The sharper risk is code. According to CellCog, the repo shipped its own modeling file and asked users to trust it. Loading an unfamiliar model through custom code means running someone else's Python on your machine, and a viral leak with a plausible README is exactly the bait you would use to get people to do that. My laptop holds API keys, SSH keys and logged-in sessions. A curiosity download is not worth that.
The five-minute check
First, look for a first-party source. A vendor page, a model card from the real organization, a statement. If the only evidence is the uploader's README, stop there.
Second, do not download the whole thing to answer a yes-or-no question. Read the file headers and a few small tensors with HTTP range requests.
Third, regenerate the small tensors. Norm weights and kernels are cheap to check against a simple seed such as the tensor name or its index. Trained weights will not match.
Fourth, do the serving math. A commenter argued that a model of this size could not be practical to serve, which is a reason to doubt a "mid-training checkpoint" nobody could run.
Fifth, never run bundled modeling code from an anonymous repo. If you must inspect it, read it first, in a container with no credentials mounted.
Where I could be wrong
A forged repo and a real leak look the same until someone checks, and I am relying on other people's checks here. If Anthropic later says something different, or the community results fall apart, I will update this. I also cannot rule out that the repo contained some real content next to the noise. The matches reported so far cover small samples of tensors, not all 772 shards.
What I'd actually do
I would write the five checks into a note and apply them to anything with "leak" in the title. In practice that means I will not download a model whose only provenance is its own README, and I will not run custom code from a repo I could not trace to a person or company I recognize. For the rest of the week, the leak that fooled people is a good reminder that curiosity is the attack surface.
Author
Lukas
@lukcombinator