The 7.7 TB 'leaked Anthropic model' is fake, and our own test confirms it

A repository called numbat, uploaded to Hugging Face on October 23, claimed to be a mid-training checkpoint of a new Anthropic model. Made of 772 files totaling 7.7 TB, it was downloaded thousands of times. A community member then showed that numbers inside the files were generated at random. We ran the same check ourselves on the first file. All 18 tensors we tried, all 369,408 values, matched bit for bit. These files cannot come from a trained model.

What this is about

An AI model is made of numbers updated billions of times during training. Those numbers are the memory of the training. Imagine someone hands you a lab notebook said to record years of experiments. The pages look full. Then you notice every number on every page can be recomputed from the page number with a short formula. That notebook holds no experiments. That is what happened with numbat.

What was claimed

The repository description called it a checkpoint from Anthropic's next Mythos-class training run, with about 14 trillion parameters, 114 layers, at step 1.83 million of a 1.96 million step run. The name appeared in a code comment in the March 2026 Claude Code source leak, which gave the claim a useful hook. The structure looked clean too: a consistent tensor index, matching sizes and a loading implementation. The index file we read states 6.85 trillion total parameters, which differs from the description.

How it was caught

In a discussion on the repository, a user named FloxUnder showed that 730,368 values across 43 tensors could be regenerated from tensor names alone. The recipe takes the SHA256 of a tensor's name, uses the first eight bytes to seed NumPy's PCG64 generator, draws normally distributed numbers and applies a simple formula: e to the power of 0.06 times the number for normalization layers, one sixth of the number for convolution kernels. The result is rounded to BF16. The user recorded predictions for 21 unread tensors before fetching them, and all 423,168 values matched. Others repeated the test.

How we measured it

We ran the test before writing this story. We did not download the 10 GB file. We read only the bytes we needed through HTTP range requests, and we ran no code from the repository. From the first file's header we picked the normalization and convolution tensors of layers 0, 1 and 2, produced the values with the same formula and compared them with the file. All 369,408 values across 18 tensors were identical at the bit level.

A trained model cannot look like this. These layers change during training, and nothing in real training would derive them from a seed made of the tensor's name. We tested a small part of the model, and users in the discussion report that some tensors do not match this recipe and were probably produced another way. We have not proven every file. A single synthetic sequence is still enough to show the checkpoint is not what it says.

Other signs

Users listed other problems. Some arguments in the model code are reversed and work only because the numbers happen to line up. The weight initialization function is empty, and the code is unfit for real inference. One user described its job as making the files load cleanly and look legitimate. The size, which would need about 80 high-end GPUs, also means few people could try it. The uploader's motive is unknown.

What it means for you

Check the community tab before downloading a model described as leaked. The larger risk goes beyond wasted time, since loading with trust_remote_code=True runs Python code from the repository on your machine. The repository was still on Hugging Face on November 1. You can run this kind of check by reading a few kilobytes: if supposedly trained numbers can be generated from their names, no training happened.

We measured it: Opus model.

Sources: Hugging Face: numbat, Community audit