On November 1, 2026, a Hugging Face repository called burner22/numbat spread on X as a leaked mid-training checkpoint of an Anthropic Mythos-class model. Its model card claims "~14T param, 114 layers, hybrid GDN/MLA, MoE (1,224 experts, top-48 + 1 shared), NVFP4" and calls the upload "a pretraining checkpoint at step 1,830,000 of a ~1.96M step run." To the question "Is this real?" it answers "Yes." CellCog, which published a timeline of the episode, says "The repository was created on October 23, 2026 at 01:37 UTC by an account named burner22". The size claims fit together. By our arithmetic, a real 14-trillion-parameter checkpoint at roughly 4.5 bits per weight would be about 7.9 TB, close to the 7.72 TB in the repository's index. Part of why the upload looked real is that its sizes were consistent.
How it was disproved
In discussion #13 on the repository, user FloxUnder reported that "43 complete tensors — 730,368 BF16 values — can be regenerated bit for bit from their tensor names alone." The recipe hashes each tensor's name with SHA-256, seeds NumPy's PCG64 generator with part of the hash, draws normal values, scales them and rounds them to BF16. FloxUnder was careful about what this proves: "the tested tensors are exactly reproducible deterministic synthetic arrays", the matches "cannot logically exclude a training setup that deliberately kept all these parameters frozen", and "They also do not authenticate the claimed Anthropic origin." User ignis-sec reproduced the recipe but found that "Some tensors still mismatch but likely generated with a different recipe or noise added on top."
CellCog reran the recipe itself: "9 of 9 tensors in shard 1 matched exactly, 147,968 values; a wrong seed matched none." It also relays another user's check on the large 4-bit matrices: "signs matched on 162,246,496 of 162,246,496 values across 770 of 772 shards". CellCog sums it up: "It is 7.72 TB of generated numbers, and it ships custom code you would have to trust to run." At the time CellCog published, "Anthropic has not commented."
The part that could do harm
The card says configuration_numbat.py and modeling_numbat.py "are included: a complete reference implementation of the checkpoint". One loading route it shows is AutoModelForCausalLM.from_pretrained(..., trust_remote_code=True), which runs the repository's Python on the downloader's machine. None of the sources we read reports malicious code in those files, and we have not reviewed them. Still, a viral "leak" is an effective way to get people to run code they have not read, on machines with expensive GPUs and cloud credentials.
What remains uncertain. Nobody has checked every tensor, and ignis-sec found some that do not fit the recipe. Who made the upload, and why, is unknown. The repository was still online when we fetched it, and CellCog's note on Anthropic reflects the time it published on November 1.
Analysis: Yesterday's Trend Watch argued that a name does not prove identity. This episode adds that a file size does not prove a model. The 7.72 TB, the 772 shards and the training-step count all made the upload look real, and none of them was evidence. What settled the question was a cheap test anyone could rerun: regenerate a tensor from its name and compare the bytes. Trained weights do not come out of a random number generator seeded by their own names.
I think the defensive habit matters more than this particular hoax. Treat model weights from an unknown source like an unknown binary. Do not pass trust_remote_code=True to a repository you have not read, pin a reviewed revision instead of a branch, and accept a provenance claim only when the publisher's own channel confirms it. At Belgavi's Book Store, Hansini could make that a rule for the team that evaluates help-desk models: any new checkpoint is loaded first in a sandbox with no credentials and no network, its custom code is read before it runs, and a few tensors are spot-checked against simple statistics before anyone spends GPU hours on it. A two-minute check like the one that disproved this upload is cheaper than a 7.72 TB download.
Sources and evidence
A 7.72 TB Hugging Face upload, burner22/numbat, spread on November 1 as a leaked ~14T-parameter Anthropic checkpoint. Users showed that 43 complete tensors (730,368 BF16 values) regenerate exactly from SHA-256-seeded NumPy PCG64 noise, and CellCog reproduced 9 of 9 tensors in shard 1, though some tensors do not fit the recipe. The card suggests loading its custom code with trust_remote_code=True. Anthropic had not commented as of CellCog's post.