The “Anthropic leak” on Hugging Face that audits say is random data: what developers should keep

Last checked 13 November 2026. General information for developers and teams who download model files, not legal or security advice. This page reports what the repository, its discussion thread and the write-ups show. We did not download the files, and Anthropic has not, in anything we found, commented on the repository.

What the repository claimed

The repository burner22/numbat, created in late October 2026, presented a model card describing a checkpoint of about 14 trillion parameters stored in 4-bit format across 772 shards, roughly 7.72 TB, under the internal codename “numbat.” The card said the checkpoint was pulled mid-pretraining, and its own question-and-answer section answered “Is this real?” with “Yes.” Anthropic was not listed as a publisher. Hugging Face’s automatic count showed about 6.8 trillion parameters, which the card put down to how 4-bit values are packed.

The codename did match a name seen in the public discussion of an earlier Claude Code source leak, according to the write-ups we read. That shows the uploader had read the same public material as everyone else. It does not show access to anyone’s training systems.

What the community audit found, and what it did not

On 1 November 2026 a user posted a reproducible audit in discussion #13 on the repository. The recipe takes the SHA-256 of each tensor’s name, uses it to seed NumPy’s PCG64 generator, draws a standard-normal array, applies a fixed formula and converts to BF16. According to the write-ups from Minerka and explainx.ai, the audit reported exact matches for 28 normalization tensors (238,848 values) and 15 convolution kernels (491,520 values) at revision 6b7f8fc, plus 21 held-out predictions that also matched when read with HTTP range requests.

The auditor was explicit about limits: not every tensor was checked, a training setup that kept those parameters frozen could not be ruled out by the match alone, and the check does not authenticate or disprove any claimed origin. A commenter reported some tensors that did not fit the recipe, which the thread treated as a possible second recipe or added noise rather than proof of training. The repository was still online when those write-ups were published.

Why this matters to developers and teams

The lesson is not about one lab. A large, confident, well-formatted model card is cheap to produce, and file size, a codename and a plausible architecture description do not show where the files came from. Developers who pull unofficial weights, LoRAs, datasets or tools from public repositories take on three separate risks: the files may not be what they say, the loading code may run on their machine, and they may not be able to show later what they actually used.

That third risk is the one a record can reduce. If a team fine-tunes on, benchmarks or ships something derived from a public checkpoint, it helps to be able to say which source URL, which revision and which exact files went in.

Why people are searching for this

Measured on 13 November 2026. A post by @NovaXCode on 1 November asking whether Anthropic’s next model had leaked had 45,534 impressions and 386 likes. A post by @RoundtableSpace on 2 November reporting that the leak looked fake, citing an independent forensic write-up, had 46,856 impressions. @ravikiran_dev7’s post on 1 November had 12,887 impressions and 93 likes. X’s trending summary, updated 1 November, described the story as a hoax debunked by community audits. Counts keep moving.

Checklist before you download or run an unofficial model

1. Record the source exactly. Keep the full repository URL, the account name, the commit or revision, and the date and time you looked.
2. Check who published it. A new account with no history that claims to be a lab’s internal release is a reason to stop, not a reason to hurry.
3. Look for an official statement or takedown. The lab’s own channels matter more than the model card’s FAQ.
4. Read small parts first. Safetensors files have a small header you can read with a ranged request, which lists tensor names, shapes and types without downloading terabytes.
5. Do not run repository code you have not read. Options such as trust_remote_code run Python from the repository. If you must test, use an isolated machine with no credentials.
6. Hash what you keep. Save a manifest of SHA-256 hashes for every file you download or derive from, and keep it with your notes.
7. Write down what you did with it. Note which experiments, fine-tunes or products used which files, and keep the licence text as it read on that day.
8. Date the manifest. Fingerprint it before you share results, so you can show later what you held and when.

What a TimeBind does and does not show

A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches. The SHA-256 fingerprint is made in your browser and the file is never uploaded. The record is anchored to Bitcoin (a Merkle root in an OP_RETURN). Your first Pooled TimeBind is free; after that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. See how it works.

For model work, it can date a hash manifest of the files you downloaded and the notes you kept about their source. It does not show that a model is genuine, trained, safe or licensed, does not detect fake weights, and does not show who uploaded a repository. Use it as a dated record of what you held, next to your own checks.

Limits

This page relies on the repository, its discussion thread as summarised in the write-ups named below, and posts on X. We did not download or inspect the files, we have not independently reproduced the audit, and we cannot say who uploaded the repository or why. Anthropic has not, in anything we found, commented on it. The audit is strong evidence about the tensors it covers, and by its author’s own account not a full inspection.

Tools that can help

Use the bulk SHA-256 manifest to fingerprint a folder of downloaded files, and the file date metadata inspector to see what dates your files carry. For related reading see what developers should keep after a CI secret stealer, the npm package compromise response checklist and what provenance means.

Sources checked

• Minerka, “A Hugging Face ‘numbat’ card claims ~14 trillion Anthropic weights — 43 tensors match a fake random seed,” 1 November 2026, https://minerka.com/stories/hf-numbat-synthetic-weights/ (read 13 November 2026)
• explainx.ai, “The ‘Leaked Anthropic Mythos Checkpoint’ on Hugging Face Looks Fake: What Is Claimed vs. Verified,” 1 November 2026, https://explainx.ai/blog/alleged-anthropic-mythos-checkpoint-numbat-hugging-face-fake-random-weights-2026 (read 13 November 2026)
• X posts by @NovaXCode (1 November 2026), @RoundtableSpace (2 November 2026) and @ravikiran_dev7 (1 November 2026), read 13 November 2026
• X trending summary, “Fake Anthropic AI Model Leak Debunked on Hugging Face,” updated 1 November 2026 (read 13 November 2026)

Date your model-file manifest and source notes

Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Click here to start, or see plans and pricing.