The repository numbat, uploaded to Hugging Face by the anonymous account burner22, describes itself as a mid-pretraining checkpoint of Anthropic’s next-generation, Mythos-class model: about 14 trillion parameters, 114 layers and 772 shards, roughly 7.72 TB in total. It was created on October 23 and spread through developer circles around November 1; in a little over a day its discussion tab accumulated 31 threads.
The latest community audit reaches a blunt conclusion: a large share of the files are pseudo-random numbers generated with tensor names as seeds. The model was never trained.
A few lines of code are enough to recompute it
A user named FloxUnder was first to publish the recipe. Take the SHA-256 of a tensor’s name, use its first 8 bytes to seed a PCG64 random number generator, draw standard normal values, then apply one fixed transform: normalization layers use exp(0.06z), and convolution kernels are multiplied by 1/6. With that recipe he reproduced 43 complete tensors, 730,368 values in all, bit for bit.
A user named ressl then downloaded everything to verify it: 784 files, 7.01 TiB. All 289 normalization layers and 258 convolution kernels matched at the byte level. In a sample of 24 NVFP4 tensors, covering 192 million elements, the sign bits agreed 100% of the time.
We ran it ourselves. Following the public recipe, our editors wrote a verification script that used only HTTP Range requests to read the header of the first shard and two tensors. We did not download the model and did not run any code from the repository. The 12,288 values of model.layers.0.input_layernorm.weight and the 24,576 values of model.layers.0.self_attn.k_conv1d.weight came out identical to the file contents. We verified only these two tensors; the full-scale conclusion rests on the two users’ audits above.
The packaging is almost flawless
What makes this convincing at first glance is that every structural check passes. According to ressl’s report, the SHA-256 hashes of all 784 files match, more than 1.57 million index entries line up one to one with the shard headers with nothing missing and nothing extra, and loading the weights in strict mode raises no errors. The “why it’s credible” section of the repository’s readme leans on exactly this kind of internal consistency.
One layer deeper, it falls apart:
- The value distribution is wrong: if a normal distribution had been quantized to NVFP4, roughly 60% of the nibbles should be zero; the measured share is only 10%.
- The scale table is too small: the more than 2.16 million block-scale values in the first shard take only 45 distinct values.
- The training log is too flat: over the last 400 steps the loss wanders between 1.0359 and 1.0649, with none of the decay you would expect near the end of training.
- The tokenizer is dated: its splitting rules are the GPT-2 regex, and the vocabulary contains not a single Chinese, Japanese or Korean character token.
- The parameter count does not add up: Hugging Face’s automatic count is 6.8 trillion, while the repository claims about 14 trillion.
The audit also marks its own limits. Tensors such as lm_head and A_log do not match their name-derived seeds, which ressl takes to mean they used a different random path. He does not claim that every tensor can be derived from its name, and insists on one point only:
"I am claiming the model is not trained."
FloxUnder also concedes that, looking at those 43 tensors alone, one cannot logically rule out that the parameters were deliberately frozen during training, so he has asked the uploader to produce the training configuration. As of publication, both audits come from community users with no third-party institution behind them, and who the uploader is and what they want cannot be verified.
The codename is real; the weights are another matter
The word numbat does have a documented origin. In the Claude Code source that leaked in March this year, a comment in prompts.ts says a certain block should be removed when the model launches, and the name it mentions is numbat. The repository’s readme treats this as its lead piece of evidence.
Lining up this year’s leaks makes the difference clear. The outside world first read about Mythos at the end of March through documents exposed by a content management system misconfiguration; the Claude Code incident the same month exposed client-side source code. None of that material involved model weights. The numbat repository borrows a known codename as a hook and then props itself up with a set of files that pass integrity checks, but a codename that has already been made public can be written into any readme by anyone, and proves nothing about where the files came from.
For people who did download it, the more practical risk is in the code. The repository ships modeling_numbat.py, and its readme says it can be loaded with trust_remote_code=True, a flag that executes the repository’s Python on your own machine. We have not audited that code and cannot say it is malicious; but with a repository of unknown origin, that switch should stay off. When you need to check something, you can read the bytes only, as the audit did, with no need to run anything.
Sources: Hugging Face model page and repository metadata, community audit threads #13 and #31, CocoLoop; the byte-level results for the two tensors were recomputed by our editors from the public recipe, and for full-scale figures the audit threads are authoritative.