VULNpocalypse
LowBreach / campaignMonitoring

Hugging Face uploader claims leaked Anthropic numbat model checkpoint

An anonymous Hugging Face uploader claims to share a leaked Anthropic training checkpoint; do not run its bundled custom code outside isolation.

Published
Exploitation
No, the only source is the uploader’s own repository, and the claimed leak is unverified

What happened

An anonymous Hugging Face account, burner22, claims that its model repository “numbat” contains a mid-pretraining checkpoint from Anthropic’s next “Mythos-class” training run, according to the Hugging Face repository page. The repository metadata shows that it was created on 2026-10-23.

The uploader says “numbat” is an internal Anthropic codename. The uploader also says the codename appeared in a comment in a “Claude Code source leak” in March 2026, according to Hugging Face. That earlier leak is described only by the uploader and is not confirmed by any other source here.

The model card makes these claims, according to Hugging Face:

  • It describes a model of about 14T parameters with a hybrid Gated DeltaNet and Multi-head Latent Attention architecture, Mixture-of-Experts layers (1,224 experts) and NVFP4 quantization.
  • The weights are split across 772 safetensors shards totalling about 7.72 TB.
  • The checkpoint was taken at step 1,830,000 of a training run, with no post-training.

The uploader declines to explain how the files were obtained (“Can’t say more than what’s already in the repo”) and invites mirrors. The page lists 10,197 downloads.

What is not confirmed:

  • Anthropic has not confirmed or commented on the claim in the available sources.
  • No independent outlet has verified the files.
  • How the files were obtained is unknown.

The page’s own metadata does not fully match the card’s description, according to Hugging Face:

  • Hugging Face displays a model size of 6.8T params, while the card claims about 14T.
  • The repository is tagged 8-bit, while the card claims NVFP4.

The uploader’s “Why believe this?” section rests on the codename match and on the files being internally consistent. Neither point establishes where the files came from.

Am I affected?

  • Anthropic API or product users: None of the sources reports any impact on Anthropic customers, accounts or data.
  • People who download or mirror the repository: The model card says the checkpoint is meant to be loaded with the bundled files configuration_numbat.py and modeling_numbat.py, including through AutoModelForCausalLM.from_pretrained(..., trust_remote_code=True), according to Hugging Face.
  • General note, not from the source: As a general Hugging Face behaviour, trust_remote_code runs Python code from the repository on your machine. The source does not state that this code is malicious, and no analysis of it is available.

What to do now

  1. Treat the claim as unverified until Anthropic or an independent party confirms or refutes it.
  2. If you load the repository anyway, do so only in an isolated, disposable environment with no credentials, tokens or sensitive data present. Read modeling_numbat.py and configuration_numbat.py before running them.
  3. Do not mirror or redistribute the files on the strength of the uploader’s own assurances (“Q: Is this real? A: Yes.”).
  4. Watch for a statement from Anthropic or Hugging Face before drawing conclusions about the origin of the files.

Sources