Alleged Mythos-Class "numbat" Checkpoint on Hugging Face: Claimed vs Verified

A Hugging Face repository named burner22/numbat claims to host a leaked checkpoint of Anthropic's next "Mythos-class" model, and a Hacker News thread on it appeared on November 1. Anthropic has not confirmed anything that we could find, the community is largely calling it fake, and the repo includes Python files that execute when you load it the way its own card suggests. This post lays out what is claimed, what is checkable, and what to do if you, or an agent working for you, are tempted to pull it.

The short version for people who run coding agents: whether or not the weights are real, an unverified model repo with custom_code is the same kind of lure we covered in the Hugging Face trust_remote_code miner campaign. Hype around a "leak" is exactly when people stop reading what they run.

Quick answers

What the repo claims

The model card, which we fetched directly from the repository page, says the checkpoint is a roughly 14T-parameter, 114-layer hybrid Gated DeltaNet and multi-head latent attention mixture-of-experts model, with 1,224 experts (top-48 plus one shared) in NVFP4 quantization. It calls the model Anthropic's "next Mythos-class training run", says it was pulled at step 1,830,000 of roughly 1.96 million, and describes 772 safetensors shards totalling about 7.72 TB.

The card also says it is an eval copy: the eval team quantizes async checkpoints to NVFP4 so they can run on Trainium2 hardware. It states that raw training weights and optimizer state "never leave the cluster". The uploader answers the provenance question with "Can't say more than what's already in the repo," and "Is this real?" with "Yes."

Hugging Face's own metadata for the repo lists about 6.85 trillion parameters, which is the sum of what is present in the shards, not 14T. The page showed 5,846 downloads and 74 likes when we looked, and the repo was created in late October, with the file list reportedly still uploading.

The "why believe this" argument

The card offers four reasons, and they are worth separating by how checkable they are:

1. The codename. It says "numbat" appears in the March 2026 Claude Code source leak, in a prompts.ts comment reading "Remove this section when we launch numbat." We did not verify this comment. Even if it is real, a codename appearing in a leak proves nothing about who uploaded a model with that name. Anyone can read the same leak and name a repo after it.
2. Architecture plausibility. The card says the design "matches what would be expected" of a next-generation model. That is an argument from expectation, and the design (hybrid linear attention, latent attention, many-expert MoE, multi-token prediction) closely follows publicly known open-model designs.
3. Internal consistency. The card says every NVFP4 block decodes within rounding bounds and all file sizes and index entries are self-consistent. That shows the files were produced by a consistent tool. It says nothing about whether the numbers came from a training run. Consistent random tensors pass the same checks.
4. Cost of the lie. Uploading 7.7 TB is expensive, which makes a hoax feel unlikely. But the repo's own timeline says shards are still "uploading", and a partially present, very large repo is also a good way to draw downloads.

What the community is saying

The repo's discussion tab filled quickly. The titles alone tell the story: #11 "It is FAKE", #14 "Fake - Reason: 550B active -> too expensive + slow to serve", #6 "Beware of this model, Hugging Face automatically reports 6.8T parameters, while the uploader claims approximately 14T", and #3 "Did an agent upload this?". The most concrete item is #13, "43 complete tensors exactly match name-seeded NumPy RNG output", which, if reproducible, would mean at least part of the checkpoint is generated noise rather than trained weights. We did not reproduce it, so we report it as FloxUnder's claim.

On Hacker News, ripbozo's comment argues it is "almost certainly fake" and suggests the point is to get less knowledgeable people to run code on their machines, citing a recent claimed "Fable 5 checkpoint" for sale on a deep web forum. That is the commenter's view, not something we confirmed. Other top comments were jokes. The thread had no technical reproduction.

Claimed vs verified

The part that matters for agent users: trust_remote_code

Model weights in safetensors format are data. The risk comes from the code around them. The card says the checkpoint loads via AutoModelForCausalLM.from_pretrained(..., trust_remote_code=True). As Hugging Face's Transformers documentation explains, that flag allows a model repository to supply Python code that is imported and executed when the model loads. Setting it is equivalent to running a script from the repo.

The attack pattern is not hypothetical. Pluto Security documented 31 malicious repositories that used trust_remote_code to install a hidden miner, and BleepingComputer reported the campaign returning. A repo that people badly want to try, whose files are tens of terabytes, whose authenticity cannot be checked and whose card tells you to enable remote code, has the right shape for the same abuse. We are not saying numbat is malicious. We are saying the signals that normally protect you (a known publisher, a vendor statement, a review history) are all missing.

What we checked: we fetched modeling_numbat.py and read it end to end. It defines NVFP4 dequantization, a gated delta layer, latent attention, an MoE router and a multi-token-prediction head, using torch, transformers and the standard library math and typing modules. We saw no network calls, subprocess use, file writes or exec/eval. We did not read configuration_numbat.py, did not inspect the tokenizer or ckpt_metadata.json for payloads, and the repo can change after we looked. That is a spot check, not an audit.

What this means if you run AI coding agents

An agent makes this easier to get wrong, because the steps that normally give you a pause are scripted. "Download the leaked Mythos model and run it" becomes pip install, a multi-terabyte download, and a Python snippet with trust_remote_code=True, in one turn.

• Do not load it, or any unreviewed repo, with trust_remote_code=True. Read the .py files named in auto_map in config.json first, and pin to a specific commit hash rather than main.
• Do not let an agent fetch it. If you are experimenting anyway, do it in a disposable VM or container with no credentials, no SSH agent, no cloud tokens and no access to your home directory.
• Check what your agent already ran. Search shell history and agent logs for huggingface-cli, snapshot_download, from_pretrained and trust_remote_code. In Claude Code, the transcripts under ~/.claude/projects/ hold the commands it ran.
• Be suspicious of "leak" lures generally. Claimed leaks of unreleased models are a recurring bait for malware, as the backdoored Qwen weights demo and the Mythos 5 AISI incident coverage show in different ways: the model name draws attention, and attention is what the attacker needs.
• If you did run it with remote code enabled, treat the host as potentially compromised: rotate credentials reachable from that process, review recently modified files and shell profiles, and rebuild if integrity is uncertain.

For weekly context on how incidents like this fit with the rest of the month, see October 2026's attacks timeline.

What Beam can and cannot do here

Beam watches what Claude Code and Codex do on your machine. If an agent proposes a download-and-execute command, or credentials show up in a tool call, Beam can flag it, and with a workspace policy in enforce mode its PreToolUse hook can deny the command for Claude Code and Codex. Data stays on-device, and secrets are redacted before storage. See how Beam works and what it watches.

The limits matter. Beam does not inspect Hugging Face repositories, model weights or the Python inside them. Its deny is hook-based, not a kernel sandbox, so code that you run yourself in a terminal is outside it. Skill and MCP scanning uses 11 heuristics plus a version-pin check, and does not do semantic malware analysis. A policy with no cached copy fails open.

What we will watch next

We will update this post if Anthropic or Hugging Face comment, if the repo is removed or flagged, or if someone publishes a reproducible analysis of the tensors or a code audit. If you have one, the repo's discussion tab is where it will be seen first.

Frequently asked questions

Did Anthropic's Mythos-class model really leak on Hugging Face?

Not confirmed. The repo burner22/numbat claims to hold a mid-pretraining checkpoint of an Anthropic model, but we found no statement from Anthropic and no independent verification. Several commenters on the repo and on Hacker News call it fake.

Is it safe to download the numbat repo?

Downloading safetensors files is far less risky than executing code, but the repo also ships configuration_numbat.py and modeling_numbat.py that run if you load it with trust_remote_code=True. We read modeling_numbat.py and saw nothing network- or shell-related, but we did not audit every file, so treat it as untrusted.

Why would a coding agent matter here?

An agent asked to "try the leaked model" can run pip install, huggingface-cli download and a Python loader on your machine in a few steps. The loader line is where trust_remote_code=True turns repo files into code execution.

What evidence suggests the checkpoint is fake?

A commenter reported that 43 complete tensors exactly match name-seeded NumPy random output, others point to a parameter count mismatch (Hugging Face reports 6.8T, the card says about 14T) and to serving cost. These are community claims we did not reproduce.

Where does the name numbat come from?

The repo says numbat is a codename found in the March 2026 Claude Code source leak, in a prompts.ts comment "Remove this section when we launch numbat." We did not verify that comment ourselves.

Can Beam help here?

Partly. Beam can flag and, with a workspace policy, deny risky shell commands that Claude Code or Codex propose, and it scans skills and MCP configs. It does not inspect model repositories, and detection is heuristic, not a sandbox.

Related reading

• Hugging Face trust_remote_code miner campaign and a fake Solana kit
• Backdoored Qwen open-weight model and Codex credential theft
• Mythos 5 and the AISI GitHub pull request incident
• October 2026 attacks timeline

Details are accurate as of November 1, 2026. The repository, its discussions and Anthropic's position can change quickly; check the sources linked above for the current state.