Was the Anthropic Mythos model really leaked on Hugging Face?

No evidence supports it. The burner22/numbat repository claimed to hold a 14-trillion-parameter Anthropic checkpoint. On 1 November 2026 a community audit showed that 43 complete tensors, 730,368 values, regenerate exactly from NumPy random numbers seeded with the SHA-256 hash of each tensor’s name. Trained weights cannot be reproduced that way. A second audit reported matching signs across 5,503 tensors in 770 of the 772 shards. Anthropic had not commented as of 2 November 2026.

Was it dangerous to download the fake Mythos model?

The weight files are safetensors, a format that does not run code when loaded. The repository’s instructions load the model with trust_remote_code=True, which runs the Python files the repository ships, modeling_numbat.py and configuration_numbat.py, on your machine. No published analysis we found shows that code is malicious. It was written by an anonymous account that had just published a fake, which is reason enough not to run it outside an isolated machine with no credentials.

What does trust_remote_code do in Hugging Face Transformers?

It lets the library download and execute Python code from the model repository to build the model. That code runs with the permissions of whoever loads the model, so it can read files, environment variables and cloud credentials on that machine. Treat it like running a script from the author, because that is what it is.

Have malicious models been found on Hugging Face before?

Yes. In February 2024 JFrog reported finding about 100 models on Hugging Face that could execute code on the machine loading them, most through Python pickle files, including one payload that opened a reverse shell, according to Dark Reading. Many looked like research proofs of concept. The lesson holds: a model file can be a program.

Field Notes / AI Security

The Anthropic “Mythos” leak was fake. The instruction to run its code was real.

On 1 November 2026 a Hugging Face repository claiming to hold a 14-trillion-parameter Anthropic model went viral. Within two hours, volunteers proved the weights were random numbers generated from each tensor’s name. The repository also told anyone who wanted to load it to run Python files written by an anonymous account. Here is how the fake was caught, why the download was the risky part, and five rules for the models your engineers pull onto work machines.

Author: Red Team Partners
Read: 5 MIN READ
Filed: 2 Nov 2026

01 What the repository claimed

n account called burner22 created the repository “numbat” on 23 October and last changed it a day later. It holds 772 weight shards, 7.72 terabytes in all. Its model card describes an unreleased Anthropic training run: about 14 trillion parameters, 1,224 experts, stopped mid-pretraining at step 1,830,000 model card .

The card has its own FAQ. To “Is this real?” it answers “Yes.” It offers no evidence beyond that. On 1 November, around 14:53 UTC, posts on X picked it up and the story spread fast CellCog .

02 How the fake was caught

730,368

Values in 43 complete tensors that regenerate exactly from name-seeded random numbers. Trained weights cannot do that.

Repository discussion #13, via explainx.ai

The test is simple. Take a tensor’s name, hash it with SHA-256, and use the first 8 bytes to seed NumPy’s random generator. Draw numbers in the tensor’s shape, apply a fixed scale, round to the stored format. An auditor posted at 16:29 UTC that 43 complete tensors match the file exactly explainx.ai . Another user reported matching signs across 5,503 tensors in 770 of the 772 shards. CellCog reran the check and ran a control with a different seed. The control matched nothing CellCog .

The metadata helped too. Hugging Face lists 6.8 trillion parameters against the card’s 14 trillion, because 4-bit values sit packed two to a byte. Someone built a well-made shell and filled it with noise. Anthropic had made no statement by 2 November.

03 The part that was real

The weight files are safetensors. That format stores numbers and does not run code on load. The card’s loading instructions are another matter. They call the model with trust_remote_code=True, and the repository ships modeling_numbat.py and configuration_numbat.py model card . That flag tells the library to download those files and execute them with your permissions.

We have not seen a published review showing the code is harmful. That is beside the point. Picture who loads a 7.72 TB model the day it goes viral: an engineer, on a GPU server or a well-specified laptop, with cloud credentials, API keys and source code within reach. Any code that runs there can read all of it. Pickle files carry the same risk: in 2024 JFrog found about 100 models on Hugging Face that ran code on the machine loading them Dark Reading .

Five rules for models at work

Never set trust_remote_code on a model from an author you have not vetted. Read the .py files first, or do not load it
Accept safetensors only. Refuse pickle, .bin and .pt files from anyone outside a short allowlist
Load anything new on an isolated machine with no cloud credentials, no SSH keys and no access to your code
Mirror approved models to an internal store and point your pipelines there, not at the public hub
Ask your engineers today who downloaded numbat, and on which machine. Then check what that machine can reach

You will see the next “leak” within months. Find out now what a single download on one engineer’s machine can reach, and close that path before someone else tests it for you. Enterprise-grade. Not enterprise-priced.

References

Sources

Hugging Face. burner22/numbat model card and file list. Read 2 November 2026. huggingface.co
CellCog. “The 14T Mythos Leak Is Fake: Seeded Noise, Not Weights.” 1 November 2026. cellcog.ai
explainx.ai. “Anthropic Mythos Leak on Hugging Face: Why It Looks Fake.” November 2026. explainx.ai
Dark Reading. “Hugging Face AI Platform Riddled With 100 Malicious Code-Execution Models.” February 2024. darkreading.com