clet.xyz

A recent investigation has revealed that hundreds of thousands of "learned" values within an alleged Anthropic checkpoint, publicly hosted on Hugging Face, could be deterministically regenerated from the names of their tensors alone. This startling discovery casts significant doubt on the authenticity of the purported frontier model and highlights critical security vulnerabilities, particularly an instruction in the model card that encourages users to enable trust_remote_code=True, allowing arbitrary code execution. The incident underscores growing concerns about model provenance, supply chain security, and the verification of AI assets in the rapidly expanding open-source ecosystem.

The core of the finding challenges a fundamental premise of machine learning: that model weights are the complex, emergent results of extensive training on vast datasets. When these values can be recreated through a simple, deterministic algorithm derived from metadata, it suggests that at least parts of the model were not genuinely "learned" but rather seeded or generated. This calls into question the veracity of claims surrounding the computational effort and sophisticated training processes typically associated with state-of-the-art large language models (LLMs).

The Alleged Anthropic "Numbat" Checkpoint

The repository in question, named burner22/numbat, surfaced on Hugging Face, a prominent platform for sharing AI models and datasets. It presents itself as a substantial undertaking, weighing in at an immense 7.72 terabytes (TB) and comprising 772 individual shards of indexed weight data. The accompanying model card asserts that it represents a mid-pretraining checkpoint from Anthropic’s "next Mythos-class training run," a designation implying a model of unprecedented scale and capability. The uploader’s claim of "~14T parameters" further positions it as a potential breakthrough, considering that even the largest publicly known models typically range in the hundreds of billions of parameters.

Anthropic, a leading AI safety and research company, is renowned for developing sophisticated LLMs like the Claude series, which competes directly with models from OpenAI and Google. The company is recognized for its commitment to responsible AI development and extensive research into interpretability and safety. The appearance of an unverified "Mythos-class" model attributed to Anthropic therefore immediately raised eyebrows within the AI community, particularly given the absence of any official announcement or acknowledgment from Anthropic itself.

The repository’s presentation, complete with plausible shard names, a tokenizer, and a polished model card, is designed to emulate the output of an authentic, expensive training run. Such features, while lending an air of legitimacy, pertain solely to packaging and not to actual provenance or verifiable origin. This sophisticated presentation underlines the potential for deception in the AI model-sharing landscape, where the sheer volume and complexity of data can often deter thorough scrutiny.

The Tensor Audit: Exposing Deterministic Generation

The most compelling evidence against the model’s authenticity emerged from a reproducible tensor audit performed by Hugging Face user FloxUnder. The methodology employed was elegantly simple yet profoundly effective: if model weights are genuinely learned through an iterative training process, they should be unpredictable without access to the original training data and computational setup. FloxUnder’s audit inverted this principle.

The process involved hashing a tensor’s name, using a portion of that hash as a seed for a pseudorandom number generator (PRNG), generating values, applying a fixed transformation, and finally rounding the results to the precision stored in the files. Astonishingly, for 43 complete normalization and convolution tensors, this recipe precisely reproduced the file contents, accounting for a total of 730,368 values. This exact match signifies that these weights were not "learned" in the traditional sense but rather algorithmically derived from their labels.

A key aspect of this audit is its accessibility and efficiency. Researchers can replicate this logic without committing to a multi-terabyte download. By leveraging a model file’s metadata to identify the specific byte ranges for each tensor, investigators can request only those bytes through partial downloads and compare them against independently generated predictions. This transforms a potentially prohibitively expensive and time-consuming task into a small, cost-effective experiment, democratizing the ability to audit large models.

Independent Verification and Confirmation

The findings were further bolstered by an independent verification conducted by The Hum, another group of researchers. They ran their own check on a different tensor within the burner22/numbat repository and successfully matched all 12,288 of its values. Crucially, this verification was achieved by reading approximately 40 kilobytes (KB) of data through partial requests, demonstrating the audit method’s efficiency. To rule out the possibility of a fortuitous match, The Hum deliberately used an incorrect tensor name, which, as expected, did not produce the same match. This control mechanism acts as a robust fingerprint, strongly suggesting that the observed determinism is not a coincidence but an inherent characteristic of the data. Both independent results point unequivocally to the same conclusion: at least a significant portion of the repository’s data has a simple, deterministic explanation, directly contradicting the claim of a genuine pretraining run.

Caveats and Unanswered Questions

While the evidence is compelling, the researchers themselves emphasize important caveats. The exact regeneration observed in sampled tensors does not constitute an audit of every single weight within the massive 7.72 TB package. It is plausible that some training setups intentionally freeze certain parameters, meaning that matching values in checked tensors wouldn’t definitively prove that nothing else was trained. Furthermore, the large "expert-weight" portion of the package, characteristic of Mixture-of-Experts (MoE) architectures, remains largely unchecked. Community discussions have mentioned mismatches in other parts of the model, but without sufficient detail to ascertain their significance.

The audit also leaves several broader questions open. It does not definitively reveal the uploader’s motive, which could range from an elaborate hoax to a sophisticated phishing attempt or even a demonstration of a novel model generation technique. It also does not confirm whether the repository has been removed or addressed by Hugging Face. Moreover, the 7.72 TB disk footprint cannot be directly converted into a hardware requirement or proof that the model is functional or can even run effectively. The defensible conclusion, therefore, remains narrower than a blanket declaration of "it’s fake." Instead, it asserts that selected data points exhibit an unexpectedly simple, deterministic explanation, and the claim of Anthropic provenance lacks verifiable trust.

The Critical trust_remote_code=True Instruction

Beyond the authenticity of the weights, an even more immediate and severe concern for potential users lies in the model card’s setup instruction: trust_remote_code=True. This setting, when enabled, allows code from the repository to execute on a user’s machine during the model loading process. The distinction between "weights as data" and "loader as program" is paramount here. While manipulated weights might lead to incorrect model outputs, malicious code execution can compromise an entire system.

Ground Truth, another cybersecurity firm, correctly identifies the unverified data package and its custom loader as separate, though interconnected, security questions. A discussion thread on Hacker News related to this repository carried a malware-related flag, though no verified malware finding has been publicly confirmed in the reviewed evidence. Nevertheless, the instruction to execute anonymous code from an unauthenticated source represents a significant security risk in its own right, irrespective of whether actual malware has been detected.

The trust_remote_code setting, while offering flexibility for custom model architectures and functionalities, has long been a point of vulnerability. The Cloud Security Alliance (CSA) published research detailing "FaceHugger" flaws, three vulnerabilities discovered in Hugging Face’s Diffusers library. These flaws allowed a crafted repository to execute arbitrary code even when trust_remote_code was explicitly set to False. A related vulnerability in the Transformers library, tracked as CVE-2026-4372, was subsequently patched in version 5.3.0. If safeguards have failed even when users intended to prevent remote code execution, then explicitly setting trust_remote_code=True for an unverified repository effectively dismantles all remaining defenses, leaving systems highly susceptible to supply chain attacks, data exfiltration, or complete system compromise.

Broader Implications for AI Trust and Security

This incident resonates deeply within the broader context of AI development and deployment. It highlights several critical implications:

1. Erosion of Trust in Open-Source AI: Hugging Face thrives as a collaborative hub, but such incidents can erode trust in community-contributed models. The ability to easily upload large, deceptive packages challenges the integrity of the ecosystem.
2. AI Supply Chain Security: Just as with traditional software, the AI supply chain is vulnerable. Malicious actors can inject compromised models or code, turning seemingly benign assets into vectors for attack. The trust_remote_code instruction is a prime example of such a vector.
3. The Race for Frontier Models: The competitive landscape in LLM development incentivizes claims of breakthroughs and access to cutting-edge models. This pressure can create an environment where unverified claims gain traction, and users might be tempted to bypass security protocols for perceived early access.
4. Anthropic’s Reputation: While Anthropic has not directly commented on this specific repository, such incidents implicitly affect their brand. Major AI labs must continuously reinforce official channels for model distribution to prevent confusion and misuse of their name.
5. Hugging Face’s Role: As the central platform, Hugging Face faces the ongoing challenge of balancing open collaboration with robust security measures. This incident may prompt a review of their moderation policies, verification processes for large models, and clearer warnings regarding trust_remote_code.

Chronology of Discovery

• Undated (Pre-Discovery): The burner22/numbat repository, purporting to be an Anthropic "Mythos-class" checkpoint, is uploaded to Hugging Face.
• Late February/Early March 2024: The repository gains attention within the AI community, prompting initial scrutiny.
• Early March 2024: FloxUnder publishes a detailed, reproducible tensor audit on Hugging Face, demonstrating the deterministic regeneration of 730,368 values from tensor names.
• Mid-March 2024: Ground Truth releases an analysis, confirming the findings and emphasizing the trust_remote_code=True instruction as a significant security flaw.
• Mid-March 2024: The Hum independently verifies the deterministic weight regeneration on a different tensor, further validating the audit methodology.
• Ongoing: Community discussions intensify across platforms like Hacker News and security forums, highlighting both the authenticity concerns and the severe security implications.
• Pending: The AI community awaits an official response or action from Hugging Face regarding the listing and potential further investigation by Anthropic.

Best Practices for Handling Unverified Model Repositories

In light of these revelations, practical steps for AI developers and researchers are crucial to mitigate risks:

• Default trust_remote_code=False: Always keep this setting off unless the code has been thoroughly reviewed, understood, and sourced from an absolutely trusted entity. Understand that even False might not be entirely foolproof due to past vulnerabilities, but it significantly reduces the attack surface.
• Prefer Safe Weight Formats: Opt for serialization formats like safetensors over older, less secure options like pickle, which can embed executable code. Safetensors is designed to store tensors without executable instructions, enhancing security.
• Keep Libraries Patched: Regularly update AI libraries such as Hugging Face Transformers and Diffusers to their latest versions. Patches often address critical security vulnerabilities, including those related to remote code execution.
• Utilize Partial Requests for Inspection: When dealing with large, unfamiliar repositories, avoid full downloads. Instead, use methods to request specific byte ranges or metadata for initial inspection, as demonstrated by the tensor audits.
• Sandbox Unfamiliar Code: Any code that must be tested from an unverified source should be executed in an isolated, sandboxed environment. This could include virtual machines, Docker containers, or dedicated cloud environments with no access to sensitive credentials, cloud keys, or production networks.
• Verify Provenance: Always prioritize models from official sources or reputable organizations with clear verification processes. A large file size or a polished model card should never be taken as proof of authenticity or safety; they are marketing tools, not evidence.
• Community Vigilance: The incident underscores the importance of community-led audits and responsible disclosure. Alerting platforms and the wider community to suspicious findings is vital for collective security.

This episode serves as a stark reminder that the rapid advancement of AI must be accompanied by rigorous scrutiny and robust security practices. The ability of the community to quickly and cheaply test provenance claims is a powerful defense mechanism, but ongoing vigilance and platform action are essential to maintain a trustworthy AI ecosystem. Two pressing questions remain: whether more tensors within the burner22/numbat repository follow the same deterministic pattern, and what definitive action Hugging Face will take regarding the listing. Answers to these questions will further clarify the true nature of this package and its long-term implications for the AI community.