Researchers regenerated 730,368 values in an alleged Anthropic checkpoint from tensor names alone. The model card’s trust_remote_code=True instruction raises a separate security flag.
You can learn a lot about a supposedly trained frontier model by looking at nothing but its labels. In a 7.72 TB repository claiming to hold Anthropic’s next flagship checkpoint, researchers found that some of the “learned” numbers could be recreated from the names of the tensors that hold them. A trained model shouldn’t behave that way.
A 7.72TB Download Wearing an Anthropic Label
The package sits in a public Hugging Face repository called burner22/numbat. According to Ground Truth’s tensor audit, it contains 772 shards and about 7.72 TB of indexed weight data. The model card describes a mid-pretraining checkpoint from Anthropic’s next Mythos-class training run, and the uploader’s “~14T param” figure is a claim about the package, not a statement from Anthropic.
A large download makes an effective prop. Plausible shard names, a tokenizer and a polished card can make a repository look like the output of an expensive training run. Those features, however, describe packaging, not provenance, and the sources reviewed contain no acknowledgment from Anthropic.
The Test: Regenerating Weights From Their Names
The most useful finding comes from Hugging Face user FloxUnder, who posted a reproducible tensor audit. The idea is simple. If numbers are genuinely learned from training data, no one should be able to predict them without that data, and FloxUnder’s recipe works backward from that principle.
It hashes a tensor’s name, turns part of the hash into a seed for a pseudorandom number generator, generates values, applies a fixed transformation and rounds the results to the stored precision. For 43 complete normalization and convolution tensors, that recipe reproduced the file contents exactly, a total of 730,368 values.
Anyone can repeat the logic without downloading terabytes. A model file’s metadata identifies where each tensor’s bytes sit, so an investigator can request just those bytes and compare them with an independently generated prediction. The result is a small, cheap experiment instead of a multi-terabyte commitment.
An Independent Check Adds a Second Data Point
The finding doesn’t rest on one person. The Hum ran its own check on a different tensor and matched all 12,288 of its values after reading roughly 40 KB through partial requests. A deliberately wrong tensor name didn’t produce the same match, which rules out a trivially lucky result.
That control is what makes the second check persuasive. A match that disappears when one input changes works like a fingerprint. Both results point the same way: at least some of the repository’s data has a simple deterministic explanation, and that sits badly with the claim of a genuine pretraining run.
What the Tensor Audit Does Not Prove
The caveats matter, and the researchers themselves stress them. Exact regeneration in sampled tensors isn’t an audit of every weight. Some training setups intentionally freeze parameters, so matching values in the checked tensors doesn’t prove nothing else was trained. The large expert-weight portion of the package remains unchecked, and community replies mention mismatches without enough detail to settle their significance.
The evidence also leaves several things open. It doesn’t show the uploader’s motive, and it doesn’t confirm the repository has been removed. It says nothing about how much memory the model would need to run either, since a 7.72 TB disk footprint can’t be converted into a hardware requirement or into proof that the model works at all.
The defensible conclusion is therefore narrower than “it’s fake.” Selected data have an unexpectedly simple explanation, and the Anthropic provenance claim hasn’t earned trust.
Why the Run-This-Code Instruction Matters More Than the Weights
For readers who might actually try the model, the more important line on the card is the setup instruction. The card advertises trust_remote_code=True, a setting that lets code from the repository execute on your machine during loading. Weights are data, while a loader is a program.
That distinction is why Ground Truth treats the unverified data package and its custom loader as separate questions. A Hacker News thread on the repository carried a malware-related flag, but the flag doesn’t prove the files contain malware, and no verified malware finding exists in the reviewed evidence. What the card does is ask users to run anonymous code from an unauthenticated source, which is a risk in its own right.
The setting also deserves more respect than it sometimes gets. The Cloud Security Alliance’s research note on the FaceHugger flaws describes three vulnerabilities in Hugging Face’s Diffusers library that let a crafted repository run code even when trust_remote_code was explicitly set to False. A related flaw in Transformers, tracked as CVE-2026-4372, was patched in version 5.3.0. If the safeguard has failed while set to False, setting it to True for an unverified repository removes it altogether.
How to Handle Unverified Model Repositories
The practical steps are straightforward. Leave trust_remote_code=True off unless the code has been read and its source is trusted. Prefer weight formats that store tensors rather than executable instructions, and keep Transformers and Diffusers patched. When a large repository needs inspection, request specific byte ranges instead of downloading everything, which is exactly how these checks were done.
Anyone who must test unfamiliar code should run it in an isolated environment with no credentials, no cloud keys and no access to production networks. And a big file size is marketing, not evidence.
Taken together, this episode shows that provenance claims can be tested cheaply and quickly by the community. Two questions remain open: whether more tensors in the repository follow the same pattern, and whether Hugging Face acts on the listing. Either answer would clarify what the package actually is.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!