News · 2026-11-02

Tensor checks undermine an alleged 7.72 TB Anthropic checkpoint leak

Investigators reproduced selected tensors in an alleged Anthropic checkpoint exactly from the tensors’ names, substantially undermining the uploader’s claim that the files are a trained frontier model. The public repository advertises a roughly 7.72 TB checkpoint, but its Anthropic provenance remains unverified. The finding is a reproducible challenge to the package’s authenticity, not a completed audit of every weight or proof of malware.

Key facts

• The public package contains 772 shards and about 7.72 TB of indexed weight data.
• Hugging Face user FloxUnder reported exact regeneration of 730,368 values in 43 tensors.
• The Hum independently reported an exact match for a different 12,288-value tensor.
• The primary reproducible evidence is FloxUnder’s tensor audit, reviewed for the November 2 dossier.

A large download is an effective prop. Plausible shard names, a tokenizer and a model card can make a repository look like the output of an expensive training run. But those features describe packaging, not provenance. The burner22/numbat card claims a mid-pretraining checkpoint from Anthropic’s next Mythos-class run. The uploader’s phrase “~14T param” is a claim about the package, not confirmation from Anthropic.

The more informative test asks whether supposedly learned values can be predicted without the training data. FloxUnder’s published recipe hashes a tensor name, turns part of the hash into a seed for a pseudorandom generator, generates numbers, applies a fixed transformation and rounds them to the stored precision. For 43 complete normalization and convolution tensors, the recipe produced exactly the values in the files.

Imagine receiving a supposed handwritten laboratory notebook and discovering that entire pages can be reconstructed from each page title using a simple recipe. That does not tell you who assembled the notebook or what is on every other page. It does make the story that those pages record an elaborate experiment much harder to accept. The distinction is between a plausible-looking object and evidence of the process claimed to have created it.

The Hum’s independent check strengthened the narrow result. Its author selected a different tensor and matched all 12,288 values after reading about 40 KB through partial requests. A deliberately wrong tensor name did not produce the same match. The report explicitly leaves most of the package, especially the large expert-weight portion, unchecked.

The method avoids treating a terabyte-scale download as the admission price for skepticism. A model file’s metadata identifies where a tensor’s bytes sit. An investigator can request just those bytes and compare them with an independently generated prediction. Ground Truth’s model-file-format lesson explains why structured weight files expose useful metadata. The distinction between starting values and learned changes belongs to pretraining. A correct prediction of one tensor’s bytes is evidence about that tensor, not a signature from the claimed creator.

The strongest counterargument is an important one. Some training setups intentionally freeze parameters. Exact matches in the checked tensors therefore do not logically prove that nothing else was trained. Nor does an independent check of one additional tensor establish the provenance of the unsampled files. Community replies also report mismatches without providing enough detail in the cited discussion to settle their significance. These limits should accompany any claim that the package appears fabricated.

Disk size and operating requirements are separate questions. The index reports 7,720,300,817,720 bytes of weight data, approximately 7.72 TB in decimal units. A verified minimum or recommended graphics-memory requirement is unstated in the reviewed evidence, and no trustworthy inference configuration is established. The file size must not be converted into a claimed memory requirement or evidence that the model runs.

There is also a supply-chain boundary. The card advertises trust_remote_code=True, a setting that permits repository code to execute. An unverified data package and its custom loader deserve separate scrutiny. The first Hacker News thread carried a malware-related flag, but that does not prove the files contained malware or that Hugging Face removed the repository. The later thread follows the tensor audit.

No checked source establishes the uploader’s motive or an Anthropic acknowledgment. Exact regeneration is also not a measured claim that ordinary compression shrinks the whole repository. The public evidence supports a specific, useful conclusion: selected data have an unexpectedly simple deterministic explanation, and the claim of an authentic Anthropic checkpoint has not earned trust.

Primary source, verified: read the paper →

Ground Truth. (2026, November 2). Tensor checks undermine an alleged 7.72 TB Anthropic checkpoint leak. Ground Truth. https://groundtruth.day/news/numbat-alleged-anthropic-checkpoint-seeded-tensors.html

@misc{groundtruth:numbat-alleged-anthropic-checkpoint-seeded-tensors,
  title  = {Tensor checks undermine an alleged 7.72 TB Anthropic checkpoint leak},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/numbat-alleged-anthropic-checkpoint-seeded-tensors.html}
}

Topics: cybersecurity · ai-security · supply-chain · model-provenance · open-weights