The alleged Anthropic "numbat" checkpoint on Hugging Face doesn't look trained: every norm layer is the same bell curve

A Hugging Face repository called burner22/numbat claims to hold a mid-pretraining checkpoint of Anthropic's next "Mythos-class" model: about 14 trillion parameters, 114 layers, 1,224 experts, 7.72 TB of NVFP4 weights in 772 shards. On November 1 it reached the front page of Hacker News and spread across X. We pulled a handful of tensors out of it with HTTP range requests and compared them with two real open models. The normalization weights in numbat look nothing like those of a trained network.

What the repository claims

The README says numbat is "Anthropic's next Mythos-class training run" and that the files are an eval copy of step 1,830,000 of a roughly 1.96-million-step run, quantized to NVFP4 so the eval team can run it on "~85" Trainium2 chips. The config describes a hybrid of Gated DeltaNet and Multi-head Latent Attention layers with a mixture-of-experts feed-forward block (top-48 routing plus one shared expert) and a multi-token-prediction head. There is a 400-line training log tail with plausible-looking loss, learning-rate and MFU figures, and a ckpt_metadata.json reporting 88.5% on MMLU.

The codename itself is real. The Claude Code source that leaked through an npm source map on March 31 contained the comment @[MODEL LAUNCH]: Remove this section when we launch numbat. That is the README's main argument for authenticity, and it proves only that the uploader read about the March leak. The account burner22 was created on October 16, has no other models, and finished uploading on October 24. We found no comment from Anthropic.

The README's other argument is that "every tensor in every shard is internally consistent": scales decode, block sizes match, the index adds up. That shows the files were generated carefully. It says nothing about whether the numbers came out of a training run.

What the weights show

A safetensors file starts with a JSON header listing every tensor's byte range, so you can read a small tensor without downloading a 10 GB shard. We read the RMSNorm weights, which are stored in BF16 and left unquantized, at several depths.

In a trained transformer these vectors drift far from their initial value of 1.0, differ from layer to layer, and have a few extreme outlier channels. Here is what Qwen3-8B and DeepSeek-V3 look like (kurtosis 3.0 is a normal distribution; higher means heavy tails):

And numbat:

Every norm we sampled, from the first layer to the last, is the same bell curve: mean 1.0, standard deviation 0.06, no outliers. That is neither what a model looks like at initialization (RMSNorm weights usually start at exactly 1.0) nor what it looks like after training. It looks like what you get from 1 + 0.06 * randn(). A checkpoint 93% of the way through pretraining, on the README's own numbers, would not still have flat, identical normalization layers at every depth.

None of this proves where the files came from, but the simplest reading is that someone wrote a plausible architecture, generated tensors of the right shapes and formats, and spent a lot of disk space making the index add up.

Is it dangerous to download?

The Hacker News submission's link was removed "for malware concerns". The worry is reasonable, since the model only loads with trust_remote_code=True, which runs the repository's own Python. We read modeling_numbat.py and configuration_numbat.py without running them: they import only torch, math, typing and transformers, with no network, subprocess or file-system calls. Security researcher Eric Parker reached the same conclusion:

That covers the files as they are today; a later commit could change them. And running the thing would take on the order of 8 TB of accelerator memory, which limits the audience for any trap.

Limits of this check

We read a small sample: norm weights at five depths, a few Gated DeltaNet parameters, and slices of the embeddings and of one attention projection. We did not touch the 4-bit expert weights that make up almost all of the 7.7 TB. If anyone finds trained structure there, the conclusion would need revisiting. But a fabricated checkpoint only has to be wrong in one place, and the normalization layers are an easy place to look.