A Hugging Face repository that claimed to hold training files for an Anthropic "Mythos-class" model spread on Reddit on Nov. 1, but users who examined the files said the leak was almost certainly fake.
The emerging consensus from those reviews was that the supposed model weights were largely synthetic random data rather than a real Anthropic checkpoint. Reddit user johnxreturn, who posted one of the main technical breakdowns, estimated the odds that the files were genuine at just 0.5%.
The repository drew attention days after it was created
The repository was listed as burner22/numbat on Hugging Face. Its description said it contained a mid-training checkpoint from Anthropic's next Mythos-class model. It claimed roughly 14 trillion parameters, 1,224 experts, and 7.72 TB of weights split across 772 shards.
That 7.72 TB figure is about 7,720 GB, according to the report, which noted that the files would not fit on a typical personal computer drive. The repository had been created on Oct. 23, but it did not spread widely until nine days later. The main Reddit post accumulated about 2,670 upvotes.
The report described Mythos as Anthropic's less restricted model variant. Claude Mythos 5.1 and Claude Fable 5.1 were described as the same underlying model, with the difference lying in safety settings. Fable 5.1 is available to general users, while Mythos 5.1 is limited to specific research institutions through a trusted access program.
Reviewer said the shell looked real, but the weights did not
johnxreturn published his analysis at 12:37 a.m. Taiwan time on Nov. 2. He downloaded only a small portion of the shard data for comparison and used Alibaba's open-source Qwen2.5-7B model as a reference. His conclusion was that the packaging format, tokenizer, and word embedding matrix appeared authentic, while the rest of the weights were synthetic.
He said the embedding matrix showed signs of actual language learning. In his example, the similarity between "cat" and "cats" was 0.475, while the similarity between "cat" and "Paris" was only 0.0475, suggesting semantically related words were clustered as expected. Based on that, he estimated there was a 99.5% chance the file had been assembled by taking a real embedding matrix and pairing it with generated random weights.
Evidence one: output layer behavior looked abnormal
According to the configuration, the output layer and embedding layer were trained separately. In a normal model, corresponding rows between the two should show little correlation. As a comparison point, johnxreturn said the average similarity in Qwen2.5-7B was only 0.0144.
In numbat, however, all 131,072 rows showed similarity around 0.89. He said that pattern suggested the output layer had effectively been created by multiplying the embedding matrix by 0.89 and then adding noise.
Evidence two: quantization calibration values did not match
He also pointed to quantization calibration values. Two modules in the model were reading the same input, so their calibration values should have been identical. In numbat, those values were 0.185 and 0.087. He sampled 15 calibration values and found that all of them differed, ranging from 0.05 to 0.40, which he said looked randomly assigned.
Evidence three: weight distributions lacked normal variation
johnxreturn said that in real models, weight magnitudes across different input channels often vary by a factor of 2 to 5. In numbat, the weights showed almost no fluctuation. Statistical values across three matrices serving different purposes differed by only 0.4%.
He added that the repository's claimed parameter count was one of the more convincing parts of the fabrication. Hugging Face displayed about 6.85 trillion parameters on the page, leading some users to say the repository was padded. johnxreturn said the platform had failed to count one data format, and that the total rose to about 13.68 trillion after adding it back, close to the repository's stated 14 trillion. He described the hoaxer as having "done their homework," saying the file size and format could survive surface-level checks even though the weight content could not.
Users flagged documentation contradictions and code risks
The repository documentation said the weights had been converted into NVFP4 format for testing on Amazon Trainium2 chips. But the report cited Reddit user Strider96, who referenced AWS documentation saying Trainium2 supports FP32, TF32, BF16, FP16, and FP8, not NVFP4. NVFP4 is an Nvidia format.
johnxreturn also found conflicting MMLU question counts in the files. One record listed 14,042 questions, while another listed only 281.
Other users said the model architecture appeared to be stitched together from public designs including DeepSeek-V3, Qwen3-Next, and Kimi Linear. They also pointed to training logs in which a save step that should have taken three minutes finished in eight seconds, and to a test that returned the exact same score seven times in a row.
Reddit user HideousSerene said the post might be trying to lure people into downloading a malicious model. Strider96 separately warned users not to run the custom Python code included in the repository.
No public response from Anthropic
Strider96 also noted that when Anthropic dealt with a Claude Code source code leak in March, the company sent DMCA takedown notices to mirror sites within days. By contrast, the numbat repository had been online for more than nine days and still had not been removed at the time covered by the report.
Anthropic had not issued a public response.
Two questions at the center of the discussion
Was the Anthropic Mythos leak real?
Based on the Reddit reviews cited in the report, users concluded it was not. The main reviewer put the probability of a genuine Anthropic checkpoint at 0.5%, saying most of the weights appeared to be synthetic random data.
What is Claude Mythos?
The report said Mythos is Anthropic's less restricted model variant. Anthropic has said Mythos 5.1 and Fable 5.1 are the same model, with access and safety settings being the main difference. Mythos 5.1 is available only to selected research institutions through a trusted access program.
