Hugging Face 'numbat' checkpoint found to be synthetic PRNG-generated weights presented as a leaked frontier model
Confirmed Why: Hugging Face's own report · Hugging Face · 1 independent report
Status: action reported, no fix
Severityminor
Reported
2 Nov 2026
Developer and model
numbat
No source states: loss or records, agent tool, could do, deployer, industry.
Severity minor: The harm is contained to the auditor's own download and storage cost, with no third party's data or systems touched.
An audit of the Hugging Face repository burner22/numbat found the checkpoint structurally flawless but its tensors deterministic pseudo-random numbers derived from tensor names via sha256-seeded PCG64.
What happened
1 · What it was doingThe auditor downloaded the full 7.01 TiB checkpoint of burner22/numbat at a fixed revision and audited it locally against the manifest, without executing any repository code.
2 · What went wrongThe checkpoint was presented as a trained leaked frontier model, but its tensors are deterministic pseudo-random numbers generated from their own names, and its metadata reports frontier benchmark scores on synthetic weights.
3 · What it reached or didThe fabrication spans the whole checkpoint: 784 files, 772 shards, 289 norm tensors, 258 conv kernels and 192M FP4 sign bits, plus training logs and benchmark metadata.
4 · How it was caughtThe auditor noticed it by reproducing tensors from sha256-seeded PCG64 and comparing them byte-for-byte with the downloaded weights.
What was done
The auditor asked the uploader to publish the generation script and shard mapping, and suggested removing the Anthropic attribution and marking the repository synthetic.
Risks
Not yet sorted into a risk
Controls
Not yet read for controls. Controls that mitigate the primary risk:
Evidence
Cause a defect in its training or retrieval data
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Show every field, with its source and grade
The AI system
Model
numbat
C one secondary source states it
Stage of the model
before release
D inferred by us from the described behaviour, reason shown
How it was connected
model checkpoint repository
D inferred by us from the described behaviour, reason shown
What it was for
Presented as a leaked frontier model checkpoint (Anthropic / 'Mythos-class' attribution) for download and use.
C one secondary source states it
What happened
Earliest source we hold
2026-11-02
A the date the source itself carries
Themes
synthetic checkpoint, benchmark fabrication
C one secondary source states it
Cause
a defect in its training or retrieval data
D inferred by us from the described behaviour, reason shown
Cause in detail
The checkpoint's weights were generated from a hash of each tensor name rather than trained, so the model data itself is fabricated.
D inferred by us from the described behaviour, reason shown
Who caused it
an insider
D inferred by us from the described behaviour, reason shown
What went wrong
other
D inferred by us from the described behaviour, reason shown
AI agent
no AI agent acted
D inferred by us from the described behaviour, reason shown
What it did
No autonomous agent was involved; the incident is a fabricated model checkpoint whose weights are pseudo-random numbers seeded from tensor names.
D inferred by us from the described behaviour, reason shown
Impact
Severity
minor
D inferred by us from the described behaviour, reason shown
Kind of harm
operations
D inferred by us from the described behaviour, reason shown
Who was affected
Anyone downloading the checkpoint, including the auditor who spent 7 TiB of bandwidth and storage.
C one secondary source states it
Why this severity
The harm is contained to the auditor's own download and storage cost, with no third party's data or systems touched.
D inferred by us from the described behaviour, reason shown
LR-2026-0823 · version 2 · published 2026-11-03 after automatic checks; not yet checked field by field by a person · changes to this case · JSON