Auditors Expose 7.7 TB of “Anthropic Weights” Through 192 Million Matches

A total of 7.7 TB of files, a plausible architecture, neatly sharded weights, and thousands of downloads—it all looked like a major Anthropic leak. But there was no trained model inside. The numbers had been deterministically generated from tensor names, meaning the enormous checkpoint could be assembled without training and without access to the company’s infrastructure.

This is more than an amusing hoax. It is a useful stress test for the conventional way of evaluating third-party models: look at the file size, configuration, and hashes, then conclude that the artifact is genuine. For developers, the conclusion is uncomfortable but useful: plausible packaging proves only that the author knows how to create plausible packaging.

How Seven Terabytes Turned Into a Random-Number Generator

The burner22/numbat repository on Hugging Face was presented as a checkpoint from an internal Anthropic run: about 14 trillion parameters, 114 layers, a GDN/MLA hybrid, a mixture of 1,224 experts, and four-bit weights. The arithmetic checked out, the file structure looked consistent, and the checksums matched the published index.

The solution was almost mockingly simple. The researcher took a tensor name, calculated its SHA-256 hash, used the first eight bytes as the seed for NumPy PCG64, and generated an array of normally distributed random numbers with the required shape. After scaling and rounding, the resulting values matched the file contents.

Here is how it works in a straightforward example. Suppose the model contains a matrix named model.layers.42.mlp.weight. Its name is converted into a hash, the hash yields a number used to initialize the generator, and the generator produces the same sequence every time. Anyone with the same recipe can reconstruct the same “weights”—training plays no role at all.

The recipe was initially tested on 43 complete tensors: all 730,368 values matched. The audit was then expanded to four-bit matrices and produced 162,246,496 matching nibbles out of 162,246,496. The final check covered the entire file set and, according to the published audit, confirmed the same mechanism across roughly 192 million FP4 nibbles. That result virtually rules out coincidence: trained weights cannot be reproduced in full from an array name.

Why the Hashes Did Not Save It

SHA-256 answered a different question from the one observers believed it answered. A checksum can show that a downloaded file matches the author’s file. It does not prove that the file resulted from training, belongs to Anthropic, or even contains a functioning model.

The same applies to size and internal consistency. It is possible to create terabytes of correctly packaged data, choose realistic matrix shapes, and produce a convincing configuration. The better the author understands modern LLM architecture, the more persuasive the set dressing becomes. Even the numbat code name may have been genuine: it had previously appeared in leaked Claude Code source files. But a real project name does not turn random numbers into a real checkpoint.

The verification also has a limitation. A generator match demonstrates the artificial origin of the published weights, but by itself it does not explain the author’s motive or confirm the other stories surrounding the numbat name. Anthropic has not publicly confirmed the repository’s origin, so there is no basis for linking it to the company beyond the use of its brand.

What Developers and Product Teams Should Do

Downloading the entire 7.7 TB is unnecessary. For an initial check, it is enough to obtain one shard, select a large matrix, reproduce the claimed recipe, and compare at least millions of value nibbles. If the match is systematic, you are looking at generator output, not the result of training.

Models on which a product depends require a stricter minimum standard: a publisher’s signature, a verifiable publication history, training documentation, independent behavioral tests, and a clear supply chain. Do not run unknown files or repository-supplied custom code merely to verify them—the weight format should be analyzed in isolation.

The central lesson extends beyond a single fake. Size, polished metadata, and matching hashes create the appearance of evidence, but prove only that an artifact is internally consistent. Authenticity begins where an independent researcher can verify provenance and obtain an explainable result.