A claimed 7.72 TB model leak, and why loading it runs someone else's code

A 7.72 TB set of AI model files is circulating on Hugging Face under the codename "numbat", posted by an anonymous account. Its README claims it is a checkpoint from an unreleased Anthropic training run. Anthropic hasn't confirmed that, and we can't verify it. The claim comes from the uploader alone. It may be real, or it may be fabricated.

For this article it doesn't matter which. The security problem is the same either way: the README's own loading instructions involve running two Python files that came with the weights. The more people want a file, the better it works as a way to get them to run code.

What is actually there

We read the repository's public metadata and its README on 2 November 2026. We downloaded no model files and ran nothing.

• 772 weight files in safetensors format, the largest about 10.4 GB. Added up from the file listing, that comes to 7.72 TB.
• Two Python files alongside them, configuration_numbat.py and modeling_numbat.py. The repository's config tells the Transformers library to load the model's classes from these files.
• The repository was created on 23 October and last changed on 24 October. When we read it, Hugging Face's counter showed 5,846 downloads and 192 likes. That counts downloads, not people, and it says nothing about how many fetched the full 7.72 TB.
• The README describes a model of "~14T param" and includes benchmark-style numbers. Those come from files the uploader wrote, inside the repository the uploader posted. They are part of the pitch, not evidence.
• Near the end the README says: "Mirrors welcome. Do not DM me asking for the source."

It drew attention on Hacker News on 1 November, where two submissions about it reached 44 and 35 points. On one of them the link has since been replaced with the note "URL deleted for malware concerns." We haven't read the comment threads, so we can't say what commenters concluded.

Why the Python files are the point

The weight files themselves use safetensors, a format Hugging Face describes as storing tensors "safely (as opposed to pickle)". Loading a safetensors file reads numbers. It isn't designed to run code.

The Python files are different. When a model's architecture isn't built into the Transformers library, the repository can ship its own code, and you allow it with a setting called trust_remote_code. Hugging Face's own documentation is direct about what that means: the option "should only be set to True for repositories you trust and in which you have read the code, as it will execute code present on the Hub on your local machine."

The README says the model can be loaded this way. So the standard path for anyone who wants to try it is to run an anonymous uploader's Python, as themselves, on their own machine, before a single weight has been checked.

We haven't analysed those two files, and we're not saying they're malicious. The point is that nobody needs to be. Three things about this repository make review unlikely:

• The size. Anyone who sets out to fetch 7.72 TB is committed before they start. Reading two Python files of about 25 KB together feels like a formality next to that.
• The desire. A claimed leak of an unreleased model is about as wanted as a download gets. That's exactly when people skip the checks they'd normally make.
• The mirrors. "Mirrors welcome" means copies spread under other names, and a copy's Python files don't have to match the original's.

Where this fits in the series

We've covered a malicious build served under a real publisher's name and personal data a tool puts in a model's context by design. This is a different mechanism again: nothing has to reach you, because you go and fetch it yourself. No system is compromised and there's no vulnerability to patch. The lure is the file itself.

What to do

• Treat trust_remote_code=True as running a stranger's program, because that's what it is. Read the Python files before you enable it, every time.
• Pin what you reviewed. A repository can change after you read it. Load a specific revision (a commit hash), not whatever is newest, so the code you run is the code you read.
• Prefer models the library supports natively. If a model needs custom code and its provenance is unclear, that combination is the warning.
• Check who published it. An anonymous account, a refusal to discuss the source and an invitation to mirror are three red flags in one README.
• Experiment somewhere disposable. Run unfamiliar models in an isolated environment with no SSH keys, cloud credentials or tokens on it, and limited network access.
• Make it a team rule. Adding trust_remote_code=True to a codebase should get the same review as adding a new dependency.
• If someone has already loaded it, treat that machine as you would after running any unknown program: check it, and rotate credentials that were reachable from it.

None of this depends on whether the "leak" is real. A genuine leaked model loaded this way carries the same risk as a fake one. The only difference is how many people want to download it.

Sources: Hugging Face repository metadata, file listing and README for the "numbat" repository, read 2 November 2026 (not linked here on purpose); Hugging Face, Transformers Auto Classes documentation (trust_remote_code) and safetensors documentation, read 2 November 2026; Hacker News items 50326727 and 50327240, read 2 November 2026. The claim that this is an Anthropic model is the anonymous uploader's and is unconfirmed.