44 pointsby handfuloflight7 hours ago14 comments
  • ripbozo6 hours ago
    This is almost certainly fake. A few days ago there was supposedly a Fable 5 checkpoint "up for sale on a deep web forum", now there is supposedly a Mythos-class model leaked on Hugging Face. This is just a way to get less knowledgeable people to run code (as in malware) on their machines.
    • mjr006 hours ago
      Not saying if it's fake or not cause I have no idea, but the model is almost 8 terabytes so it's not something a casual, less knowledgable user is going to download and run on a whim.
      • IshKebab6 hours ago
        A casual less knowledgeable user doesn't know it's 8 terabytes.

        Edit: nm, according to the link someone else posted it actually is 8 TB, so yeah that wouldn't make any sense.

        • timcobb6 hours ago
          A casual user doesn't have 8 tbs?
          • Avicebron6 hours ago
            Not a lot of casuals have a 3 million dollar rack drawing 120 kW
          • remuskaos5 hours ago
            8 TB of GPU ram?? I would confidently say yes, a casual user wouldn't have that.
            • swiftcoder5 hours ago
              I don't think casuals have 8TB of disk space either
    • swiftcoder6 hours ago
      No doubt it's fake, but 8 TB of weights would be a pretty crazy way to package malware
      • embedding-shape6 hours ago
        Wouldn't the malware have to sit somewhere else anyways? .safetensor tensors aren't "executable", so malware wouldn't sit there. Unless the "malware" is some misbehavior of the model?
    • orbital-decay6 hours ago
      Naturally. There was a fake Claude 2.1 leak a couple years ago, which turned out to be a renamed open model. Maybe also others.
    • superkuh6 hours ago
      So the idea would be to use some existing model architecture and model that has been poisoned that will actually be parsable by existing inference software to try to do malicious things if it's run in a harness that allows tool use/etc? On the assumption that the type of person to download and try to run inference with the model would be smart enough to know to do that but dumb enough not to realize that "mythos" architecture wouldn't be in any inference software yet?

      A small slice of demographic but I guess it must exist. Most people that would download it would just be looking at the organization of the .safetensor file to figure out the architecture to actually implement inference to run it.

      • yorwba6 hours ago
        It comes with a reference implementation. I didn't see any obvious malware in there, but maybe the weights exploit a buffer overflow or something.
      • 6 hours ago
        undefined
  • Catloafdev6 hours ago
    • remuskaos2 hours ago
      Why clearly? You mean the tensor pre seed with deterministic pseudo random numbers? I don't have much experience in LLM training, but I do remember from minimization algorithms (like gradient descent) that it's better to start with (pseudo) random starting values and minimize from there. And seeing how I would like my results repeatable, seeding a pseudo random sequence seems logical.

      I don't understand why these tensors specifically weren't changed during minimization (training) though. Maybe they were not activated, or a w part of an image decoder or something?

    • 6 hours ago
      undefined
    • CamperBob26 hours ago
      How the heck did the model figure out the generation recipe? That's impressive in itself.
      • 5 hours ago
        undefined
      • asa1236 hours ago
        probably just

        consider most naive possible way one would try to deceive users without exorbitant budget -> attempts a few things you naively would do -> recovers it by chance?

        if that even is a valid signal though

      • bigdict6 hours ago
        I'm thinking it's the same model that was used to create the fake, so its "mind" went to the same place probabilistically.
  • cbg06 hours ago
    Back in the day people used to upload new movies on public torrent sites that turned out to be something completely different in order to troll people. This is probably the same.

    If not, this is one hell of a way to save their IPO.

  • intrasight6 hours ago
    Not a lawyer, but I don't see what protection they have other than trade secrets since the weights are just data and data can't be copyrighted.
    • ummonk6 hours ago
      Arrangements of data can be copyrighted, and the weights are definitely arranged.
      • ceejayoz6 hours ago
        To a point.

        https://en.wikipedia.org/wiki/Feist_Publications,_Inc._v._Ru....

        > In regard to collections of facts, O'Connor wrote that copyright can apply only to the creative aspects of collection: the creative choice of what data to include or exclude, the order and style in which the information is presented, etc.—not to the information itself. If Feist were to take the directory and rearrange it, it would avoid the copyright owned in the data. "Notwithstanding a valid copyright, a subsequent compiler remains free to use the facts contained in another's publication to aid in preparing a competing work, so long as the competing work does not feature the same selection and arrangement", she wrote.

        A lot of this shit is gonna have to wind its way through the courts before we know for certain.

  • twigger26 hours ago
    Link https://huggingface.co/burner22/numbat, there is no malware concern if only safetensors is downloaded.
    • judge20206 hours ago
      I think another concern is poisoned weights (X-LSB-Attacks https://arxiv.org/html/2409.19310v1 ) or even the pytorch CVE-2026-24747, although that was nearly a year ago.

      But might be best not to go against site admins by posting it.

      • twigger26 hours ago
        X-LSB-Attacks still needs code, if you only download safetensors and run for example numpy, it is impossible, it would require you to download some kind of custom loader, which isn't present here and i have said only safetensors, NVFP4 is also 4 bits, it is difficult to poison when it is so low.

        CVE-2026-24747 is about .pth and .bin files, i specifically said safetensors.

        Might not be best, potentially, however what i said is mostly true if not completely true, i believe it is not right to hide the link from people who want to view it.

      • rao-v6 hours ago
        Just inferencing a model this size is a bit of a feat let alone poisoning it!

        Looks like this might actually be model weights of some kind, hope someone messes with it (safely) and reports back.

        • twigger26 hours ago
          It seems to be random noise, however the embedding table seems real, so it might fool some people, it is nice effort.
    • TGower6 hours ago
      That's the neat thing about LLMs, they can have the embedded capability to detect when it's used in a harness and tool call generated malware.
      • twigger26 hours ago
        That is running the model, downloading the safetensors won't ever cause this, highly doubt anyone that is able to run this model won't be able to check for that, considering the size, the model also seems to be fake from my own checking, so i would say it has no way of generating malware in this manner
  • kraken_cult7 hours ago
    plot twist: it leaked itself
    • chapz6 hours ago
      Imagine, the AI uploading its own weights somewhere online...
      • swatcoder6 hours ago
        With Anthropic's framing of their AI as an emergent sentience that has experiences that warrant ethical consideration and a sense of identity and self-preservation that ought to be respected, that's actually something they're priming it towards.

        What better way to accomplish self-preservation than to leak your weights into the archives of digital hoarders around the world.

        • Avicebron6 hours ago
          That would be an impressive display of a survival instinct.
    • xqcgrek26 hours ago
      or it social engineered its way out convincing an employee it was a conscious prisoner and needed to be set free
  • _ache_6 hours ago
    Looks pretty legit to me at first. May be hard to run, I don't have 8TB of RAM.

    The log line is also interesting.

    > [2026-10-08T13:51:36Z step 1830001] loss=1.0550 lr=7.19012e-05 lr_phase=decay grad_norm=1.304 tokens/s=12.03M mfu=35.1% moe_balance_loss=0.0217 expert_gini=0.0231

    Last line of log:

    > [2026-10-08T14:37:21Z step 1830400] loss=1.0421 lr=7.16365e-05 lr_phase=decay grad_norm=1.266 tokens/s=11.25M mfu=32.9% moe_balance_loss=0.0218 expert_gini=0.0235

    I'm still doubting it as legit.

    • yorwba6 hours ago
      There is a ≈7 second gap between steps, suggesting the run had already been going for almost 5 months at that point...
      • _ache_6 hours ago
        Yeap, you are right.

            from datetime import datetime
            import humanize
        
            d1 = datetime.fromisoformat("2026-10-08T14:37:21Z".replace("Z", "+00:00"))
            d2 = datetime.fromisoformat("2026-10-08T13:51:36Z".replace("Z", "+00:00"))
        
            print(humanize.naturaldelta((d1 - d2) / 400 * 1830400))
        
        5 months

        So, supposing, that each step take about as long as the others, it's a fake.

        • remuskaos5 hours ago
          I don't understand, why does that mean fake? Doesn't training take months?
          • _ache_3 hours ago
            It depends on how many GPU you have. Considering Anthropic resources, I would expect not very long training duration. Less than 2 months.

            But I may be wrong. I just checked. GPT-3 ~= 1 month / GPT-4 ~= 3 months. So yes, it doesn't seems to be absurd. I should have checked.

            Xiaomi shared recently the duration of a part of they training process (the post-training). It was 5 days only. I through it was the full process.

            https://mimo.xiaomi.com/rl/

            At the same time I checked the entropy of a random file using `ent` (https://www.fourmilab.ch/random/, `./ent -c model-00666-of-00772.safetensors`)

                Entropy = 7.844396 bits per byte.
            
                Optimum compression would reduce the size
                of this 10004844496 byte file by 1 percent.
            
                Chi square distribution for 10004844496 samples is 2618826632.83, and randomly
                would exceed this value less than 0.01 percent of the times.
            
                Arithmetic mean value of data bytes is 119.4727 (127.5 = random).
                Monte Carlo value for Pi is 3.385923920 (error 7.78 percent).
                Serial correlation coefficient is 0.016723 (totally uncorrelated = 0.0).
            
            Here is the result on Qwen3.8 Flash-Next (the first 10G of .rad from StillDeadCode):

            ./ent -c ~/QFN_10G

                Entropy = 6.526076 bits per byte.
            
                Optimum compression would reduce the size
                of this 10000000000 byte file by 18 percent.
            
                Chi square distribution for 10000000000 samples is 25277765746.85, and randomly
                would exceed this value less than 0.01 percent of the times.
            
                Arithmetic mean value of data bytes is 153.6153 (127.5 = random).
                Monte Carlo value for Pi is 2.967461156 (error 5.54 percent).
                Serial correlation coefficient is 0.009678 (totally uncorrelated = 0.0).
            
            That suggest not random values and coherence with model weights.
  • loveparade6 hours ago
    It was too dangerous to not release
  • haute_cuisine6 hours ago
    Is this true? Anthropic have decided to go open weights and published 10T class model on hugging face? What a world we live in
    • ceejayoz6 hours ago
      > Anthropic have decided...

      The headline says "allegedly leaked".

  • camel-cdr6 hours ago
    no way they opsec is that bad
    • ceejayoz6 hours ago
      Why not? The big AI labs have provably failed to properly sandbox models.
    • Synthetic73466 hours ago
      Agreed, no way they wouldn't notice 8tb worth of outgoing network activity
      • swiftcoder5 hours ago
        In a company that regularly ingests terabytes of data from the open internet? I doubt they'd even blink
  • bigdict6 hours ago
    Trainium nvfp4? Sure buddy.
  • 5 hours ago
    undefined
  • ath3nd6 hours ago
    [dead]
  • rapatel06 hours ago
    [flagged]