Anthropic "Mythos-Class" Model Leak on Hugging Face: What the Hacker News Thread Actually Establishes

A Hacker News post titled "Anthropic's Mythos-class model allegedly leaked on Hugging Face" claims that an unreleased Anthropic model appeared on Hugging Face. The submission's URL was removed by moderators for malware concerns, and the discussion that followed was dominated by skepticism rather than confirmation. No comment in the thread provides verified evidence that the model is genuine, and the post itself supplies no technical detail beyond the headline.

What the post claims, and what was removed

The submission is an "Ask HN"-style post by user handfuloflight that reached 32 points and 19 comments. Its body contains only a single line: "URL deleted for malware concerns." That means the original link — presumably to a Hugging Face repository — is not available in the record of the post, and readers cannot inspect the alleged upload from the submission itself.

The post does not state the model's parameter count, release status, file formats, license, or any hash or repository name. The term "Mythos-class" is used without definition in the post, and the thread does not establish what it refers to.

The dominant reaction: this is probably a malware lure

The most-upvoted comment in the thread argues the leak is fabricated and that the purpose is to get less careful users to execute malicious code.

This is almost certainly fake. A few days ago there was supposedly a Fable 5 checkpoint "up for sale on a deep web forum", now there is supposedly a Mythos-class model leaked on Hugging Face. This is just a way to get less knowledgeable people to run code (as in malware) on their machines. — @ripbozo

That comment places the claim in a pattern of similar recent rumors about other supposedly leaked model checkpoints. A second commenter compared it to an older internet practice of mislabeling files on public torrent sites to troll downloaders.

Back in the day people used to upload new movies on public torrent sites that turned out to be something completely different in order to troll people. This is probably the same. If not, this is one hell of a way to save their IPO. — @cbg0

The IPO remark is speculative commentary by the commenter; the thread contains no reporting on Anthropic's financial plans.

The counterargument: safetensors-only downloads avoid code execution

One commenter pushed back on the malware framing and supplied a repository path, arguing that the risk depends on which files a user downloads.

Link https://huggingface.co/burner22/numbat , there is no malware concern if only safetensors is downloaded. — @twigger2

This is a real technical distinction. Safetensors is a tensor-serialization format that stores weights as raw data and does not execute arbitrary Python on load, unlike formats that rely on pickle deserialization. Loading only .safetensors files avoids the classic pickle-based code-execution vector. That does not, however, make an unknown repository safe: a user still has to trust the weights themselves, any accompanying tokenizer or configuration files, and any trust_remote_code path a loading script might invoke. The thread does not establish that the linked repository is authentic, and the original submission's URL was removed for malware concerns.

The training-log detail that made one commenter pause

One commenter said the upload initially looked plausible because of an attached training log, and quoted two lines from it.

[2026-10-08T13:51:36Z step 1830001] loss=1.0550 lr=7.19012e-05 lr_phase=decay grad_norm=1.304 tokens/s=12.03M mfu=35.1% moe_balance_loss=0.0217 expert_gini=0.0231

Last line of log: [2026-10-08T14:37:21Z step 1830400] loss=1.0421 lr=7.16365e-05 lr_phase=decay grad_norm=1.266 tokens/s=11.25M mfu=32.9% moe_balance_loss=0.0218 expert_gini=0.0235

I'm still doubting it as legit. — @ache

The same commenter noted the practical barrier to verification: "May be hard to run, I don't have 8TB of RAM." The log lines reference mixture-of-experts metrics (moe_balance_loss, expert_gini) and model-FLOPs utilization (mfu), which are consistent with a large MoE training run, but a text log is trivially forgeable and the thread contains no independent corroboration of it.

The legal question raised: trade secrets, not copyright

One commenter raised the intellectual-property angle, arguing that model weights fall outside copyright and are protected, if at all, as trade secrets.

Not a lawyer, but I don't see what protection they have other than trade secrets since the weights are just data and data can't be copyrighted. — @intrasight

This is a commenter's lay opinion, explicitly framed as such, and the thread does not resolve it. It does capture the standard framing of the debate: weights are commonly treated as data rather than expressive works, which shifts protection toward contract and trade-secret law rather than copyright.

Shorter reactions

The remaining comments are jokes and one-line reactions rather than evidence. One reads the leak as an intentional release — "It was too dangerous to not release" — a reference to Anthropic's stated release philosophy. Another suggests the model leaked itself. A third asks whether Anthropic has actually gone open-weights with a "10T class model," a claim nothing in the thread substantiates. One comment was flagged and its content is not visible.

What the thread does and does not establish

The thread establishes that a Hacker News submission alleged an Anthropic "Mythos-class" model leak on Hugging Face, that the submission's link was removed for malware concerns, and that a commenter pointed to a repository named burner22/numbat while arguing safetensors-only downloads avoid code execution.

The thread does not establish that any Anthropic model leaked. No commenter verified the weights, matched them to a known Anthropic training run, or confirmed the repository's provenance. The dominant view among commenters is that the claim is a hoax or a malware lure, and the practical advice implied by the discussion is to treat unsolicited model repositories as untrusted: avoid pickle-based weight files, avoid loading scripts that require remote code execution, and treat training logs as unverified text rather than proof.