> status: mostly fine. patch anyway.practical AI security · est. 2026

Calm down. · Both

Calm down: the "Claude Fable 5" weights for sale are public catalog data and a header that won't load

By alkizz ·

At 6:59 PM ET on Oct 30, Dark Web Informer posted on X what screenshots show as a forum listing by a seller called "localizer," whose account joined in Oct 2026 and has one post. The seller claims to have one shard of Anthropic's Claude Fable 5, model-00638-of-00640.safetensors at "~7.0 GiB," and says the full model is about 8 TB in 640 shards. The claimed source is "a misconfigured AWS S3 bucket tied to Bedrock" in eu-north-1, and the claimed reason there's only one shard is that the owners "reconfigured it due to our poor network connection." So 639 shards got away because the internet was slow. Price is by PM, it's negotiable, and the pitch is "This can be used for distilling."

That sounds like the end of the AI industry, and it's getting the treatment: the post had 144,750 impressions and 834 bookmarks when it was pulled at 10:02 PM ET. But when you look at the "proof," it's a public AWS catalog entry, a file header the standard safetensors loader would reject, and a listing that was already posted on another forum on Oct 27. As of 10:18 PM ET tonight, neither Anthropic nor AWS has said anything about Bedrock weights or S3. Calm down.

Claimed vs. confirmed

What the listing says What the sources say
These are Claude Fable 5 weights The name is real, and that's the problem: it's public, so it's easy to borrow. AWS's model card gives the ID anthropic.claude-fable-5, says it launched Jun 9, 2026, and lists eu-north-1 (Stockholm). AWS's launch blog says it was available "in the US East (N. Virginia) and Europe (Stockholm) Regions." Anthropic's models overview now lists it under "Legacy models (still available)," behind Claude Fable 5.1.
Here's the "index JSON" Its fields (batchSupported, consoleIDEMetadata, converse, invokeExample and friends) are the shape of a Bedrock ListFoundationModels model summary, the output Qualys documents. Any account with Bedrock access can make that call. The filename is just the public foundation-model ARN, arn:aws:bedrock:<region>::foundation-model/<id> per AWS's API reference, with the : and / stripped out. It also has no tensor-to-shard map, which is what an index is for.
The JSON describes Fable 5 It doesn't match Fable 5's documented specs. It offers a manual reasoningConfig with budgetTokens and a maxTokensMaximum of 64000. AWS says Fable 5's "adaptive thinking is always on and cannot be disabled," with 128K max output, and Anthropic says manual budget_tokens thinking is "not accepted on later models" than the 4.6 generation. Our read is that it's an older Claude 4.x catalog entry with Fable text pasted in, but on its own that's an inference, not proof.
Here's the shard's header The safetensors format is an 8-byte length, a JSON header and then raw bytes, so anyone can write one. The dump's length prefix decodes to a 260,504-byte header, and most of the tensors visible in it use dtype "0C_28FF", which isn't one of the dtypes safetensors defines. The stock loader would reject it. The shapes and offsets do add up (1 byte per element for the "0C_28FF" tensors, 4 for the one F32 tensor), so whoever made it took some care.
It came from a misconfigured S3 bucket tied to Bedrock AWS says Bedrock deep-copies provider models into a "Model Deployment Account … owned and operated by the Amazon Bedrock service team" (data protection docs), and it describes Bedrock Mantle as giving "protection for model weights." The only Bedrock path that puts safetensors in a customer's own S3 is Custom Model Import, which is for open architectures like Llama, Mistral and Qwen, caps imported weights under 200 GB (100 GB for multimodal models) and isn't offered in eu-north-1.
It's a fresh leak A search-engine snippet of a BreachForums-style mirror, bf[.]st (we didn't visit it), shows the identical listing by "localizer" dated Oct 27. The screenshot Dark Web Informer shared shows a forum labeled "Pwned" dated Oct 29. So the X post is at least the second airing of a three-day-old listing. The listing doesn't even agree with itself on the "index JSON": its text says 30.2 KiB, but the seller's own file listing shows 8.1 KiB.
The shard is real We can't confirm that, because nobody can check without the file, and we're not getting it. We also didn't find any credible researcher or outlet verifying or debunking this specific listing.
The full model is ~8 TB in 640 shards Claimed, and we can't confirm it either way, since Anthropic doesn't publish parameter counts or checkpoint sizes. The seller's numbers don't agree with each other, though: 8 TB over 640 shards averages 12.5 GB, but shard 638 of 640 is supposedly 7 GB, and sharding normally fills each file to a fixed size until the last one.

We've seen this many times before

This happens all the time. Dark web posts that are old or recycled get dressed up as new, then amplified for clicks and giggles, and big "leak" claims have a habit of shrinking once someone actually checks the sample. The correction never seems to travel as far as the scary post.

There's also an Anthropic-flavored one. In April 2026, a "ShinyHunters" persona on BreachForums[.]rs offered "Claude Mythos" internal data for $300K–$500K. Threat intel firm Underdark.ai said in a LinkedIn post that the proof was "generic UI mockups … a classic scam pattern" and that a former member had flagged the persona as a scammer. That's one firm's assessment and we haven't seen it verified elsewhere, but the shape is familiar: new persona, famous model name, proof you can't check and a price by PM.

And don't mix this up with Anthropic's real incidents this year, none of which has been reported to involve weights. In April, SiliconANGLE reported unauthorized access to Mythos Preview through a third-party vendor environment, with "no indication" that Anthropic's own systems were affected. The Mar 31 Claude Code source map leak exposed no model weights, according to Zscaler, and Trend Micro reports that Anthropic said no customer data or credentials were exposed. And for October's Cathedral intrusion, an aggregator reports that Anthropic confirmed limited sales, HR and IT access with weights, source and conversations not accessed. We haven't opened the primary reporting behind that one.

What it means

Don't trust garbage, validate claims for yourself. Everything is moving so quickly now that you have to be extra skeptical of claims that pop up online.

The rush to be first and get clicks can actually make everything harder for defenders, researchers, and the general public, because some board member reads a breaking headline and activates resources based on it, diverting those resources from actual security work.

The boring lesson

A dark web "leak" about a vendor you use is an intel lead, not an incident. The useful question isn't whether some brand-new account with one post has 7 GB of Anthropic's weights. It's whether anything of yours is sitting where that story says the weights were: a public bucket, or a key that works for whoever finds it. Threat actors don't need frontier weights to hurt you when an open bucket or a leaked Bedrock key will do.

What to do:

Anthropic's Bedrock weights don't sit in customer accounts, so there's nothing on their side for you to rotate unless your own artifacts or keys turn up.

Sources

Related

On the checklist

More briefs

← All briefs