Step 5 Preview Leaked: How StepFun's 600B Model Reached Hugging Face Three Weeks Early

StepFun announced Step 5 Preview on 20 September with API access the same day and open weights promised for 15 October. Less than two hours after the announcement, a 1.2 TB BF16 checkpoint of the model was sitting in a public Hugging Face account that is not StepFun's. Four days later it is in five accounts, has a 286 GB GGUF, a llama.cpp patch, a model card with benchmark charts, and a licence. Most of that was written by one person who does not work at StepFun.

We traced the copy chain through Hugging Face's commit logs and read the tensors. Here is what happened, what the files prove, and what the widely mirrored model card gets wrong.

What StepFun announced

Step 5 Preview is StepFun's new flagship: a sparse mixture-of-experts model with 600B total parameters and about 27B active per token, a 92-layer "narrow and deep" transformer, a one-million-token context, text and image input, and a built-in sparse attention scheme StepFun calls Sparse GQA with block-wise token merging. The company's own numbers, which we have not verified: 67.7 on DeepSWE v1.1, 33.3 on Terminal-Bench v4, 66.4 on FrontierFinance against 69.7 for Claude Opus 5, and a score of 44 on the Artificial Analysis Intelligence Index, which StepFun says places it in the top three open models worldwide. The API costs $1.00 per million input tokens and $2.70 per million output. Artificial Analysis independently lists the 44, at rank 32 of 210 models, along with a note that the model is unusually verbose, spending 160M output tokens on the index run against a median of 88M.

The announcement said weights would open on 15 October. It named no licence.

The timeline

Every row below comes from Hugging Face's public commit history, which records who created each repository, when, and from where. Times are UTC on 20 September unless stated.

So the sequence is not a break-in. StepFun's own staff pushed the checkpoint to the company's official repository on launch morning, the repository was public, and the first clone was made within 112 minutes. The Duplicate button on Hugging Face copies a repository server-side in seconds, without downloading anything, which is why 1.2 TB could spread across five accounts in a day. StepFun closed the door afterwards. It has said nothing in public since.

A word on who made the later copies, because their names suggest more than they are. The Manusagents account's other repositories are "abliterated" builds of Kimi K3 and Muse Glimmer 30B, with the refusal behaviour removed, and an "Uncensored" GGUF of Qwen-Image-2.1 posted two days after that model shipped. The TypeSafeAI organisation on Hugging Face has three members: that account, one named after the organisation, and one using the name of Anthropic's chief executive. There is a San Francisco company called TypeSafe AI that builds decision models; nothing on its site mentions StepFun, Step 5 or Hugging Face, and nothing ties it to this organisation beyond the name. Whatever these copies are, they are a hobbyist's, not a lab's.

What the files prove

The copies contain 26 safetensors shards, a config, the tokenizer, a chat template, and, in the later copies, the model card and images. There is no licence file and no modelling code. We checked what could be checked without downloading a terabyte, by reading the shard headers and a handful of small tensors directly over HTTP.

The architecture matches the announcement. The config declares 92 layers, 352 routed experts with 8 active per token plus one shared expert on 88 of those layers, 64 attention heads of width 192 in groups of 4, a 512-token sliding window, three next-token-prediction layers, and a maximum position of 1,048,576. Summing the shapes gives about 603B parameters for the text model. The shard index totals 1,208,684,168,984 bytes, which is 604B parameters at two bytes each. Our rough count of the active path lands near 30B; StepFun says 27B, and the difference is within what our attention estimate can resolve.

The weights are trained, not random. A forged checkpoint of this size would be cheap to produce with random numbers, so we looked at the distributions. The token embedding and output head have the tight, slightly skewed spread of a trained language model. Norm weights are not the constant ones a freshly initialised network carries; the final norm averages 0.73 with a spread of 0.07, and the first layer's input norm is centred below zero. Router biases, which StepFun uses for load balancing, range from −0.8 to +0.04 across the 352 experts, the signature of a router that has been steered during training. The vision tower's layer norms are equally worn in. None of this proves the files are Step 5 Preview rather than some other 604B StepFun checkpoint, but a fake is ruled out.

It is a StepFun model. The tokenizer and special-token map are byte-identical to the ones StepFun ships with Step-3.5-Flash. The config is Step-3.5's design scaled up: the same 4,096 hidden size, the same 128,896-token vocabulary, the same 512 sliding window, the same three prediction layers, with the head width grown from 128 to 192, the expert count from 288 to 352, and the depth from 45 to 92 layers. Twenty-three of the layers carry the sparse-attention indexer tensors the announcement describes.

What the files do not prove

Nobody has published a comparison of the leaked weights' outputs against StepFun's API, and the only runnable build changes the attention, see below. Until someone with eight H100s runs both side by side, "the weights are real" means "a real 604B StepFun model with the announced architecture", not "produces the API's answers". That is probably the same thing. It is not yet shown to be.

The licence that does not exist

The model card that four of the five copies now carry says Step 5 Preview is released under the "StepFun Community License", links to a LICENSE file in the repository, and summarises its terms: commercial use permitted with attribution, autonomous weapons and surveillance prohibited. The link returns 404. There is no LICENSE file in any copy. The original clone from StepFun's repository had no README at all, so every word of the licence section was written by the mirror's maintainer on the evening of the leak.

The same card's config references a Python file for the model class that is also absent, so the checkpoint cannot be loaded with the code path the card documents.

This matters because StepFun's licence for Step 5 is genuinely unknown. Its earlier open models, Step-3.5-Flash, Step-3.7-Flash and Step3-VL, are Apache 2.0. Whether the October release keeps that or moves to a research licence, as Qwen did with Qwen-Image-2.1 this week, is StepFun's to announce. A model card that invents the answer, and that has been mirrored as if official, is the most misleading artefact of the whole episode.

The GGUF that is not the model

The 286 GB Q3_K_M GGUF comes with a 207-line patch to llama.cpp that reuses the existing Step-3.5 graph and the Step3-VL vision encoder. Its own notes say it was verified end to end, BF16 conversion to Q3_K_M to loading and generating text. They also say the sparse-attention indexer is dropped for a dense-attention fallback and that outputs "differ from the reference until the indexer is implemented". So the one thing a home user could conceivably load is a three-bit quant of a model with its signature attention mechanism removed. It will talk. It is not Step 5 Preview.

Can you run it anyway?

No, and the arithmetic is worth a paragraph because it will not change on 15 October. In BF16 the weights are 1.2 TB, which StepFun's own hardware table puts at eight H100s. FP8 halves that to about 600 GB, INT4 to about 300 GB. The three-bit GGUF is 286 GB. A dual GB10 pair has 256 GB between the two boxes and needs room for a KV cache on top. An RTX 5090 has 32.

The only route on consumer hardware is the expert-streaming approach that put a 502 GB DeepSeek-V4.1-Flash on one 5090 at five tokens a second, and that took a purpose-built llama.cpp fork and a month of measurement for a model half this size. Step 5 Preview at 27B active parameters is a mixture of experts in the same family, so it is not impossible in principle. Nobody has done it, and the announced release is what any such work should wait for.

Bottom line

• The leak was an open door. StepFun's own account pushed the checkpoint to its public repository on launch day; the first copy was made 112 minutes later, server-side, with one button.
• The weights are real and trained, with the announced architecture and StepFun's tokenizer. Whether they reproduce the API's outputs has not been tested.
• The licence in the mirrors is fiction. No LICENSE file exists. StepFun's terms for Step 5 are unannounced; its previous models are Apache 2.0.
• The GGUF is a different model, with the sparse attention removed and outputs that its own author says differ from the reference.
• Nothing here runs at home, at 286 GB and up. The 15 October release is the one to plan around.

Related reading

• DeepSeek V4.1 Flash on Nvidia 5090? — what it takes to stream a 502 GB model on one card, and why 1.2 TB is a different problem
• Mixture of Experts (MoE), Explained — why 27B active out of 600B is the number that decides where it can run
• Best Model for a Dual DGX Spark — the 256 GB class, and why it still is not enough here
• Qwen-Image-2.1 on RTX 5090 and 4090: VRAM, INT8, and the New Licence — the other open-weights licence story of the week, this one real