Ornith-1.5-397B: licence declared, the file still missing for the third time in three days
7 min read
On 18 August 2026, within the space of an hour, the ornith-ai organisation’s Ornith-1.5 family appeared on Hugging Face — three base sizes, 9B, 35B-A3B and the model we’re writing about, ornith-ai/Ornith-1.5-397B, plus their respective FP8, GGUF, MLX and NVFP4 quantised builds, twenty-five repositories in total. The API’s createdAt for the 397B: 2026-08-18T06:34:59Z; last modified 2026-08-20T02:23:15Z, the day before our check. We queried it ourselves on 21 August: 672 downloads, 65 likes, 137 files in the repository, of which 122 .safetensors shards. Declared tags: transformers, safetensors, qwen3_5_moe, image-text-to-text, text-generation, conversational, license:mit, eval-results, region:us. Who is Ornith? The organisation’s page shows 5 users, 25 models, is not verified (isVerified: false), and has 2,637 followers — with no information on its registered office, legal form or funding: not there, not on the ornith.ai website, not in the post the card cites as its source, signed only “Ornith Team”.
Three hundred and ninety-seven billion parameters, a cluster to run them
The API’s safetensors field declares 396,802,360,816 parameters in BF16: at 2 bytes each, 793.6 GB of weights alone — consistent with what the card itself says: “Ornith-1.5-397B is a ~397B mixture-of-experts model (≈800 GB in bf16), so multi-GPU serving is required.” config.json confirms the Qwen3_5MoeForConditionalGeneration architecture: 60 layers, 512 routed experts, 10 activated per token, plus a shared expert, hidden_size 4096. The README doesn’t state how many parameters stay active per token: only the structure of the expert system, not the final count — unlike other open-weight models that publish that figure explicitly. The declared context is 262,144 tokens, i.e. 256K, not 262K, extendable with YaRN to roughly a million with a scaling factor of 4.0. config.json also carries a full vision_config (a 27-layer encoder), but the README neither documents nor demonstrates it: the card describes text and agentic use only.
To serve it, the card specifies “8-way tensor parallelism on a single node (e.g., 8× H200 141GB)” — or FP8/INT4 quantised builds for smaller deployments; it also requires recent runtimes (Transformers ≥5.8.1, vLLM ≥0.19.1, SGLang ≥0.5.9). The card also offers a comparison — “performing on par with Claude Opus 4.8 (85.0 and 59.0) while outperforming leading open-source models of similar scale, including GLM-5.2 and DeepSeek-V4-Flash-0731” — on benchmarks such as Terminal-Bench 2.1 (86.1) and SWE-bench Verified (86): figures from the card, calculated by whoever published the model, not verified by us.
The declared licence, the file still missing for the third time in three days
Here begins the line-by-line check. The public tag is license:mit, confirmed by cardData.license. The README goes further: in its YAML front matter it also declares license_link: https://huggingface.co/ornith-ai/Ornith-1.5-397B/blob/main/LICENSE — a precise link, not a generic pointer. We opened it: HTTP 404. We then looked for every variant the platform uses for this file — LICENSE, LICENSE.md, LICENCE, NOTICE, USE_POLICY.md — 404 on all five, checked on both the page and the raw endpoint. None of the repository’s 137 files carries that name. A second document narrowing use — a usage policy, an acceptable-use notice — doesn’t exist: the README contains none of those phrases, only technical start-up instructions.
This isn’t an isolated case, and that’s why we’re writing about it. On 19 August it was Ant Group’s Ling-3.0-tiny: MIT licence in the tags, no file in the repository. On 20 August, Tencent’s UI-Mate-27B: Apache 2.0 declared, the text findable only on GitHub, not in the weights repository. Today, the third consecutive day, the same pattern — made worse by a link that points to a specific file and still doesn’t exist. This is no longer an isolated incident from a single lab: it’s a practice we have now verified across three repositories from three different publishers in three days. We also checked the sibling repository ornith-ai/Ornith-1.5-35B-A3B, published ten minutes earlier: the same license:mit declaration, the same absence of all five files. It isn’t an isolated case even within the same model family — unlike, by contrast, the case where the file was there in full.
Gated false, verified without credentials
The gated field is false. Verified without authenticating: config.json under resolve/main returns a 307 redirect to the public cache, not a 401; the API responds 200, private: false. We also tried the links the card promises — the chat_template.jinja file cited in the text, the sibling GGUF repository for Ollama and llama.cpp, the ornith.ai/ornith_1_5.html post cited as the source of the benchmarks: all return 200. We found no hosted version of Ornith-1.5-397B, on the site or elsewhere, offering functions absent from the weights: unlike Ling-3.0-tiny, also reachable via a free endpoint on OpenRouter, no equivalent service verified by us exists here.
The perimeter, not just the download
Downloadable weights without the compute that makes them runnable aren’t sovereignty: here the compute is anything but negligible. An 8-GPU H200 cluster isn’t an expense a department approves without anyone knowing — but downloading the weights is, and that’s the first step that needs to leave a trace. The question isn’t whether a company can afford the hardware: it’s whether, once it can, someone has recorded under which licence it downloaded those 793.6 GB, from which organisation — one whose registered office, in this case, we don’t even know — and with what authorisation to distribute it further within the perimeter. The same discipline we ask for the technical report a model card ought to provide before installation applies here: the artefact’s version and digest, channel and date of acquisition, licence archived in the text of the day — not recalled from memory months later, when a link may still return today’s same 404 — and the approved uses, with who approved them.
What we don’t know
We haven’t run the model: no claim about quality, behaviour or reliability. The benchmark scores reported are those the card declares, not verified by us. We don’t know the parameters activated per token, which the README doesn’t state. We don’t know what data it was trained on or who is legally answerable for it: the organisation’s page lists no registered office, company or funder. We make no legal qualification, AI Act included. We don’t know whether a LICENSE file will appear in the repository in future, nor whether today’s broken link will be fixed: what we report is the state verified on 21 August 2026.
See the service · Talk to an engineer
The register, applied to this case
Complying: for a model like this, the register can’t stop at name and declared licence. It has to record that the licence link the README itself cites returns 404, the date we checked it, and the confirmation that no second restricting document exists — with the dated record ready to show an inspector, a client in a tender, or a board, regardless of whether the organisation that published the model ever answers a request for clarification.
Deciding: the same system brings models, data, contracts, archives and documents together into a single operating model, on which AI agents execute decisions with a human operator in command, for large enterprises, defence, government and healthcare. The bigger a model gets — here, nearly 800 GB of weights alone, an eight-GPU cluster to serve it — the greater the temptation to trust the label without checking the file behind the label: that’s precisely the opposite of what a serious register has to do. Always in two modes, on-premise on the client’s own self-contained machines, or dedicated cloud with a dedicated VPN and a data centre in Italy, always with shared management.
From the first session, at no cost, comes the dated register of the models you have in service: for each one, the licence archived in the text of the day it was downloaded, not a link that might already return an error. It stays yours even if we don’t go on to work together.