The most-downloaded "Qwen3.8" repository on Hugging Face declares neither licence nor origin

Yesterday we wrote that the Qwen3.8-Max announcement — “the weights will open next week” — is not yet a downloadable file. We checked again this morning: the public endpoint api/models/Qwen/Qwen3.8-Max still returns a 401, and on the Qwen organisation on Hugging Face the last model actually published dates back to 26 June 2026 — the most recent change recorded on an existing repository, on 22 July, is not a new model, it’s a card edit. Searching “Qwen3.8” on the hub anyway turns something up: two repositories from a single author, Ma7ee7, both uploaded on 30 July 2026 — four days before Qwen published its announcement. Neither is the official model: they are an independent adaptation of a different, real Qwen model from a year earlier. But one of the two, at the moment we check, has roughly 155 times the downloads of the other — and it’s the one that declares neither licence nor origin.

Two repositories, one author, two different cards

The first, Ma7ee7/Qwen3.8_4B_Distilled, is in safetensors format and has 90 downloads. The card is done properly: the frontmatter declares license: apache-2.0 and base_model: unsloth/Qwen3-4B-Thinking-2507-unsloth-bnb-4bit, and the body repeats it in plain text — “Developed by: Ma7ee7”, “License: apache-2.0”, “Finetuned from model: unsloth/Qwen3-4B-Thinking-2507-unsloth-bnb-4bit”. Everything needed to trace the source is there, stated twice.

The second, Ma7ee7/Qwen3.8_4B_Distilled_GGUF, has 13,965 downloads. Its frontmatter carries only three tags — gguf, llama.cpp, unsloth — no license field, no base_model field: the Hugging Face API returns both as empty, not as “specified elsewhere.” The body says only that “this model was finetuned and converted to GGUF format using Unsloth,” then lists the files: qwen3-4b-thinking-2507.Q4_K_M.gguf, ...Q5_K_M.gguf, ...Q8_0.gguf. There’s a Modelfile ready for Ollama, and a command that gets it running in one line: llama-cli -hf Ma7ee7/Qwen3.8_4B_Distilled_GGUF --jinja.

A repository’s name is free text, not an attestation

The name “Qwen3.8” sits in the title of both repositories. In the files — in the .gguf filenames, in the base_model declared by the first repository — a different name is written: qwen3-4b-thinking-2507. That’s a real model, published by Qwen on 5 August 2025, exactly one year before this article. “Qwen3.8” didn’t publicly exist on 30 July, when the two repositories were uploaded; it doesn’t exist as downloadable weights even today. Nobody has forged a certificate: on Hugging Face, the field that identifies a repository is a string chosen by whoever uploads it, with no check against a real model’s identity. Anyone who searches “Qwen3.8” and downloads by name is downloading that string, not a guarantee.

An empty field is not a grant

The repository with nearly fourteen thousand downloads has no licence field. That is not the same as “permissive by default”: it is the absence of any written grant at all. The sibling repository from the same author declares Apache 2.0 — but these are two distinct repositories, with two distinct sha values, and what binds whoever uses it is the text that accompanies the file downloaded, not the one attached to the repository next door. Whoever puts the GGUF package into production has no title to stand on. It’s the same problem we described yesterday for Qwen3.8-Max: a declarative gap is not the same as an authorisation, and the clauses that matter — revenue thresholds, field-of-use restrictions, revocation conditions — differ from one licence text to the next: when the text is missing entirely, there isn’t even a first line to read.

Convenience and traceability pull in opposite directions

The ready-to-run format is also the least documented one, and that’s not a one-off feature of this repository: it’s the trajectory of the steps that separate it from the original. On 5 August 2025 Qwen publishes Qwen3-4B-Thinking-2507 under an Apache 2.0 licence. The next day, Unsloth uploads a 4-bit requantisation, base_model declared, same licence. Nearly a year later, on 30 July 2026, Ma7ee7 uses it for a fine-tune and still declares everything — licence, base model. Then, a few minutes later, converts the same work to GGUF: and in those minutes the two fields disappear from the card. Three steps, three publishers, and the documentation thins out as the format becomes more convenient to run — one command, a Modelfile, no dependency to install. Where “the model is open” ends and “what actually stays installable” begins is the question the hub never asks on its own. And the chain hasn’t stopped at 30 July: as we write this, another account has already derived its own fine-tune from Ma7ee7’s repository, plus the resulting GGUF conversion. Zero downloads, for now — but the mechanism that lengthens the chain is already running, one week after another.

This is not a question of bad faith

This needs to be said without ambiguity: the safetensors repository’s card is done well, it declares licence and origin, and there is no element — not in that card, not anywhere else in this story — suggesting an intent to mislead. The name “Qwen3.8” could be a personal convention, an experiment, the habit of someone uploading many fine-tunes in the same month. This article is not about the conduct of whoever uploaded the two repositories: it is about the duty of verification of whoever downloads, and a structural flaw in model hubs, where the repository name is free text and declaring a licence is optional. Nor is it a judgement on the model: we haven’t run it, and its technical quality isn’t the point of this piece.

What to do about it

Verify that the organisation publishing is the one it claims to be: a name in a repository’s title is not the same as a verified organisation on Hugging Face.
Read the file names, not the repository name: they carry, almost always, the real name of the base model.
Treat a missing license field as a block on adoption, not a detail to fill in later.
Trace the base_model chain back to its origin, step by step, and log every intermediate publisher.
For every installed model, keep a record of licence, version, origin of the weights and verification date: the register we’ve already written about.

How we solve this

Verifying the provenance, licence and derivation chain of every model going into production — not once, at the first download, but on every update — becomes a check that runs on the client’s own systems: a register of installed models with the file’s real name, the actual licence, the base_model traced back to its origin, the date of the last verification. Ready to show an inspector, not reconstructed when someone asks for it.

The same setup brings the organisation’s scattered data — archives, business systems, documents, sensors, plant — into a single operating model on which AI agents execute decisions with a human operator in command: for large enterprises, defence, government and healthcare. We are already in the field, with systems in production across a number of enterprise organisations and beyond. In both delivery modes — on-premise on the client’s self-contained machines, which need no deep integration into the client’s network, or a dedicated cloud with a dedicated VPN and a data centre in Italy, in premises we staff directly — and always with shared governance: anyone without an in-house team to administer AI models doesn’t need to build one just to start. And the system is multi-model: the model gets swapped whenever the client wants, because the value sits in the ontology and the data, not in whichever file happens to be running today.

About to put into production a model downloaded from a third-party repository, with a name that promises more than the card declares? Thirty minutes with one of our experts: we’ll check the licence, the base_model and the derivation chain together, before it becomes the team’s habit.