If you follow extreme experiments with open models, Qwen has already appeared as an unexpected platform. The same researcher who previously placed a RISC-V CPU inside the model's weights has now published QwenPU: an NPU compiled into the weights of Qwen 3.5-4B, capable of running stories260k, Andrej Karpathy's small LLM, with no external tools. The code is on GitHub, the weights on Hugging Face.

The technical point is radical. stories260k is a C program. To run it inside Qwen, the author compiled an NPU into the outer model's weights, able to perform matmul, softmax, and attention in bit-exact fashion. The nested model's matrices reside in Qwen's own memory, with no calls to separate runtimes. This is not emulation in the traditional sense: it is a computing machine encoded as patterns of activations and weights, existing only when Qwen processes tokens.

The first implication is not performance, but the redrawing of the boundary between model and execution platform. A 4-billion-parameter LLM is used as a computational substrate, not only as a text generator. Anyone managing self-hosted deployments knows that each additional component — inference server, NPU runtime, orchestration — increases the attack surface and operational complexity. Here the execution logic is embedded in the same model artifact. There are no external dependencies. For those evaluating on-premise deployments, this introduces a trade-off between fewer dependencies and model capacity; AI-RADAR discusses these frameworks at /llm-onpremise.

The second implication is second-order: open model weights become a distribution vector for software that runs only during inference. Today stories260k is an experiment; tomorrow the same pattern could encapsulate compliance filters, parsers, or small automations inside self-hosted models, without additional containers. But it also carries risks: a system nested inside weights is harder to inspect than a separate executable; audit and maintenance change in nature.

The author said he is sick and that the full writeup is still in progress, with optimizations and size reductions ongoing. It is a human detail that makes the project even more interesting: the demonstration is already public, but the full reasoning will arrive later. In the meantime, QwenPU raises a more uncomfortable question than it seems: if an LLM can run another LLM, when does it stop being a model and become a computer? For those building local stacks, the answer is no longer a theoretical exercise.