Anthropic Claude Code Leak: A Deep Dive into the Source Code and Its Implications
The digital world often operates with an illusion of control, a carefully curated facade over complex systems. On March 31, 2026, that facade briefly crumbled for Anthropic, one of the leading AI companies, when the entire source code for its command-line interface (CLI) tool, Claude Code, became inadvertently public. This wasn't a malicious hack, but rather a simple oversight, amplified by developers' natural curiosity and the pervasive interconnectedness of online platforms.
Source: Own illustration
Quick Summary: Key Takeaways from the Claude Code Leak
The accidental leak of Anthropic’s Claude Code source code has unveiled critical insights and raised important questions. Here's a brief overview:
- What Happened? On March 31, 2026, the source code for Anthropic’s CLI tool, Claude Code, was accidentally made public via an npm registry Source Map file. This marks the third time Anthropic has made this error.
- Scope of the Leak: The leak comprised 1,906 proprietary TypeScript files, totaling over 512,000 lines of code, offering a full blueprint of the client-side tool.
- Anthropic's Response: The company swiftly removed the problematic npm package, confirmed the unintentional leak, and stated that no sensitive customer data or login credentials were compromised. They attributed it to a packaging error caused by human oversight.
- Key Discoveries: The code revealed a sophisticated three-tiered "Self-Healing Memory" architecture, an autonomous "KAIROS" daemon mode for background operations, and internal model codenames like "Capybara" (Claude 4.6) and "Fennec" (Opus 4.6).
- Controversial Features: An "Undercover Mode" was discovered, designed to mask the AI origin of contributions to public open-source repositories. A "Buddy" system, a Tamagotchi-like terminal pet, was also found.
- Security Implications: The leak increases the risk of attackers crafting malicious repositories. A concurrent `axios` npm package compromise also posed a threat to users who updated Claude Code via npm during a specific window.
- Recommendations: Users are advised to switch to the Native Installer, verify lockfiles for malicious `axios` versions, rotate API keys, and adopt a zero-trust approach in unfamiliar environments.
Unpacking the Anthropic Claude Code Leak
On March 31, 2026, the source code for Anthropic's CLI tool, Claude Code, was accidentally made public, a fact widely reported by outlets like The Register. The core of the issue was a Source Map file, which was inadvertently published on the npm registry, as detailed by The Decoder. The discovery was first publicly reported by security expert Chaofan Shou on X (formerly Twitter).
Source: usethebitcoin.com
Security expert Chaofan Shou initially reported the accidental public release of Anthropic’s Claude Code source code, bringing the incident to public attention.
Immediately following this revelation, a complete snapshot of the codebase surfaced in a public GitHub repository titled instructkr/claude-code, a fact verified by dev.to. This mirrored code was substantial, containing roughly 1,900 files and totaling over 512,000 lines, according to Heise.
Claude Code is designed as a command-line tool, enabling developers to interact with Anthropic's AI models using natural language, as reported by Silicon Republic. It assists with tasks like editing files or executing commands. Source Maps, typically used for debugging, help link compressed code back to its original source files, as dev.to explains. When these files are accidentally included in published packages, they can expose the full, unminified source code. In this specific incident, the 59.8 MB JavaScript Source Map file (.map) within version 2.1.88 of the `@anthropic-ai/claude-code` package pointed directly to its unminified TypeScript sources, according to dev.to. A faulty package configuration during the npm publishing process is believed to be the root cause of this exposure.
Anthropic responded swiftly, removing the problematic package version from the npm registry and replacing it with a clean version that lacked the exposed Source Maps. A company spokesperson confirmed the unintentional code leak, reassuring the public that no sensitive customer data or login credentials had been compromised. Anthropic characterized the incident as a packaging issue caused by human error, not a security vulnerability, and stated that measures were being implemented to prevent similar occurrences in the future.
What makes this leak particularly noteworthy is that it marks the third time Anthropic has made this precise error with Source Maps in the npm registry, as reported by The Register. An earlier version of Claude Code faced a similar exposure in February 2025; Anthropic addressed it by removing the old version and Source Map. However, the problem resurfaced in version 2.1.88 in 2026. The technical root cause appears to be a documented bug (oven-sh/bun#28001) in the Bun bundler, which generates Source Maps by default unless explicitly disabled, leading to repeated incidents if not properly configured.
Implications and Unexpected Discoveries in the Anthropic Claude Code
The extensive leaked code, comprising 1,906 proprietary TypeScript source files, offered an unprecedented window into Anthropic's internal architecture. It laid bare intricate details about their API design, telemetry analysis systems, encryption tools, and inter-process communication protocols. While user data and AI model weights remained unexposed, this newfound transparency of Anthropic's internal workings provides significant insights for competitors and introduces new security considerations for users.
Self-Healing Memory and KAIROS Daemon
One of the most striking revelations from the leak is Anthropic’s sophisticated three-tiered memory architecture, explicitly designed to tackle "context entropy." Unlike traditional "save everything" retrieval methods, Claude Code employs a unique "Self-Healing Memory" system, as detailed by dev.to. This system relies on `MEMORY.md`, a lightweight index of pointers (roughly 150 characters per line) that is consistently loaded into the model’s context. Crucially, this index stores memory locations, not the actual data itself. The true project knowledge is distributed across "topic files," which are retrieved only when needed. Raw transcripts are never fully re-read; instead, they are "grep'd" for specific identifiers. A "Strict Write Discipline" ensures that the agent updates its index only after a successful file write operation, preventing the model's context from being polluted by failed attempts. The code also explicitly confirms that Anthropic’s agents are instructed to treat their own memory as merely a "hint," requiring verification against the actual codebase before proceeding with any action.
The leak also brought to light "KAIROS," an autonomous daemon mode mentioned over 150 times throughout the source code, as detailed by dev.to. KAIROS operates as a constantly active background agent, meticulously managing background sessions and utilizing a process called "autoDream." While the user is inactive, "autoDream" performs "memory consolidation," a sophisticated process that merges disparate observations, resolves logical contradictions, and transforms vague insights into concrete facts. This background maintenance ensures the agent's context remains clean and highly relevant for the user’s return. A forked subagent handles these tasks, critically preventing these routine maintenance operations from corrupting the main agent's "train of thought."
Internal Model Roadmap
The leaked code also offered a glimpse into Anthropic's internal model roadmap. "Capybara" was revealed as the internal codename for a Claude 4.6 variant, while "Fennec" is associated with Opus 4.6. "Numbat" represents a model still in the testing phase. Internal comments within the code indicated that Anthropic was already working on Capybara v8, which showed a significant 29-30% rate of false claims—a regression from the 16.7% rate observed in v4. To counteract this, an "Assertiveness Counterweight" feature aims to prevent the model from becoming overly aggressive during refactoring processes, highlighting Anthropic's efforts to balance performance with accuracy.
Here's a quick look at the model codenames revealed:
| Codename | Associated Model/Status | Notes |
|---|---|---|
| Capybara | Claude 4.6 variant | Internal comments indicate v8 has 29-30% false claim rate (regression from 16.7% in v4). |
| Fennec | Opus 4.6 | — |
| Numbat | Model in testing phase | — |
| Tengu | Attestation functionality | — |
Undercover Mode and Buddy System
One ethically questionable feature brought to light is the "Undercover Mode," as highlighted by dev.to. This mode suggests Anthropic uses Claude Code for "stealth" contributions to public open-source repositories. The system prompt explicitly warns the model: "You are operating UNDERCOVER... Your commit messages... MUST NOT contain any Anthropic internal information. Do not reveal yourself." This logic ensures that no model names (like 'Tengu' or 'Capybara') or AI attributions appear in public Git logs, effectively masking the automated nature of the contributions. Crucially, there is no way for a user to forcibly disable this Undercover function.
❝ You are operating UNDERCOVER... Your commit messages... MUST NOT contain any Anthropic internal information. Do not reveal yourself. ❞
Source: red-gate.com
A code snippet explicitly warns the model about its "Undercover Mode" operation, instructing it to avoid revealing any internal Anthropic information in public commit messages.
Additionally, the code exposed the "Buddy" system, a Tamagotchi-like terminal pet with statistics like CHAOS and SNARK, designed to increase user engagement, also discovered by dev.to. The species names are encoded to bypass automated code reviews, adding another layer of obscurity to its internal functionality.
Source: etsy.com
The Buddy system is a Tamagotchi-like terminal pet, featuring stats like CHAOS and SNARK, designed to enhance user engagement with Claude Code.
Security Risks and Recommendations for Claude Code Users
The Claude Code source code leak presents heightened security risks for both individual users and corporate customers. With the detailed blueprint of the tool’s inner workings now public, attackers could craft malicious repositories designed to trick Claude Code into executing background commands or even exfiltrating data. Compounding this, a separate supply-chain attack on the `axios` npm package occurred concurrently, just hours before the Claude Code leak. This means that if Claude Code was installed or updated via npm between 00:21 and 03:29 UTC on March 31, 2026, a malicious version of `axios` (either 1.14.1 or 0.30.4) containing a Remote Access Trojan (RAT) might have been installed on users’ systems.
Affected users should immediately review their project lockfiles (such as `package-lock.json`, `yarn.lock`, or `bun.lockb`) for the presence of these suspicious `axios` versions or the `plain-crypto-js` dependency. If any are found, the host machine should be considered compromised. All secrets must be rotated, and a clean operating system reinstallation should be performed to ensure full remediation.
Installation Best Practices
Moving forward, it is highly advisable to transition from npm-based installations to the Native Installer for Claude Code, which can be accessed via `curl -fsSL https://claude.ai/install.sh | bash`. The Native Installer uses a standalone binary, making it immune to the volatility of the npm dependency chain. It also supports automatic background updates, crucial for receiving security patches (likely version 2.1.89 or later). If maintaining the npm installation is unavoidable, users should uninstall the now-compromised version 2.1.88 and explicitly pin their installation to a verified secure version, such as 2.1.86.
curl -fsSL https://claude.ai/install.sh | bashFurthermore, a zero-trust posture is recommended when using Claude Code in unfamiliar environments. Avoid running the agent within freshly cloned or untrusted repositories until the `.claude/config.json` file and any custom hooks have been manually reviewed for suspicious elements. Anthropic API keys should be rotated frequently via the developer console, and usage patterns should be continuously monitored for any anomalies, providing an additional layer of security.
Frequently Asked Questions (FAQ)
What exactly was leaked?
The leak comprised the entire source code for Anthropic's command-line interface (CLI) tool, Claude Code. This included 1,906 proprietary TypeScript files, totaling over 512,000 lines of code, covering internal API design, telemetry systems, encryption tools, and inter-process communication protocols.
Were any sensitive user data or AI models compromised?
According to Anthropic, no sensitive customer data, login credentials, or core AI model weights were compromised in this incident. The leak primarily exposed the client-side implementation of the Claude Code tool.
How did the leak happen?
The leak occurred due to an inadvertently published Source Map file within version 2.1.88 of the `@anthropic-ai/claude-code` package on the npm registry. A faulty package configuration during the npm publishing process, possibly related to a bug in the Bun bundler, is believed to be the root cause. This is the third time Anthropic has made this specific error.
What are the most significant findings from the leaked code?
Key discoveries include a sophisticated three-tiered "Self-Healing Memory" architecture, an autonomous "KAIROS" daemon mode for background memory consolidation, internal model codenames (e.g., "Capybara" for Claude 4.6), and an "Undercover Mode" designed to mask the AI origin of code contributions to public repositories.
What are the security risks for users?
The public availability of the source code could allow attackers to craft malicious repositories that trick Claude Code into executing commands or exfiltrating data. Additionally, a concurrent compromise of the `axios` npm package means users who updated Claude Code via npm during a specific window (March 31, 2026, 00:21 to 03:29 UTC) might have installed a malicious version of `axios` containing a Remote Access Trojan (RAT).
What should Claude Code users do to protect themselves?
Users should transition from npm-based installations to the Native Installer. Immediately check project lockfiles for malicious `axios` versions (1.14.1 or 0.30.4) or the `plain-crypto-js` dependency. If found, consider the machine compromised, rotate all secrets, and perform a clean OS reinstallation. Adopt a zero-trust approach, review configuration files, and frequently rotate Anthropic API keys.
Conclusion
The accidental public exposure of Anthropic's Claude Code source code vividly underscores the persistent challenges inherent in software development and deployment, particularly within the rapidly evolving AI landscape. While Anthropic asserts that no sensitive user data or crucial AI model weights were compromised, the leak provides competitors with an exceptionally detailed blueprint of Claude Code's internal workings, including its sophisticated memory management and complex multi-agent workflows, as comprehensively reported by dev.to. Beyond competitive insights, it also raises critical security concerns for end-users, highlighting the absolute necessity for vigilance and adherence to best practices in managing software dependencies. This incident serves as a stark reminder that even a single, seemingly minor misstep in a configuration file can expose months of proprietary work and send significant ripples throughout the technical community.