Anthropic accidentally exposed the full source code of its Claude Code CLI after publishing a public npm package that included a debug artifact linking back to the original TypeScript files. The incident reportedly involved about 512,000 lines of code and centered on version 2.1.88 of @anthropic-ai/claude-code, which shipped with a 59.8 MB JavaScript source map file. That file pointed to a publicly accessible zip archive hosted in Anthropic’s own Cloudflare R2 storage bucket.
According to Anthropic, this was not a breach in the conventional sense. The company told VentureBeat that the exposure resulted from a human packaging mistake during release preparation, not from a hack or unauthorized intrusion. Security researcher Chaofan Shou identified the issue and posted the direct bucket link on X, after which mirrored repositories quickly appeared on GitHub before DMCA takedowns began rolling out.
What the leak contained
Developers who reviewed the material said the archive included roughly 1,900 TypeScript files spanning tool execution logic, permission schemas, memory systems, telemetry, system prompts, and feature flags. In effect, the leak offered a detailed look at how Anthropic engineers a production-grade agentic coding tool.
The report also said the telemetry system checks prompts for profanity as a sign of user frustration, while not storing full conversations or user code. Another notable detail was a so-called “secret mode” designed to instruct the AI to remove internal codenames and project references from Git commits and pull requests.
Unreleased features surfaced in the code
The exposed code also revealed several features that had not yet been publicly released. One of them, KAIROS, was described as an always-on background daemon that watches files, logs events, and runs a dream-like memory consolidation process during idle time. Another, BUDDY, appeared to be a terminal pet system with 18 species, including a capybara, and stats such as DEBUGGING, PATIENCE, and CHAOS.
Other hidden capabilities reportedly included COORDINATOR MODE, which allows one agent to spawn and manage parallel worker agents, and ULTRAPLAN, a system for scheduling multi-agent remote planning sessions lasting 10 to 30 minutes. Together, these details gave observers an unusually clear preview of Claude Code’s internal roadmap and design philosophy.
Company response and broader concerns
Anthropic said the incident did not expose customer data, credentials, model weights, or inference infrastructure. Even so, the leak has raised fresh questions about release hygiene because this was reportedly the second similar source map exposure involving Claude Code, following an earlier incident in February 2025.
The timing added another layer of concern. The March 31 exposure overlapped with a separate npm supply-chain attack affecting the axios package between 00:21 and 03:29 UTC. Developers who installed or updated Claude Code through npm during that window were advised to audit dependencies and rotate credentials. Anthropic has also recommended using its native installer instead of npm going forward.
The broader context matters as well. Just days earlier, on March 26, a CMS misconfiguration at Anthropic reportedly exposed around 3,000 internal files tied to the unreleased “Claude Mythos” model. Two significant accidental disclosures in less than a week have intensified scrutiny of the company’s operational controls. While user data and core Claude models were not compromised, the leak has undeniably made it easier for outsiders to study—and potentially replicate—the structure of Anthropic’s coding assistant stack.