Anthropic accidentally exposed the full source code of its Claude Code CLI after shipping a public npm package that included a 59.8 MB JavaScript source map. According to the reported details, the issue affected version 2.1.88 of @anthropic-ai/claude-code and ultimately revealed around 512,000 lines of TypeScript, giving outside observers a detailed look at how the company’s production coding assistant is built.
Anthropic told Venture Beat on March 31, 2026 that the incident was the result of human error in the release packaging process, not a hack or unauthorized intrusion. The source map, a debugging artifact that maps minified production code back to original source files, reportedly pointed directly to a publicly accessible zip archive hosted in Anthropic’s own Cloudflare R2 storage bucket. In practical terms, no attacker needed to breach infrastructure to retrieve the code; the files were simply left exposed through the release workflow.
How the leak was discovered
The problem was reportedly identified by Chaofan Shou, a security researcher and intern at blockchain security firm Fuzzland. After the direct bucket link was shared on X, mirrored copies quickly appeared on Github. Some repositories reportedly gathered significant attention before takedown requests under the DMCA began to hit. By then, members of the developer community had already started examining the codebase, removing telemetry hooks, toggling hidden feature flags, and discussing clean-room reimplementations in other languages such as Python and Rust.
The root cause appears straightforward. The article states that Bun’s bundler generates source maps by default, and Anthropic’s release process failed to exclude that debug artifact before publication. A missing configuration entry in .npmignore or the files field of package.json would likely have prevented the exposure entirely. That makes this less a story about a sophisticated exploit and more a case study in release hygiene and package management discipline.
What the exposed code revealed
Developers analyzing the leaked material reportedly found roughly 1,900 TypeScript files covering core parts of the Claude Code CLI, including tool execution logic, permission schemas, memory systems, telemetry, system prompts, and feature-flag infrastructure. The leak offered what the report described as a full engineering view into how Anthropic structures a production-grade agentic coding tool.
One notable detail involved telemetry. The exposed code suggested that prompts are scanned for profanity as a signal of user frustration, while full conversations and code are reportedly not logged. Another feature described in the report was an “undercover mode”, designed to strip references to internal codenames and project details from git commits and pull requests.
The leak also surfaced several unreleased or hidden features. These included KAIROS, described as an always-on background daemon that watches files, logs events, and performs a “dreaming” style memory consolidation process while the system is idle. Another flagged feature, BUDDY, appeared to be a terminal pet system with 18 species, including capybara, and personality or gameplay-style stats such as DEBUGGING, PATIENCE, and CHAOS.
Additional features cited in the report included COORDINATOR MODE, which would allow a single agent to spawn and manage parallel worker agents, and ULTRAPLAN, a framework for scheduling 10- to 30-minute remote multi-agent planning sessions. Taken together, these details offer a glimpse into Anthropic’s direction for more persistent, collaborative, and multi-agent coding workflows.
Anthropic says no customer data or model weights were exposed
Anthropic emphasized that the incident did not expose sensitive customer data, login credentials, model weights, or inference infrastructure. That distinction is important. While the leak may be embarrassing from an operational and competitive standpoint, the company’s statement suggests the event did not become a direct compromise of user privacy or core model security.
Still, even without customer data involved, the exposure has obvious strategic consequences. Source code at this level of detail can reveal design philosophy, engineering tradeoffs, internal controls, and product direction. It may also lower the barrier for competitors or open-source developers seeking to understand, emulate, or selectively reimplement elements of Claude Code’s architecture.
A repeat mistake raises bigger questions
The report notes that this is not the first time Anthropic has suffered a similar leak. A nearly identical source-map exposure reportedly affected an earlier Claude Code version in February 2025. If accurate, the 2026 incident marks the second occurrence in roughly 13 months, suggesting that the underlying process weaknesses were not fully corrected after the first event.
The timing also adds pressure. Just days earlier, on March 26, 2026, a separate CMS misconfiguration reportedly exposed around 3,000 internal files related to the unreleased Claude Mythos model, with that issue also attributed to human error. Two accidental disclosures in less than a week inevitably raise questions about release management, internal controls, and the company’s broader operational discipline.
Concurrent supply-chain concerns for npm users
The article further notes that the Claude Code packaging incident overlapped with a separate npm supply-chain attack on the axios package, active between 00:21 and 03:29 UTC on March 31. Developers who installed or updated Claude Code through npm during that period were advised to audit dependencies and rotate credentials as a precaution. Anthropic reportedly recommended using its native installer going forward instead of the npm distribution path.
That overlap does not mean the Anthropic leak and the axios incident were the same event, but it does complicate the risk environment for developers who relied on npm during the affected window. Even when a vendor confirms that no user data or credentials were directly exposed in its own mistake, adjacent supply-chain events can increase the need for defensive checks.
The code may remain available despite takedowns
Although Anthropic has moved to remove mirrors and archives, the report says the leaked codebase continues to circulate in archived and mirrored forms online. That is a familiar reality once source code spreads across public repositories and developer channels: takedown efforts may reduce visibility, but they rarely guarantee complete removal.
At the time described in the source material, Anthropic had not published a broader public post-mortem beyond its media comment. In the absence of a detailed technical write-up, outside observers are left with a limited but still revealing picture: no user data loss, no model-weight compromise, but a major self-inflicted disclosure of product internals. For the market, the incident underscores a recurring lesson in modern software distribution—small packaging oversights can have outsized consequences, especially when they expose the blueprint of an advanced AI developer tool.
In short, the Claude Code leak was not a classic breach, but it may still prove consequential. The company’s models remain unaffected, according to its statement. Yet the engineering map behind one of its coding products is now far easier for the public to study, analyze, and potentially build upon.