On April 1, 2026, Anthropic confirmed that the complete source code of its Claude Code CLI tool was accidentally leaked via an npm packaging error, exposing approximately 512,000 lines of TypeScript to the public internet. The incident was discovered on March 31, 2026, by security researcher Chaofan Shou, a blockchain security intern at Fuzzland, who posted a direct link to Anthropic's Cloudflare R2 storage bucket on X. The source map file (59.8 MB) was a debugging artifact that should have been excluded from the npm package but was inadvertently included due to a missing .npmignore configuration. Within hours, mirrored repositories appeared on GitHub, some garnering tens of thousands of stars before Anthropic issued DMCA takedown requests.
Leak Details: Hidden Features and Internal Architecture Exposed
Security experts analyzing the leak found approximately 1,900 TypeScript files covering tool execution logic, permission schemes, memory systems, telemetry, system prompts, and feature flags — a complete technical view of how Anthropic builds its production agentic coding tool. Notably, the code revealed several previously unreleased features:
- KAIROS: A constantly running background daemon that monitors file changes, logs events, and triggers a memory consolidation process called "dreaming" during idle periods.
- BUDDY: A terminal pet system with 18 species (including capybara) carrying stats like DEBUGGING, PATIENCE, and CHAOS.
- COORDINATOR MODE: Allows a single agent to launch and manage parallel worker agents.
- ULTRAPLAN: Plans 10- to 30-minute remote multi-agent planning sessions.
Additionally, telemetry scans prompts for profanity as a signal of user frustration but does not record full conversations or code. "Undercover mode" instructs the AI to remove references to internal code names and project details from Git commits and pull requests. Anthropic told Venture Beat that the incident did not involve any customer data, credentials, model weights, or inference infrastructure.
Supply Chain Attack Overlap: Double Risk for npm Installers
Coincidentally, between 00:21 and 03:29 UTC on March 31, a supply chain attack targeting the axios package hit the npm ecosystem. Developers who installed or updated Claude Code via npm during this window are advised to audit dependencies and rotate credentials. Anthropic recommends using its native installer going forward. This is the second time Anthropic has suffered a source map leak — an almost identical vulnerability occurred in February 2025 involving an earlier version of Claude Code.
Second Internal Data Leak Within a Week
Just five days earlier (March 26), Anthropic exposed approximately 3,000 internal files due to a CMS misconfiguration, containing details of the unreleased "Claude Mythos" model. Two significant accidental disclosures in less than a week raise serious questions about the company's release security — especially since its tools are actively used to write and ship code at scale. Separately, a federal judge recently blocked the Pentagon from labeling Anthropic a national security threat, though that incident is unrelated to the code leak.
As of this writing, the leaked source code remains accessible via archived and mirrored copies despite active takedown enforcement. Anthropic has not published a broader root-cause analysis or public statement beyond its comment to Venture Beat. The underlying Claude models remain unaffected, but the blueprint for building a competitor to Claude Code is now substantially easier to assemble.