Anthropic has confirmed that a release packaging mistake exposed the full source code of its Claude Code CLI through a public npm package, revealing roughly 512,000 lines of TypeScript to anyone who inspected the artifact closely. According to the reported timeline, the issue centered on version 2.1.88 of @anthropic-ai/claude-code, which shipped with a 59.8 MB JavaScript source map. That debugging artifact made it possible to trace the minified production bundle back to original TypeScript sources and, in turn, locate a publicly accessible zip archive stored in Anthropic’s own Cloudflare R2 bucket.
Anthropic told VentureBeat that the incident was not the result of a hack, intrusion, or unauthorized breach. Instead, the company attributed the exposure to human error in the release packaging process. In practical terms, the code was simply published in a way that should have been prevented during build and release validation. The report notes that Bun’s bundler generates source maps by default, and that a missing exclusion step—such as an omitted entry in .npmignore or the files field of package.json—appears to have allowed the debug artifact to ship publicly.
Researcher discovery quickly turned into widespread mirroring
The issue was first spotted by security researcher Chaofan Shou, an intern at blockchain security firm Fuzzland, who posted the direct bucket link on X. Once the location became public, the source spread quickly. Within hours, mirrored repositories appeared on Github, and some reportedly accumulated tens of thousands of stars before takedown notices were issued. By that point, developers and community members had already begun inspecting the codebase, removing telemetry hooks, toggling hidden feature flags, and discussing clean-room reimplementations in languages such as Python and Rust in an effort to avoid copyright complications.
The speed of replication is a reminder of how difficult it is to contain exposed source code once a public distribution artifact has escaped into the wild. Even if the original package is fixed and repositories are removed, archived copies and mirrors can continue circulating. That appears to be the case here as well, with the report stating that the leaked source remains accessible in archived or mirrored form despite active enforcement.
What the leaked code reportedly contained
The exposed material is described as extensive: approximately 1,900 TypeScript files covering a broad swath of Claude Code’s engineering internals. The package reportedly included logic for tool execution, permission schemas, memory systems, telemetry components, system prompts, and feature flags. In effect, outside observers gained a detailed look at how Anthropic structures and operates a production-grade agentic coding assistant at the CLI level.
The report also highlighted specific implementation details that drew immediate attention. One area concerned telemetry. According to the article, the telemetry system scans prompts for profanity as a proxy signal for user frustration, but does not log full user conversations or code. Another notable internal mechanism was described as an “undercover mode”, instructing the AI to strip references to internal codenames and project details from git commits and pull requests.
Unreleased features surfaced behind internal flags
Among the most widely discussed findings were several features that had not yet been publicly released. The report says the leaked code referenced KAIROS, described as an always-on background daemon that watches files, records events, and runs a “dreaming” memory-consolidation process while the system is idle. Another hidden feature, BUDDY, was framed as a kind of terminal pet with 18 species—including a capybara—and with attributes such as DEBUGGING, PATIENCE, and CHAOS.
Two additional features pointed to Anthropic’s broader ambitions around multi-agent workflows. COORDINATOR MODE was described as enabling a single agent to spawn and manage multiple worker agents in parallel. ULTRAPLAN, meanwhile, was said to schedule remote multi-agent planning sessions lasting roughly 10 to 30 minutes. Taken together, these references suggest that Anthropic has been testing more advanced orchestration patterns inside Claude Code than are publicly visible in current releases.
Anthropic says customer data and model weights were not affected
Anthropic’s public position, as cited in the report, is that the leak did not expose sensitive customer data, secrets, credentials, model weights, or inference infrastructure. That distinction matters. While source-level visibility into a tool can reveal design choices, internal prompts, and implementation strategy, it is different in severity from the compromise of live systems or user records.
Still, the exposure is significant because source code can materially lower the barrier for reverse engineering, imitation, and competitive replication. The article’s conclusion was blunt: no user data was exposed, and the core Claude models remain unaffected, but the blueprint for building a competitor to Claude Code has become considerably easier to assemble.
Repeated operational errors raise process questions
The broader concern for observers is not only this single release mishap, but the pattern around it. The report says a nearly identical source-map leak involving an earlier Claude Code version occurred in February 2025. If confirmed, that makes this the second similar incident in roughly 13 months. Repeat occurrences of the same class of error often trigger sharper scrutiny because they suggest that lessons from the earlier event may not have been fully operationalized.
The timing also compounds the issue. Just days earlier, on March 26, a separate CMS misconfiguration reportedly exposed around 3,000 internal files related to Anthropic’s unreleased “Claude Mythos” model, again attributed to human error. Two accidental disclosures within less than a week invite questions about release hygiene, internal review gates, and configuration management at a company whose tools are increasingly used to help write, review, and ship software at scale.
Developers are urged to review supply-chain exposure
The article also connected the March 31 source leak to a separate npm supply-chain incident involving the axios package, active between 00:21 and 03:29 UTC. Developers who installed or updated Claude Code through npm during that window were advised to audit dependencies and rotate credentials as a precaution. Anthropic reportedly recommends using its native installer going forward rather than the npm distribution route.
That recommendation underscores a wider lesson for developers and security teams: even when a vendor-specific leak does not include credentials or user data, concurrent ecosystem-level package risks can turn an operational mistake into a more urgent security review event. Package provenance, reproducible builds, dependency scanning, and installer trust models all become more important in moments like this.
A leak without a breach can still have strategic impact
The Claude Code incident is a case study in how accidental publication can create consequences similar to those of a security failure, even without adversarial intrusion. Nothing reportedly had to be hacked. The code was there, publicly accessible, because a release artifact was packaged incorrectly and made available through normal distribution channels. That is a narrower claim than a full compromise, but from a strategic and reputational standpoint, the fallout can still be substantial.
For Anthropic, the immediate challenge is containment and trust restoration. For developers, the event is a cautionary reminder that source maps, package manifests, build defaults, and storage permissions are not trivial implementation details. They are part of the security boundary. A single omitted exclusion can expose years of engineering work. In this case, it also exposed internal product direction, hidden features, and the architecture of a flagship AI coding tool—without touching model weights or customer records, yet still leaving a meaningful mark on the competitive landscape.