Anthropic has confirmed that it accidentally exposed the full source code of its Claude Code CLI through a public npm package, in what the company described as a packaging mistake rather than a hack. The incident centered on version 2.1.88 of @anthropic-ai/claude-code, which included a 59.8 MB JavaScript source map. That debugging artifact reportedly pointed directly to a ZIP archive stored in Anthropic’s own publicly accessible Cloudflare R2 bucket, making the underlying TypeScript code retrievable without bypassing any security controls.
How the leak happened
According to the report, the root cause was operational rather than adversarial. The package build process appears to have shipped a source map that should never have been included in a production npm release. Source maps are commonly used for debugging, allowing minified or bundled code to be traced back to original source files. In this case, that convenience became an exposure vector. The article notes that the issue could likely have been prevented by excluding the artifact through .npmignore or by tightening the files field in package.json.
The flaw was discovered by Chaofan Shou, a security researcher and intern at blockchain security firm Fuzzland, who posted the direct bucket link on X. Within hours, mirrored repositories began appearing on GitHub. Some reportedly accumulated tens of thousands of stars before Anthropic issued DMCA takedown notices. The speed of redistribution highlights a recurring challenge in modern software leaks: once a package artifact has been indexed, mirrored, and cloned, removal becomes largely symbolic rather than comprehensive.
What was exposed
The leaked material reportedly included around 512,000 lines of TypeScript spread across roughly 1,900 files. The code base covered core implementation details for the CLI, including execution logic, permission architecture, memory systems, telemetry, system prompts, and feature flags. For developers and competitors alike, the release offered a rare look at how a production-grade AI coding tool is assembled and managed.
The report emphasizes that the exposure did not include customer data, credentials, model weights, or Anthropic’s inference infrastructure. Anthropic told VentureBeat that no sensitive user information was involved and characterized the issue as a human error in the release process. Even so, source code disclosure of this scale can still be strategically significant. It can reveal product assumptions, implementation tradeoffs, hidden workflows, and future roadmap signals that would normally remain private.
Unreleased features and internal design clues
One reason the leak drew so much attention is that it exposed several unreleased or hidden features. Among them was KAIROS, described as an always-on background daemon that watches files, logs events, and runs a memory-consolidation process called “dreaming” while idle. Another feature, BUDDY, appeared to be a terminal pet system with 18 species, including a capybara, and personality-style attributes such as DEBUGGING, PATIENCE, and CHAOS.
The code also referenced COORDINATOR MODE, which would allow a single agent to generate and supervise parallel worker agents, as well as ULTRAPLAN, a system for arranging 10- to 30-minute remote multi-agent planning sessions. Together, these elements suggest Anthropic has been exploring richer orchestration models for agent-based coding workflows, potentially extending Claude Code beyond a straightforward CLI assistant into a layered autonomous toolchain.
Additional details reportedly showed that Claude Code’s telemetry system scanned prompts for profanity as a signal of user frustration, while not logging full conversations or full user code. Another feature, referred to as a form of “stealth mode,” was designed to prevent internal codenames and project details from appearing in Git commits or pull requests generated with AI assistance.
Why the timing matters
The report says the March 31 incident coincided with a separate npm supply chain attack targeting axios, active between 00:21 and 03:29 UTC. Because of that overlap, developers who installed or updated Claude Code through npm during that window were advised to review dependencies and rotate credentials as a precaution. Anthropic reportedly recommended that users favor its native installer going forward rather than npm-based distribution.
This timing added another layer of concern. On its own, a source map exposure is a serious release engineering failure. Combined with an active supply chain attack in the same ecosystem, it raises the operational stakes for users and enterprise teams that rely on package managers as trusted delivery channels.
A repeat incident raises process questions
Perhaps more damaging than the single mistake is the fact that this was reportedly the second time a closely related source map leak had occurred. An earlier version of Claude Code was said to have suffered a nearly identical exposure in February 2025. That makes the 2026 event not just a one-off blunder but a recurrence of the same class of error within roughly 13 months.
The broader context makes the pattern more concerning. Just days earlier, on March 26, Anthropic reportedly exposed around 3,000 internal documents because of a CMS configuration mistake. Those files allegedly included details about an unreleased “Claude Mythos” model. Two substantial accidental disclosures in less than a week inevitably invite scrutiny over release discipline, internal review practices, and configuration management at a company whose tools are increasingly used to help generate and ship code at scale.
Strategic impact beyond data security
Anthropic has not, according to the report, published a fuller public postmortem beyond its comments to VentureBeat. That leaves outside observers with an incomplete picture of what safeguards failed and what controls will change. Still, the basic implications are already clear. Even when no customer records are lost and no model weights are stolen, exposing source code can materially reduce the effort required for rivals, researchers, and open-source communities to analyze, emulate, or rebuild core product behavior.
Mirrors and archives of the code reportedly remain available despite takedown efforts. That means the leak’s afterlife could extend well beyond the initial news cycle. Developers may continue mining the material for implementation insights, hidden capabilities, and architectural lessons. Competitors may gain a shortcut to understanding how Anthropic approached permissions, memory, orchestration, and telemetry in a real-world AI coding assistant.
In short, Anthropic avoided the worst-case scenario of a customer-data breach or model theft. But the company still suffered a highly consequential exposure of intellectual property, internal product strategy, and operational design. For a leading AI firm, the event is a reminder that packaging mistakes can be just as revealing as traditional intrusions—and sometimes much easier for the public to exploit.