On March 31, 2026, Anthropic accidentally leaked the full source code of its Claude Code CLI tool via a public npm package, exposing approximately 512,000 lines of TypeScript code. The leak was caused by an included JavaScript source map file in the release package, which mapped minified production code back to the original TypeScript and directly pointed to a publicly accessible zip archive stored on Anthropic's Cloudflare R2 bucket. Security researcher Chaofan Shou, an intern at blockchain security firm Fuzzland, discovered the issue and posted the direct link on X. Within hours, mirrored repositories appeared on GitHub, some garnering tens of thousands of stars before Anthropic issued DMCA takedown requests.
Root Cause: Human Error and Default Configuration
Anthropic confirmed to Venture Beat that the incident resulted from a human error in the packaging process. The Bun package manager generates source maps by default, and the pre-publication build step failed to strip this debugging artifact. A simple entry in the .npmignore file or the files field in package.json would have prevented the leak. This marks the second time Anthropic has made the same mistake, following a nearly identical source map leak in February 2025.
Leaked Content: Unreleased Features and Internal Mechanics
The leak comprised roughly 1,900 TypeScript files covering tool execution logic, permission schemas, memory systems, telemetry, system prompts, and feature flags—a complete technical blueprint of how Anthropic builds a production-grade agentic coding tool. Among the hidden features revealed: KAIROS (a persistent background daemon that monitors files, logs events, and runs memory consolidation processes called 'dreaming' during idle time), BUDDY (a terminal pet with 18 species including capybara, carrying stats like DEBUGGING, PATIENCE, and CHAOS), COORDINATOR MODE (allows a single agent to spawn and manage parallel worker agents), and ULTRAPLAN (plans 10-to-30-minute remote multi-agent planning sessions). Telemetry scans prompts for profanity as a signal of frustration but does not record full user conversations or code. 'Undercover mode' instructs AI to remove references to internal code names and project details from Git commits and pull requests.
Second Leak in a Week Erodes Trust
Just five days earlier, on March 26, 2026, a misconfigured CMS at Anthropic exposed approximately 3,000 internal files containing details about the unreleased 'Claude Mythos' model—also attributed to human error. Two significant accidental disclosures in less than a week raise serious questions about the company's release security, especially as its tools are actively used to write and ship code at scale. Anthropic stated that no customer data, credentials, model weights, or inference infrastructure were compromised, and it is implementing measures to prevent recurrence. However, the developer community has already begun extracting telemetry data, toggling hidden feature flags, and preparing clean-room reimplementations in Python and Rust to avoid copyright issues.
Concurrent Supply Chain Attack and Recommendations
The npm leak coincided with a separate supply chain attack targeting the axios package between 00:21 and 03:29 UTC. Developers who installed or updated Claude Code via npm during this window are advised to audit dependencies and rotate credentials. Anthropic recommends using its native installer instead of npm going forward. As of press time, the leaked source code remains available on archived and mirrored sites despite active DMCA enforcement. Separately, a federal judge blocked the Pentagon from labeling Anthropic a national security threat, ruling that such designation likely violated the First Amendment—adding to the company's mounting legal and security challenges.