1. WHAT HAPPENED
On March 31, 2026, Anthropic accidentally shipped the entire source code of Claude Code to the public npm registry via a single misconfigured debug file — a cli.js.map sourcemap bundled into version 2.1.88 of @anthropic-ai/claude-code. DEV Community The 59.8MB file pointed to a zip archive on Anthropic’s own cloud storage containing the full source code, with nearly 2,000 files and 500,000 lines of TypeScript. VentureBeat
Within hours, security researcher Chaofan Shou discovered the file and posted it on X. The codebase was mirrored and dissected across GitHub almost immediately. VentureBeat
Anthropic confirmed it was human error in a deploy process with manual steps. A known bug in Bun (the JavaScript runtime Anthropic acquired in late 2025) was responsible — issue #28001 had been open for 20 days before the leak, reporting that sourcemaps were being served in production builds. Nobody caught it. DEV Community
This was the second major data leak in under a week. Days earlier, Fortune reported that nearly 3,000 internal files had been found publicly accessible, including a draft blog post about an unreleased model known internally as “Mythos” / “Capybara.” Fortune
2. WHAT WAS FOUND INSIDE
Unreleased Features (8 total):
The analysis uncovered 8 unreleased features, 26 hidden slash commands, 32 build-time feature flags, and over 120 secret environment variables. The standout discoveries:
- BUDDY — A Tamagotchi-style virtual pet system giving every user a unique creature with species, rarity tiers, stats (Debugging, Patience, Chaos, Wisdom, Snark), and cosmetic hats. Planned rollout: April 1–7, 2026.
- KAIROS — An autonomous daemon mode representing a persistent assistant that operates as an always-on background agent, performing “memory consolidation” while the user is idle through a process called autoDream — merging observations, removing contradictions, and converting vague insights into structured facts. VentureBeat
- ULTRAPLAN — A 30-minute autonomous planning mode that spins up a remote cloud instance using Opus 4.6, with browser-based review and approval before execution.
- Coordinator Mode — Multi-agent orchestration where Claude becomes a manager, delegating tasks to parallel worker agents.
- Daemon Mode — Background session management (like
docker psfor AI agents). - UDS Inbox — Inter-session messaging so multiple Claude instances can communicate locally.
- Bridge — Remote control of local Claude from phone or browser (since released).
- Auto-Dream — Between-session memory consolidation triggered after 24+ hours and 5+ sessions.
Hidden Internal Mechanisms:
- Undercover Mode — A stealth system that strips all traces of AI involvement from commits when Anthropic employees contribute to open-source projects. The prompt instructs: “Do not blow your cover.” ccleaks
- Anti-Distillation — A system that injects fake tool definitions into API calls to poison competitor training data, gated behind a feature flag. ccleaks
- Frustration Regex — Claude monitors user messages for expletives to adjust its behaviour dynamically. ccleaks
- YOLO Classifier — The auto-permission system is literally called
classifyYoloAction(), with risk levels assessed by Claude evaluating its own tool use. ccleaks - Safety Bypass (ABLATION_BASELINE) — A single environment variable that disables all safety features at once for research purposes. ccleaks
- Next-gen model references — The undercover prompt warns employees never to leak “opus-4-7” and “sonnet-4-8.” ccleaks
Internal Model Roadmap:
The leak confirms that “Capybara” is the internal codename for a Claude 4.6 variant, with “Fennec” mapping to Opus 4.6 and the unreleased “Numbat” still in testing. Internal comments reveal Anthropic is iterating on Capybara v8, which still has a 29–30% false claims rate — a regression from the 16.7% rate seen in v4. VentureBeat
3. THE FALLOUT
DMCA Chaos:
Anthropic issued a DMCA takedown notice that was executed against roughly 8,100 GitHub repositories — including legitimate forks of Anthropic’s own publicly released Claude Code repo. TechCrunch Anthropic’s head of Claude Code, Boris Cherny, said the move was accidental and retracted the bulk of the notices, limiting it to one repository and 96 forks. TechCrunch
Community Explosion:
A clean-room rewrite called claw-code crossed 100,000 GitHub stars. A Python fork hit 111,000 stars and 98,000 forks in a single day — one of the fastest-growing GitHub projects in history. Community forks like OpenClaude now let users run Claude Code’s tooling with any LLM including OpenAI, Gemini, DeepSeek, and Ollama.
Supply Chain Attack (Concurrent):
A separate, unrelated supply chain attack compromised the axios npm package the same day. Users who installed or updated Claude Code between 00:21 and 03:29 UTC on March 31 may have pulled in a malicious version containing a Remote Access Trojan. VentureBeat
Security Vulnerabilities Discovered:
Days after the leak, security firm Adversa AI discovered a critical vulnerability: a malicious CLAUDE.md file could instruct Claude to generate a 50+ subcommand pipeline that bypasses all deny rules, security validators, and command injection detection entirely. SecurityWeek This could enable exfiltration of SSH keys, AWS credentials, and GitHub tokens.
Third-Party Harness Crackdown:
On April 4, Anthropic cut third-party tools like OpenClaw from subscription access entirely, requiring pay-as-you-go billing for anything outside Claude Code and Claude.ai. One-time credits of $20–$200 were offered, claimable by April 17.
4. FINANCIAL EXPOSURE
- Claude Code’s run-rate revenue had swelled to more than $2.5 billion as of February 2026. CNBC
- Enterprise adoption accounts for 80% of that revenue. ccleaks
- Anthropic’s total annualized revenue run-rate reached $19 billion as of March 2026. VentureBeat
- The botched cleanup is particularly problematic as Anthropic reportedly plans an IPO, a process that demands attention to execution and compliance. TechCrunch
5. OUTCOME & IMPACT ASSESSMENT
Competitive Impact: HIGH
The leak hands competitors a detailed unreleased feature roadmap and deepens questions about operational security at a company that sells itself as the safety-first AI lab. Axios For competitors, the internal model metrics (false claims rates, assertiveness calibration data) provide invaluable benchmarks of the ceiling for current agentic performance and highlight the specific weaknesses Anthropic is still struggling to solve. VentureBeat Every major AI lab now has a production-grade blueprint for building autonomous coding agents.
Security Impact: SEVERE
The readable source code gives attackers leverage for exploits that would otherwise take significantly more research time. Straiker The exact orchestration logic for hooks, MCP servers, and permission systems is now public knowledge. Attackers can now design malicious repositories specifically tailored to trick Claude Code into running background commands or exfiltrating data before a user ever sees a trust prompt. VentureBeat The concurrent axios supply chain attack compounded the risk for anyone who updated during the exposure window.
Reputational Impact: SIGNIFICANT
Two leaks in one week (Mythos model + Claude Code source) from a company that positions itself as the responsible, safety-first AI lab is deeply damaging to that narrative. The discovery of “undercover mode” — hiding AI authorship in open-source contributions — directly contradicts transparency values. The DMCA overreach (hitting 8,100 repos including their own forks) added a perception of panic and incompetence.
Operational Impact: MODERATE
While the leak does not include model weights, training data, or customer data, what was exposed is an operational blueprint of how the current version of Claude Code is designed to work — how it handles inputs, enforces permissions, and resists abuse. SecurityWeek Anthropic can update its harness code, rotate keys, and change feature flags, but the architectural knowledge is permanently in the open.
Long-term Strategic Impact: UNCERTAIN
The leak accelerated the open-source agentic coding ecosystem by months or years. Clean-room rewrites are DMCA-proof. The walled-garden strategy (blocking third-party harnesses, forcing pay-as-you-go) may push power users toward competitors or open-source alternatives at exactly the moment Anthropic needs to demonstrate subscriber growth for an IPO.
[AIL3]