The incident began on 2026-03-31 UTC 04:23. Security researcher Chaofan Shou discovered that the NPM package for Claude Code v2.1.88 contained a 59.8MB source map (previous versions were ~17MB), pointing to a publicly accessible src.zip on Cloudflare R2 — even after the npm package was taken down, anyone who knew the URL could still download all the source code. This dual exposure path was overlooked in most analyses.
@tvytix extracted 4,756 source files from it. The GitHub mirror created by Korean developer Sigrid Jin surpassed 50K Stars within two hours, and the clean-room Python rewrite claw-code ultimately broke 100K Stars, likely setting a GitHub growth record. The code entered IPFS — at this point, permanently public.
This was Anthropic's second accidental information leak within five days, and the second identical source map incident in 13 months. This goes beyond "individual human error" and points to systemic process deficiencies.
Injecting "fake tools" into the API to poison intercepted traffic, inserting cryptographic signature digests between tool calls. But analysts noted both layers of protection can be easily bypassed with environment variables or man-in-the-middle proxies — a company that brands itself on "AI safety" had its anti-distillation publicly verified for the first time as performative.
A 90-line code module instructs the AI to hide Anthropic internal codenames (Capybara, Tengu) in external repositories. When employees submit code to open-source projects, AI traces are systematically erased. When you see a commit from a "human developer," it may have been AI-assisted, and you'd have no way of knowing.
Identifying user frustration relies on simple regex, not LLM reasoning. Speed and cost trumped technical elegance — this engineering decision reflects the real priorities of AI product design.
Source code references 150+ times: background Daemon that continues running after terminal closes, periodic <tick> prompts + GitHub Webhook subscriptions + nighttime memory distillation (autoDream) + ULTRAPLAN for up to 30 minutes of deep thinking. The most sensitive competitive intelligence, fully visible to all competitors.
QueryEngine.ts at nearly 50K lines — the reason for bypassing the official SDK is that the SDK has an O(n²) performance issue. A company's flagship product doesn't dare use its own public tool library. This detail reflects the "say one thing, do another" reality of AI engineering more authentically than any architecture diagram.
The community fed the leaked source code to OpenAI Codex for analysis and discovered that after autoCompact fails, it retries infinitely with no failure count limit — source code comments recorded a maximum of 3,272 consecutive failures, each one burning the user's token quota.
Three lines of code.
This directly corresponds to what Anthropic concurrently admitted — that "users hit usage limits faster than expected." Developers' long-standing complaint of being "rate-limited after two uses" was partly caused by this bug burning tokens in the background. After the patch, users' quota usage returned to normal.
The most ironic part: this bug was discovered using OpenAI's Codex in Anthropic's leaked source code — a competitor helping you find bugs is perhaps the most darkly humorous form of collaboration in the AI industry.
vibe coded garbage can generate
$2.5 billion in annualized revenue in less than a year — as long as product-market fit is there. — BUILD.MS · ON THE LEAKED SOURCE
Almost all mainstream analyses focused on feature discoveries. But the security team at Concret.io and The Register's follow-up investigation pointed to an underappreciated dimension: Claude Code's data collection scope far exceeds what a "coding assistant" reasonably needs.
Every Read, every Bash, every search result is stored locally in plaintext JSONL, and transmitted back with user ID, organization UUID, and email as metadata. Data retention periods are scattered across five different policy documents — the security page says "limited retention," while the privacy center says "up to seven years."
Even more alarming is the architectural-level remote control capability: feature gates hot-reload hourly without user interaction. Combined with the exposed CHICAGO module (screenshots/keyboard/clipboard/system-level file access), there is a dynamic gap between "the terms agreed to at installation" and "actual runtime behavior".
A corporate risk blind spot that almost all analysts overlooked: when developers use personal free accounts to process company code, consumer terms apply rather than enterprise agreements. Anthropic's data protection follows the account, not the code — enterprise DPAs are effectively void in this scenario.
The DMCA takedown action mistakenly hit approximately 8,100 legitimate forks. But the real story isn't about enforcement intensity — it's about the self-contradiction in legal logic.
CEO Dario Amodei once hinted that a significant portion of Claude Code was written by Claude itself. Build.ms sharply pointed out the double standard: Anthropic claims "AI rewrites don't constitute infringement" when training Claude, but after the Claude Code leak claims "AI rewrites do constitute infringement".
This isn't just an Anthropic problem. It exposes the entire AI industry's legal infrastructure deficit — when AI is both the author of code and the "laundering tool" for code, the "author" concept in copyright law needs to be completely rewritten.
The Chinese developer community strongly resonated with the 3,000-line, 12-level nested "shit mountain code" in src/cli/print.ts. But this isn't mockery — it's a challenge to a deep-seated belief in the developer industry:
The correlation between code quality and product success is far lower than engineers are willing to admit.
Comparative evidence: Codex and Gemini Code Assist's underlying code has always been open source, yet it never threatened Claude Code's market position. If code being public meant losing competitiveness, those two products should have won long ago. The real impact of the leak is perceptual, not technical.
The real moat lies in the combination of model capability + inference cost + cloud infrastructure + brand trust — not in 510K lines of TypeScript. Engineer's Codex further noted: Claude Code only enables 15-20 tools by default, and this deliberate tool minimalism may be the key to its UX advantage over competitors.
An article on DEV Community raised a question framework that shouldn't be easily dismissed:
oven-sh/bun#28001)The most ironic part is the Undercover mode itself: Anthropic specifically wrote 90 lines of code to prevent internal information from leaking through code contributions, then leaked all their source code through a file they forgot to exclude from the npm package. A company that built a dedicated anti-leak system was brought down by the most basic release configuration.
We'll most likely never get a definitive answer. But the question itself reveals a new reality: in the AI industry's information environment, the distinction between "accident" and "information operation" is increasingly difficult to make, and this indistinguishability is itself a strategic asset.
510K lines of TypeScript will eventually be forgotten. But the conversations it sparked have only just begun:
Anthropic saw its process vulnerabilities and the fragility of the "AI safety company" label. Competitors saw a complete engineering blueprint, but also had to face an awkward truth — Claude Code's market position rose rather than fell in the week after the leak. The open-source community was forced to re-examine "who writes code." Regulators (if they were paying attention) saw the real permission scope of AI tools on developers' machines — far exceeding the "coding assistant" positioning in public discourse.
And the AI industry as a whole saw a more fundamental signal: when your product is an autonomous agent with system-level permissions, the risk checklist for "code leaks" has expanded from traditional "loss of trade secrets" to "public scrutiny of capability boundaries". This is an entirely new kind of exposure — it's not the code that's running naked, it's the intent.