On March 31, 2026, the AI community woke up to a surprising incident: Anthropic, one of the most well-funded and closely watched AI safety companies in the world, had accidentally exposed the full source code of its popular coding tool, Claude Code. The leak was not the result of a cyberattack or a sophisticated intrusion. It was, in the company’s own words, “a release packaging issue caused by human error.”

In this article, we will walk through exactly what happened, what was inside the leaked code, why it matters, and what the broader implications are for the AI industry.

What is Claude Code?

Before diving into the incident, it helps to understand what Claude Code actually is. Claude Code is an agentic AI coding assistant that runs directly in the terminal, allowing software developers to build features, fix bugs, navigate codebases, and automate complex development tasks with natural language instructions.

It is not a simple autocomplete tool. Claude Code operates with a degree of autonomy: it can read files, execute bash commands, manage entire projects locally, and communicate with external services through integrations. Since its public release in May 2025, it has seen enormous adoption, particularly among enterprise engineering teams.

As of early 2026, Claude Code had reached an annualized recurring revenue of over $2.5 billion, with enterprise customers accounting for around 80% of that figure. It is arguably Anthropic’s most commercially significant product, which makes the events of March 31 all the more consequential.

How did the leak happen?

The technical cause of the leak is straightforward. Anthropic published version 2.1.88 of the @anthropic-ai/claude-code package to the public npm registry, which is the standard package registry that JavaScript and Node.js developers use to install and update tools. Bundled inside this routine update was a 59.8 MB JavaScript source map file named cli.js.map.

A source map file is a debugging artifact that maps compiled or minified production code back to the original, human-readable source code. It is intended strictly for internal use during development. In this case, the source map contained references to unobfuscated TypeScript source files and pointed directly to a publicly accessible zip archive stored in Anthropic’s own Cloudflare R2 storage bucket.

No hacking was required. The file was simply there, accessible to anyone who knew where to look.

Note: A misconfigured .npmignore file or an incorrect files field in package.json is all it takes to accidentally bundle sensitive internal files into a public package. This is a known risk in JavaScript packaging, and one that standard CI/CD checks are designed to prevent.

Security researcher Chaofan Shou, an intern at Solayer Labs, was the first to spot the exposure and post about it publicly on X (formerly Twitter). His post, which read “Claude Code source code has been leaked via a map file in their npm registry!”, accumulated over 28 million views within hours. The AI and security communities moved quickly: mirrored repositories appeared on GitHub almost immediately, some accumulating tens of thousands of stars and forks before Anthropic’s DMCA takedown notices could make a dent.

What was actually inside the leak?

The zip archive contained approximately 1,900 TypeScript files totaling over 512,000 lines of code. This was not the underlying Claude AI model itself (the model weights were not exposed), but rather the “agentic harness” that wraps around the model and instructs it how to behave, use tools, manage context, and interact with a developer’s environment.

Here is a breakdown of the most significant components that were exposed.

The system prompt

Perhaps the most immediately surprising finding was that Claude Code’s system prompt, the master instruction set that governs how the model reasons and acts during a coding session, was baked directly into the CLI’s distributed package. This is notable because system prompts are typically considered closely guarded intellectual property. Having it embedded in a distributed binary, even an obfuscated one, is an unusual architectural choice that raised eyebrows in the developer community.

44 hidden feature flags

Researchers digging through the source quickly identified 44 feature flags covering capabilities that are fully built but not yet publicly released. These are not prototypes or experiments. They are compiled, functional code sitting behind flags that are set to false in external builds. Anthropic essentially had an unreleased roadmap sitting inside every developer’s local Claude Code installation.

KAIROS: Background autonomous mode

One of the most talked-about unreleased features carries the internal name “KAIROS,” from the Ancient Greek concept meaning “at the right time.” Mentioned over 150 times across the source files, KAIROS represents a shift from reactive to proactive AI assistance.

In KAIROS mode, Claude Code runs as an always-on background daemon. When the user is idle, it enters a process called autoDream: the agent consolidates memory, removes logical contradictions from its working context, merges disparate observations, and converts vague insights into concrete facts. When the user returns, the agent’s context is clean, focused, and ready. This is a significant architectural departure from how most AI coding tools work today.

Anti-distillation mechanisms

Another discovery that generated considerable discussion was a feature flag called ANTI_DISTILLATION_CC. When enabled, Claude Code sends a special parameter in its API requests that instructs the server to silently inject fake, decoy tool definitions into the system prompt. The intent is clear: if a competitor is recording Claude Code’s API traffic in order to train a rival model on it, the fake tools pollute that training data and reduce its usefulness.

There is also a second anti-distillation mechanism that operates server-side, summarizing the assistant’s text between tool calls and returning a cryptographically signed summary rather than the full output.

Architecture of the agentic harness

Beyond individual features, the leak gave the broader developer community a detailed look at how a production-grade AI agent is actually engineered. Key components visible in the source include:

  • A query engine that manages LLM API calls, streaming responses, retry logic, and token counting.
  • A tools system enabling capabilities like file reading, bash execution, and web search.
  • A multi-agent orchestration layer that can spawn sub-agents to handle parallel or complex tasks.
  • A bidirectional communication layer connecting the CLI to IDE extensions and browser interfaces.
  • A self-healing memory architecture designed to manage and compress long-running context windows.

References to an unreleased model

Security researchers also found multiple references throughout the codebase to a model internally named “Capybara,” which aligns with earlier reporting by Fortune that Anthropic had inadvertently exposed internal documents referring to an upcoming model called both “Mythos” and “Capybara.” Analysis of the leaked code suggested the new model may come in fast and slow variants and will feature a significantly larger context window than current Claude models.

A concurrent and more urgent security threat

While the source code leak captured most of the public attention, security researchers flagged a separate and arguably more immediately dangerous incident that occurred the same day.

Between 00:21 and 03:29 UTC on March 31, 2026, the popular npm package axios, an HTTP client that Claude Code uses as a dependency, was the target of a supply-chain attack. Malicious versions (1.14.1 and 0.30.4) were briefly published to npm containing a cross-platform Remote Access Trojan.

Developers who installed or updated Claude Code via npm during that specific window may have pulled in the compromised axios version without knowing it. Anyone in that window is advised to immediately check their lockfiles (package-lock.json, yarn.lock, or bun.lockb) for those specific axios versions or for the dependency plain-crypto-js. If found, the host machine should be treated as fully compromised, all credentials and secrets rotated, and a clean OS reinstallation performed.

In response, Anthropic has designated its native installer as the recommended installation method going forward. Instead of using npm, developers can install Claude Code using:

This approach uses a standalone binary that does not rely on the npm dependency chain and therefore is not vulnerable to npm supply-chain attacks.

Anthropic’s official response

Anthropic confirmed the incident and issued a consistent statement across multiple media outlets.The full statement, as shared with The Register, reads:

“Earlier today, a Claude Code release included some internal source code. No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We’re rolling out measures to prevent this from happening again.”

The company moved quickly to pull the affected npm package and issued DMCA takedown notices targeting GitHub repositories that had mirrored the source code. However, given how rapidly the code spread (the repository was forked over 80,000 times before takedowns could take effect), enforcement has faced significant practical limitations.

The original uploader of the code voluntarily repurposed their GitHub repository to host a Python feature port of Claude Code rather than Anthropic’s source directly, citing concerns about legal liability.

This is not the first time

What makes this incident harder to dismiss as a one-off is the context surrounding it. This is the second time the same source-map mistake has occurred. A nearly identical leak involving an earlier version of Claude Code happened in February 2025, making this the second such incident in just over a year.

Further compounding the situation, the source code leak came just five days after Fortune reported that Anthropic had inadvertently exposed approximately 3,000 internal files through a CMS misconfiguration. Those files included a draft blog post detailing the company’s upcoming “Mythos/Capybara” model and its cybersecurity implications.

Two significant accidental disclosures in under a week, from a company that markets itself as the safety-first AI lab, has prompted uncomfortable questions about operational security and release engineering discipline.

There is also a potential technical explanation for this specific leak. Anthropic acquired the JavaScript runtime Bun at the end of 2025, and Claude Code is built on top of it.A Bun bug filed on March 11, 2026 (issue oven-sh/bun#28001) reports that source maps are served in production mode even though Bun’s own documentation states they should be disabled in production. If this bug was a contributing factor, Anthropic’s own toolchain shipped a known, unresolved issue that ultimately exposed their own product.

Fun fact: The leaked source code reportedly contains an extensive regex filter filled with swear words, used to detect negative sentiment in user prompts. Someone at Anthropic has a sense of humour.

What are the broader implications?

The leak has ramifications on several levels, and it is worth thinking through each of them.

For competitors

The most obvious implication is competitive. Claude Code is a $2.5 billion ARR product, and its source code now serves as a publicly available engineering blueprint. Rivals, from large incumbents to startups building in the AI coding space, now have direct visibility into the architectural decisions, feature roadmap, and implementation strategies that Anthropic spent considerable time and money developing. The code itself can be refactored and the specific implementations changed. The strategic surprise, however, cannot be un-leaked.

For Anthropic

Beyond competitive exposure, Anthropic faces a more subtle but significant risk. Features like KAIROS and the anti-distillation mechanisms were presumably intended to be shipped with a degree of strategic timing and positioning. That is no longer possible. Competitors can now see exactly what is coming, prepare their own responses, and potentially ship similar capabilities first.

There is also the question of intellectual property. While Anthropic has clarified that the leaked code is not open source and that redistributing or using it in other projects constitutes a license violation, enforcement against thousands of forks across dozens of platforms is a difficult proposition.

For developers and the broader community

For developers, the leak offers an unusually transparent window into how a professional, large-scale AI agent is actually built. The architectural patterns visible in the source (context management strategies, multi-agent orchestration, tool integration, memory consolidation) have real educational value for anyone building in this space.

For the AI industry

Perhaps the most important takeaway is the reminder that AI companies are software companies, and software companies are susceptible to the same operational risks as everyone else. The narrative around AI labs often focuses on the sophistication of their models and the ambition of their research. Incidents like this are a reminder that basic software engineering hygiene (secure CI/CD pipelines, proper package configuration review, dependency auditing) matters just as much.

Key takeaways

The Claude Code source leak is a significant event for the generative AI field, and there are a few clear lessons we can take from it.

  • Well-resourced AI companies are also not immune to mundane engineering mistakes. A single misconfigured packaging file is all it took to expose half a million lines of proprietary code.
  • The npm ecosystem’s openness, which is a strength for the developer community, is also a meaningful attack surface. The concurrent axios supply-chain attack on the same day underscores that developers should audit their dependencies and diversify away from npm-based installations where possible.
  • The leaked feature roadmap (KAIROS, persistent memory, multi-agent orchestration at scale) gives us a useful preview of where agentic AI tooling is heading: toward always-on, context-aware, autonomously operating developer assistants. That future is closer than most public product announcements have suggested.
  • The incident raises a question worth sitting with: if the company building tools to automate and improve software engineering ships two significant accidental disclosures in a single week, what does that tell us about the current state of operational maturity in the AI industry at large?