Tragic mistake... Anthropic leaks Claude’s source code

A leaked source map file accidentally shipped with an npm release exposed Claude Code’s full readable TypeScript source—over 500,000 lines—turning a closed, “safety-first” product into a blueprint for competitors overnight. Within minutes of the discovery, mirrors and clones spread widely, and Anthropic issued DMCA takedowns only after the code had already been replicated across the internet.

The key technical trigger was straightforward: security researcher Chiao Fan Sha found that version 2.1.88 of the Claude Code MPM package included a 57 MB source map file. Source maps are typically used only during development to map compiled code back to its original source; build pipelines usually strip them out for production. The transcript links the packaging mistake to Claude Code’s reliance on Bun.js—recently acquired by Anthropic—and notes a GitHub issue from weeks earlier about Bun.js serving source maps in production. Whether that issue was the root cause or a separate developer error, the result was the same: a “holy grail” artifact made the entire codebase readable.

Once the source became public, the leak shifted from a security incident to an intelligence windfall. The code reportedly relies on Axios, which the transcript ties to a separate claim of compromise by North Korean hackers—raising the prospect of supply-chain risk if the dependency were exploited in Anthropic’s environment. More broadly, the system was portrayed as an engineered prompt-and-tool pipeline rather than a mysterious leap in AI capability: the workflow from input to output is described as a multi-step process (11 steps), with hard-coded instructions and guardrails embedded as large strings.

Several “anti-distillation” mechanisms drew attention. The transcript claims Claude Code includes poison-pill behavior designed to mislead competitors training on its outputs—by referencing tools that supposedly exist but don’t. It also highlights a major bash-command parsing and execution component (over a thousand lines), framing it as a central capability of an AI coding assistant.

Other features described in the leaked instructions include “undercover mode,” which aims to keep Claude from mentioning itself in commit messages or outputs to reduce code-name leakage. The transcript also points to a “regex frustration detector” that scans prompts for keywords and logs events when users appear unhappy, plus unusually heavy commenting—interpreted as material intended for the AI to generate or refine its own coding workflow.

Finally, the leak allegedly exposed feature names and roadmap hints under feature flags, including “Buddy” (a customizable Tamagotchi-style companion), references to “Opus 4.7,” and a new model name “Capiara,” alongside “ultra plan,” “coordinator mode,” and “demon mode.” A “Chyus” capability is described as a background journaling agent using “dream mode” to consolidate memories on a schedule.

For Anthropic, the fallout is framed as a major setback ahead of an IPO timeline. The incident also reinforces a broader lesson: even highly guarded systems can become effectively open-source if a single build artifact—like a source map—slips into a public npm package.