What did the leaked Claude Code source reveal?

On 30 March 2026, Anthropic published version 2.1.88 of its coding agent Claude Code on npm with a source map, a debugging file that pointed to the full TypeScript source. More than 512,000 lines of code in about 1,900 files became public. They show how the agent coordinates subagents and keeps its memory small, and they contain features that were built but switched off, such as an always-on background agent called Kairos. According to Anthropic, no customer data leaked.

How did the code get out?

An npm package normally contains only bundled, minified JavaScript. Version 2.1.88 also shipped a .map file that referenced the original TypeScript, which sat in a cloud storage bucket of Anthropic's and could be downloaded as a ZIP archive (InfoQ). Security researcher Chaofan Shou spotted it on 31 March and posted it on X. Within hours copies were on GitHub, and The Batch counted more than 40,000 forks. Anthropic pulled the package from npm.

Anthropic called it "a release packaging issue caused by human error, not a security breach" and said that no customer data or credentials were exposed (Fortune). Boris Cherny, who leads Claude Code, said it was a developer error and not a bug in Bun, the JavaScript runtime Claude Code runs on (Ben's Bites).

What leaked is the harness around the model: the code that tells the model how to use tools and which rules to follow. The model weights were not part of it (Fortune). The minified code had always been inside the package; the source map added the original file structure, variable names and comments (InfoQ). It was Anthropic's second leak in a week. On 26 March, Fortune had reported that a draft blog post about an unreleased model, Claude Mythos, sat in a publicly accessible data store.

How is Claude Code built?

Engineers who studied the code describe it as closer to "a small, dedicated operating system" than to a chatbot wrapper, The Batch reports. It is written in TypeScript, draws its terminal interface with React through the Ink library, and ships as an executable of Bun, the runtime Anthropic acquired in December 2025. From The Batch and from developer Alex Kim's reading of the code:

• Tools behind permission gates. More than 40 tools, for reading files, running bash commands or fetching web pages, each sit in their own module with a permission gate between the model and the computer. According to Kim, every bash command passes 23 numbered security checks.
• Subagents. A controller agent hands subtasks and permissions to swarms of subagents with their own tools, and each swarm shares a memory. Kim notes that the coordinator's rules live entirely in a prompt, with lines such as "Do not rubber-stamp weak work".
• Memory in three tiers. An index file, MEMORY.md, is always loaded and points to Markdown memory files that are read only when needed. JSON transcripts record file changes; they are searched and never loaded whole.
• Compaction in three stages. To stay within the context window, Claude Code first trims cached tool output locally. Near the limit it writes a structured summary of 20,000 tokens. Finally it compresses the whole conversation and adds back the files it last worked on (up to 5,000 tokens each), active plans and relevant skills. See also context compression.

Automatic compaction also turns itself off for the rest of a session after three consecutive failures. A code comment dated 10 March 2026, quoted by Kim, explains why: 1,279 sessions had 50 or more failures in a row, up to 3,272 in a single session, which wasted about 250,000 API calls a day.

Which features had not been released yet?

Several features were hidden in the published build. The Batch notes that some sat behind flags that compile to "false", a sign that they were still in progress:

• Kairos. An always-on background agent that, according to InfoQ, consolidates memory while the user is idle. Its autoDream logic merges duplicate memories, removes contradictions and prunes what is stored (The Batch). Kim found code paths for a /dream skill for "nightly memory distillation", daily logs, GitHub webhook subscriptions and a refresh every five minutes.
• Ultraplan. Sends complex planning tasks to the cloud (The Batch, InfoQ).
• Buddy. A Tamagotchi-style companion that comments on your work, with species, rarity tiers and stats such as DEBUGGING and SNARK. This one did ship: version 2.1.89 added /buddy "for April 1st" (changelog).

The code also names unreleased models. The Batch mentions Capybara, which it calls a Claude 4.6 variant, and Numbat; InfoQ adds Fennec, an Opus 4.6 variant. According to The Batch, version 8 of Capybara made false or exaggerated claims about 30 percent of the time, against 16.7 percent for an earlier version. The draft blog post from the earlier leak used Capybara as the name of a new tier above Opus, apparently for the same model as Claude Mythos, and warned that it "presages an upcoming wave of models that can exploit vulnerabilities in ways that far outpace the efforts of defenders" (Fortune). On 7 April 2026 Anthropic announced Claude Mythos Preview, which it kept out of general release and made available to the partners in Project Glasswing.

What is undercover mode?

Undercover mode lets the agent commit to public Git repositories without a signature or any other sign that it was active, The Batch reports. The newsletter suggests it may let Anthropic test unannounced models and work with unannounced partners without giving them away. According to Kim, the file that implements it tells the model never to mention internal codenames such as Capybara or Tengu, internal Slack channels, repository names or the words "Claude Code". The mode can be forced on, and a comment in the file says "There is NO force-OFF". The public build strips the function out, so the mode only works in Anthropic's internal version. The consequence, as Kim puts it: commits and pull requests that Anthropic employees make this way in open-source projects carry no sign that an AI wrote them.

What happened to the copies?

Developers ported the code to Python and then to Rust (Ben's Bites). On 31 March, Anthropic filed a DMCA notice with GitHub against one repository with the code and its forks, and GitHub applied it to the whole network of 8,100 repositories. The next day Anthropic withdrew the notice for all of them except the original repository and the 96 forks it had listed by name. Ben's Bites called the ports a copyright grey area and noted that a push to remove them could raise questions about Anthropic's own copyright issues.

What can you take from it as a developer?

For The Batch, the value of the leak is that anyone can now see how Claude Code works and may work next, and either follow its choices or deliberately make different ones. Four lessons follow from what was reported:

• Check what you publish. Bun generates source maps unless you switch them off. InfoQ lists three ways to keep them out of a package: add *.map to .npmignore, list the published files in the files field of package.json, or check the contents with npm pack --dry-run before a release.
• Keep memory behind an index. Load a short index and read the details only when a task needs them.
• Cap automatic retries. A step that keeps failing and retrying without a limit keeps costing API calls.
• Put a gate on every tool. In Claude Code, each of the more than 40 tools has its own permission check.