$2.5B Codebase Leaked. Reveal of Claude Code Files

Hey!

You know that feeling when someone spends years building something locked-down and secretive — and then accidentally leaves the front door wide open?

That’s exactly what happened to Anthropic on March 31, 2026.

One day before April Fools’ Day, they shipped the entire source code of Claude Code to the public npm registry inside a routine update. By morning, 512,000 lines of proprietary TypeScript were live on GitHub, being forked tens of thousands of times, and analyzed by basically every developer on the internet.

Not a hack. Not a breach. A misconfigured .npmignore file.

And what developers found inside was... a lot. Hidden features nobody knew existed. An internal model roadmap. A subsystem specifically designed to prevent Anthropic’s secrets from leaking — inside a codebase that just leaked.

We went deep on this one. Here’s everything that matters for you.

How It Happened

Claude Code is built with Bun as its JavaScript bundler. Bun generates debug .map files by default unless you explicitly turn that off. Nobody did. So version 2.1.88 shipped with a 59.8MB source map that pointed directly to a complete ZIP of Anthropic’s original TypeScript — sitting in a public Cloudflare R2 bucket with zero access controls.

At 4:23am ET, an intern at Solayer Labs named Chaofan Shou spotted it, posted a download link on X, and the race was on.

Boris Cherny — the creator of Claude Code, who we’ve covered before — confirmed it publicly on X: plain human error. His follow-up:

Mistakes happen. As a team, the important thing is to recognize it’s never an individual’s fault. It’s the process, the culture, or the infra.

Anthropic’s official line:

No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach.

The brutal irony? The leaked code contained a whole subsystem called Undercover Mode — designed specifically to stop Anthropic’s internal information from leaking. They built an AI feature to prevent leaks. Then leaked their own source code through a config file.

The GitHub Chaos (Real Links)

yes, he renamed it to claw code to avoid legal actions

The community response was instant — and permanent.

Sigrid Jin, a Korean developer, woke up at 4am. He ported the full architecture to Python from scratch using OpenAI’s Codex, and pushed claw-code (~~Claude Code~~) before sunrise. Legally untouchable by DMCA. 100,000+ stars.

The repos worth bookmarking:

• 🐍 Python rewrite (DMCA-proof): github.com/instructkr/claw-code
• 🦀 Rust breakdown + technical deep-dive: github.com/Kuberwastaken/claurst
• 📋 All system prompts for all major models: github.com/asgeirtj/system\_prompts\_leaks
• 🔄 Live Claude Code prompt tracker: github.com/Piebald-AI/claude-code-system-prompts
• 📄 Anthropic’s DMCA takedown: github.com/github/dmca/…/2026-03-31-anthropic.md

What Was Inside

1. KAIROS — The 24/7 Background Agent Nobody Knew About

Hidden behind feature flags PROACTIVE and KAIROS is a fully built, never-announced autonomous agent mode.

KAIROS runs 24/7. Every few seconds it gets a heartbeat prompt: “anything worth doing right now?” It can fix errors, update files, send messages, run tasks — without you initiating anything.

• 📱 Push notifications — reaches you on your phone when the terminal is closed
• 📦 File delivery — sends you files it created without being asked
• 🔀 PR subscriptions — watches your GitHub and reacts to code changes autonomously

At night it runs a process the codebase literally calls autoDream — consolidating everything it learned and reorganizing its memory.

44 hidden feature flags total. 20+ unshipped features: multi-agent coordination, cron scheduling, voice command mode, browser control via Playwright, agents that sleep and self-resume.

2. Undercover Mode — Anthropic Contributing to Open Source Anonymously

undercover.ts — 90 lines — injects a system prompt that strips all traces of AI involvement from commits and PRs.

You are operating UNDERCOVER in a PUBLIC/OPEN-SOURCE repository. Your commit messages, PR titles, and PR bodies MUST NOT contain ANY Anthropic-internal information. Do not blow your cover. NEVER include... The phrase ‘Claude Code’ or any mention that you are an AI.

• ✅ Only Anthropic employees can activate it (USER_TYPE === 'ant')
• ✅ It’s dead code in your Claude Code build — you cannot turn it on
• ✅ The primary goal is preventing internal codenames from leaking into public commits, not some grand cover-up

But the effect is still that Anthropic’s open-source contributions don’t disclose AI authorship.

3. The Memory Architecture That Actually Solves Context Problems

The leaked source shows exactly how Anthropic solved “context entropy”. The system is built around MEMORY.md:

• A lightweight index of pointers (~150 chars per line), always loaded into context
• The index stores where things are, not the things themselves
• Actual knowledge lives in topic files fetched on demand
• Transcripts are never re-read fully — only grep’d for specific identifiers
• Strict write discipline: the index only updates after a confirmed successful file write

If you’re building with n8n, MCP servers, or your own agent workflows — this architecture is worth stealing directly.

4. The Model Roadmap Anthropic Never Meant to Publish

• 🦸 Capybara (Mythos): Version 8. 1M context — and a 29–30% false claims rate, up from 16.7% in v4. That’s a regression.
• 🦡 Numbat: Tagged @[MODEL LAUNCH]: Remove this section when we launch numbat — a future release baked into the source.
• 🦊 Fennec: Widely speculated to be Opus 4.6.
• 👺 Tengu: The codename Undercover Mode was designed to hide.

We already mentioned this leak last week (omg, second leak in less than 7 days!)

5. Anti-Distillation: Poisoning Competitors’ Training Data

API requests include anti_distillation: ['fake_tools'] flags — injecting decoy tool definitions into system prompts to poison competitor training data.

A second layer compresses Claude’s reasoning cryptographically and only returns summaries to API traffic recorders. The real deterrent is probably legal, not technical.

6. The Permission System — Fully Exposed

• default — Interactive prompts for each action
• auto — ML-based auto-approval via transcript classifier
• bypass — Skip all permission checks
• yolo — Deny all (yes, really)

Every action is tagged LOW, MEDIUM, or HIGH risk. When Claude Code explains a command — that explanation is itself generated by a separate LLM call.

🎮 Bonus: The Fun Stuff

buddy/companion.ts: An April Fools’ Easter egg with 18 creature species, rarity tiers, 1% shiny rate, RPG stats. Also: print.ts is 5,594 lines, with one function 3,167 lines long and 12 nesting levels deep.

⚠️ The Security Issue You Actually Need to Act On

️Action required if you updated Claude Code via npm between 00:21–03:29 UTC on March 31, 2026

North Korean APT group UNC1069 hijacked the npm account of the axios maintainer. Malicious versions 1.14.1 and 0.30.4 shipped with a Remote Access Trojan. Claude Code depends on axios.

# Check when your Claude Code was last modified
ls -la $(which claude)

# Check your lockfile for malicious axios versions
grep -E "axios.*1\.14\.1|axios.*0\.30\.4|plain-crypto-js" \
  package-lock.json yarn.lock bun.lockb 2>/dev/null

If found: treat the machine as fully compromised. Rotate all secrets. Clean OS reinstall.

curl -fsSL https://claude.ai/install.sh | bash

Switch to the native installer. No npm dependency chain. Background auto-updates.

What This Means for You

If you ship CLIs, tools, or npm packages

# Fail the build if any .map files are in the tarball
npm pack --dry-run | grep "\.map$" && echo "⚠️ MAP FILES FOUND" && exit 1
echo "*.map" >> .npmignore

Three failures compounded: misconfigured .npmignore, a Bun bug, and a public R2 bucket with no access controls. Any one would have stopped it.

If you’re building AI agents

The leaked architecture is the most detailed public documentation of production-grade AI agent infrastructure that exists. Read the Engineer’s Codex breakdown before your next sprint.

If you’re using Claude Code in production right now

1. If you updated via npm in the axios attack window — check and act immediately
2. If you run Claude Code on untrusted repositories — review permission settings and .claude/config.json
3. Future exploit attempts — attackers now know the exact orchestration logic for hooks and MCP servers

Practical steps: switch to the native installer, rotate your Anthropic API key at console.anthropic.com, monitor API usage for anomalies.

If you’re thinking about IP and clean-room rewrites

Whether an AI-generated clean-room rebuild violates copyright has never been tested in court. That legal question is now publicly open.

The Real Story

Anthropic has $19 billion in annualized revenue. Their most important developer product leaked in its entirety through a config file.

The three-layer memory system, the KAIROS daemon, the permission framework, the internal roadmap with a 29% false claims regression — all of it is now public knowledge.

👉 Claude Code Tips from the Creator Himself

👉 How Claude Code Can Be Your AI Teammate

👉 Skills, Plugins & Swarm Mode

👉 Claude Cowork — Complete Guide

I still have a feeling it was the most crazy April Fools’ joke of all times. Which led one of the biggest AI giants to become open source. Let’s see how it will affect the upcoming IPO and if we find out something else later