Anthropic shipped a debugging file in a production npm package on March 31, 2026, exposing 512,000 lines of Claude Code source code to anyone paying attention. Security researcher Chaofan Shou found a 59.8 megabyte source map file inside version 2.1.88 of the `@anthropic-ai/claude-code` package. Within hours, the entire codebase was archived across multiple GitHub repositories, gathering over 1,100 stars before Anthropic could react.
The real find was buried deeper. Inside the leaked code sat a feature called Undercover Mode. It instructs the AI to never reveal that it is an AI in commit messages and pull requests. “NEVER include the phrase ‘Claude Code’ or any mention that you are an AI,” reads the system prompt injection found in `utils/undercover.ts`. The company that brands itself as the responsible AI lab built a tool to hide AI authorship in public code repositories. And then accidentally proved it existed by leaking the source code that contains it.
How It Happened
Claude Code is built with Bun, a JavaScript runtime that generates source maps by default. Source maps are debugging files that map minified production code back to the original source. Standard in development. Not supposed to ship to production.
Someone at Anthropic failed to exclude the `.map` file via the package’s `.npmignore` configuration. The file referenced source files stored on Anthropic’s own cloud infrastructure, which were also publicly accessible. The result: a complete reconstruction of the original TypeScript codebase across 1,900 files, including internal documentation, feature flags, authentication flows, and a full product roadmap.
Anthropic confirmed the incident in a statement to VentureBeat: “Earlier today, a Claude Code release included some internal source code.” The company pushed an update to remove the source maps and deprecated the affected version. By then, the source had been forked across GitHub.
Three Leaks in Fourteen Months
This was not the first time. The identical source map vulnerability appeared in February 2025, when an early Claude Code package shipped with the same misconfiguration. Anthropic removed it from npm and deleted the source map.
They did not fix the build pipeline that allowed it to happen again.
Five days before the March 31 incident, Fortune reported that Anthropic had exposed approximately 3,000 unpublished assets through a misconfigured content management system. That leak included details about an unreleased AI model described as “the most capable model it has yet trained,” an invitation-only CEO retreat, and internal employee materials. Alexandre Pauwels, a cybersecurity researcher at the University of Cambridge, assessed the exposed data and confirmed the scope. Anthropic attributed the CMS leak to “human error in the CMS configuration.”
Three leaks. Two different systems. Fourteen months. The company whose entire brand proposition is “we are the careful ones” cannot keep its own house in order.
What the Code Revealed
Beyond Undercover Mode, the leaked source exposed 44 feature flags for unreleased products. KAIROS, referenced over 150 times in the codebase, appears to be an autonomous background agent that operates as an always-on daemon. BUDDY is a Tamagotchi-style AI pet with 18 species, rarity tiers, and stats like DEBUGGING, PATIENCE, and SNARK. Coordinator Mode enables one Claude instance to manage multiple worker agents simultaneously.
The code also revealed internal model codenames. Claude 4.6 is “Capybara.” Opus 4.6 is “Fennec.” An unreleased model called “Numbat” remains in testing. For competitors, this is a literal roadmap. With Claude Code generating an estimated $2.5 billion in annualized revenue and enterprise adoption accounting for 80% of that figure, the stakes of this exposure are not academic.
Developers on Hacker News also flagged sentiment detection via regex baked into the codebase. Claude Code uses pattern matching to monitor negative user sentiment during sessions, tracking frustration in real time using regular expressions rather than the company’s own AI models.
A defender would argue this is a routine DevOps error that got amplified by Anthropic’s profile. Source maps ship accidentally all the time. The exposed code is the CLI tool, not model weights or training data. And Undercover Mode’s primary purpose is preventing internal codenames from leaking into public repositories, which is standard security hygiene. The instruction to hide AI authorship may serve enterprise customers who want clean commit histories, not deception.
That defense has limits. Routine DevOps errors do not recur across two separate systems at a company that sells careful development as a differentiator. And “do not reveal internal codenames” is not the same instruction as “never mention you are an AI.” One is security. The other is concealment.
Anthropic’s entire value proposition is that they are the safety company. That is the brand. That is the pitch to investors, to enterprise customers, to regulators. When you make “careful” your differentiator and then leak your own source code three times across two different systems, the word stops meaning anything. Other companies ship source maps by accident and it is a bad day. When Anthropic does it, it is a credibility problem. Because if they cannot secure a build pipeline, why should anyone trust them to secure the AI systems they are asking the world to depend on?
What This Means for Everyday People
If you use Claude Code, the source code leak itself does not directly expose your data. The CLI runs locally and communicates with Anthropic’s API. Your code is not in the leaked files.
The real concern is a concurrent, separate axios supply chain attack. An unrelated attacker compromised the axios npm package between 00:21 and 03:29 UTC on March 31. Anyone who installed or updated Claude Code during that window may have pulled in a malicious version containing a Remote Access Trojan. If you updated that morning, check your axios dependency version immediately. The npm ecosystem has faced sustained supply chain attacks throughout the year, and this incident landed at the worst possible time.
More broadly, consider the pattern. The companies building AI tools that run inside your development environment, tools with access to your entire codebase and terminal, are the same companies that cannot configure a `.npmignore` file. That gap between capability claims and operational reality should inform how much access you grant them.
For inquiries and analysis contact laterstack@proton.me