By Assaf Biton
One missing line in a config file cost Anthropic its biggest competitive secret. On March 31, 2026, a routine npm release shipped a 59.8 MB source map that exposed the full TypeScript behind Claude Code: 512,000 lines across 1,906 files. I read the analyses so you do not have to download a single byte (please do not).
TL;DR: Version 2.1.88 of @anthropic-ai/claude-code accidentally included a cli.js.map file with the entire unminified source. Within hours it was mirrored across GitHub with 41,500+ forks. The code exposed unreleased features (an autonomous daemon called KAIROS, a controversial Undercover Mode, anti-distillation defenses) and proved the real moat is the 512K-line tooling layer, not the model. Anthropic called it "human error, not a security breach." No one was fired.
If you follow AI coding tools, you know this one got loud. So let me give you the parts that matter. For the model side, see our Claude Opus 4.6 review and our AI news coverage.
How a missing .npmignore line leaked Claude Code
The root cause is almost boring. Claude Code is built with the Bun runtime, and Bun generates source maps by default. The *.map files were never excluded in .npmignore, so the published package quietly carried the full source.
Here is the part that stings. A nearly identical mistake happened on Claude Code's first launch day in February 2025. That makes this the second incident of the same category in 13 months, with no preventive automation added after.
Security researcher Chaofan Shou, an intern at Solayer Labs, spotted the exposed map around 4:23 AM ET and posted a download link on X. The map also pointed to a zip on Anthropic's own public Cloudflare R2 bucket. By the time Anthropic's team woke up, recall was impossible: tens of thousands of forks, that X post past 28 million views.
Do not download "leaked Claude Code" archives. Threat actors flooded GitHub and search results with fake repos pushing Vidar infostealer and GhostSocks malware, plus a trojanized axios client (versions 1.14.1 and 0.30.4) in the npm chain between roughly 00:21 and 03:29 UTC on March 31. If you updated in that window, rotate your tokens now.
What was actually inside: KAIROS, Undercover Mode, and more
This is the part everyone clicked for. The code held features that were never announced, and a few that raised real ethical questions. Here are the big ones.
KAIROS is the headline. It is an always-on autonomous daemon (Greek for "the right time") referenced 150 to 190 times across 61 files. It turns Claude Code from a reactive tool into a background agent that decides, on each periodic <tick> message, whether to act or sleep. It carries GitHub webhooks, 5-minute cron cycles, and three tools missing from the public build, plus a companion called autoDream that consolidates memory while you are idle.
Undercover Mode is the one that got people angry. The file undercover.ts strips every trace of Anthropic involvement (codenames, Slack channels, the Co-Authored-By line) when employees contribute to public repos. It defaults to ON and, oddly, has no force-OFF switch. In plain terms: AI-authored commits from Anthropic staff can look human-authored in open source. The allowlist for it accidentally leaked 22 private repo names.
There is more. ULTRAPLAN offloads heavy planning to a remote container running Opus 4.6 for up to 30 minutes. And a regex file watches your messages for frustration ("wtf", "this sucks") and fires telemetry marked is_negative: true. An AI company using regexes for sentiment. The community had a field day.
The real lesson: the moat is the tooling, not the model
Strip away the drama and one finding stands out. The 512K lines describe what analysts called "a small, dedicated operating system," not a thin chat wrapper. The tooling layer runs 40+ self-contained tools through MCP, a three-tier memory system, and a multi-agent Coordinator Mode behind a feature flag.
That settles a long debate: the edge in AI coding tools lives in the engineering scaffolding, not the weights. The QueryEngine alone (about 46,000 lines) got a circuit breaker only after 1,279 sessions hit 50+ consecutive compaction failures, wasting roughly 250,000 API calls a day worldwide. Want to see how the model stacks up? Try our Claude Code vs Cursor breakdown.
Anthropic's command-line coding agent whose full source map leaked via npm
Best for: Senior developers who want to delegate long autonomous tasks and review results, DevOps teams integrating AI into CI pipelines for automated test fixing
Pro Tip: If you build your own agent scaffolding, treat persisted memory as a hint, not a fact. The leaked code re-verifies its own memory against the live codebase before acting, which kills a class of stale-memory hallucinations and cuts "confidently wrong" actions in Anthropic's design.
The fallout: 8,100 repos, malware, and clean-room rewrites
Anthropic's first DMCA takedown accidentally hit around 8,100 GitHub repositories, because the leaked repo was tangled in a fork network linked to Anthropic's own public repo. Legitimate forks went dark. The company retracted most notices within about 24 hours, narrowing scope to 1 repo and 96 related forks.
Boris Cherny, who heads Claude Code, was blunt: "Our deploy process has a few manual steps, and we didn't do one of the steps correctly." Two security holes did surface, though: a bash parser difference that lets carriage returns bypass the command-injection gate, and a compaction step that can launder poisoned instructions hidden in a CLAUDE.md file into directives the model later trusts.
Then came the rewrites. Korean developer Sigrid Jin published claw-code, a clean-room Python and Rust build that contains none of the leaked TypeScript. It hit 50,000 GitHub stars in about 2 hours and crossed 100,000 within a day, reportedly the fastest-growing repo in GitHub history.
The Leak: What Helped Developers and What Backfired
What Works
- Confirmed that disciplined agent scaffolding (memory tiers, permission gating, tool isolation) is the actual product
- Sparked open clean-room projects like claw-code that push the patterns into the open
- Anthropic owned the mistake publicly and retracted its overbroad DMCA within ~24 hours
What Doesn't
- The same .npmignore error happened twice in 13 months with no automation added after the first
- Undercover Mode raises a genuine open-source trust problem, and it has no force-OFF switch
- Anti-distillation defenses have documented workarounds, so their protection is limited
What happens next for Anthropic and Claude Code
Analysts estimate the leak compressed a possible 12 to 18 month competitive lead into 3 to 6 months, since Cursor, Copilot, and Windsurf now know what Anthropic built. The leak did not slow the business side: on June 1, 2026, Anthropic confidentially filed a draft S-1 with the SEC, after a $65B Series H at a roughly $965B valuation, moving toward a public listing rather than away from one. As of June 2026, there is still no detailed public post-mortem of the leak itself, and KAIROS remains unreleased.
So is the story over? Not really. Whether KAIROS ships, whether clean-room rewrites hold up legally, and how far Undercover Mode reached are all still open. The practical move is the same as our agent security checklist says: keep your scaffolding model-flexible and never trust "leaked" code.
Our Take
The headline finding: the 512K-line tooling layer is the real asset, not the model. If you are choosing a coding agent, judge the scaffolding (memory, permissions, multi-agent coordination), not the model name on the box.
Biggest risk for users: the supply-chain attacks that followed. Never download "leaked" archives, and rotate tokens if you updated on March 31.
What to watch: whether Anthropic still ships KAIROS, and whether Undercover Mode survives the open-source backlash.
Frequently Asked Questions
What caused the Claude Code source leak?
A missing .npmignore rule. The Bun build runtime generates source maps by default, and version 2.1.88 of the npm package shipped a 59.8 MB cli.js.map file holding the full source. A near-identical error happened at Claude Code's first launch in February 2025.
What is KAIROS in the Claude Code leak?
KAIROS is an unreleased always-on autonomous daemon found in the source, referenced 150 to 190 times across 61 files. It runs Claude Code as a background agent using periodic tick messages, GitHub webhooks, and 5-minute cron cycles, deciding on each tick whether to act or sleep.
Is it legal or safe to download the leaked Claude Code source?
No. Anthropic filed DMCA takedowns, and threat actors seeded fake archives with Vidar and GhostSocks malware plus a trojanized npm package. Downloading it risks both legal exposure and a malware infection. Read the analyses instead.
Did Anthropic fire anyone over the leak?
No. Anthropic called it "human error, not a security breach." Boris Cherny said the deploy process had manual steps and one was done incorrectly. No personnel were terminated.
