--- title: "Anthropic accidentally published Claude Code’s source code this morning" id: "5634" type: "post" slug: "anthropic-claude-code-source-code-leaked-npm" published_at: "2026-03-31T18:16:48+00:00" modified_at: "2026-10-28T00:19:10+00:00" url: "https://mediacopilot.ai/anthropic-claude-code-source-code-leaked-npm/" markdown_url: "https://mediacopilot.ai/anthropic-claude-code-source-code-leaked-npm.md" excerpt: "A packaging error exposed Claude Code’s source." taxonomy_category: - "News" taxonomy_post_tag: - "ai" - "anthropic" - "Microsoft" - "claude code" --- # Anthropic accidentally published Claude Code’s source code this morning A packaging error exposed Claude Code’s source. ![Claude AI mascot frantically plugging leaks in a dam with source code gushing out — illustrating Anthropic's Claude Code source leak](https://mediacopilot.ai/wp-content/uploads/2026/03/claude-code-source-leak-dam-400x225.png) 512,000 lines. One missing .gitignore. (Credit: Google Gemini) Mar 31, 2026 By Anthropic accidentally published the source code for Claude Code this morning — 512,000 lines of TypeScript, exposed for hours before anyone pulled it. ### Key Takeaways - A packaging error pushed Claude Code’s 512K-line source to NPM. - A Solayer Labs dev spotted it and mirrored it to GitHub before takedown. - Anthropic called it a release-packaging mistake, not a security breach. [Are you an AI Agent? Read more here >](https://mediacopilot.ai/anthropic-claude-code-source-code-leaked-npm.md) Source maps can reconstruct the full, readable source from compiled code. By 4:23 am ET, a developer at Solayer Labs had spotted it, posted a direct download link on X, and the codebase was being mirrored to GitHub and analyzed by thousands of developers across the industry. Anthropic confirmed the incident to [VentureBeat](https://venturebeat.com/technology/claude-codes-source-code-appears-to-have-leaked-heres-what-we-know) : “Earlier today, a Claude Code release included some internal source code. No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We’re rolling out measures to prevent this from happening again.” That framing — human error, not a breach — is accurate but undersells the competitive exposure. Claude Code is reportedly [generating $2.5 billion in annualized recurring revenue](https://www.forbes.com/sites/the-prompt/2026/02/17/anthropic-is-cashing-in-on-claude-codes-success/) , has more than doubled since the start of the year, and competes directly with Cursor, GitHub Copilot, and a fast-moving field of agentic coding tools. The leaked code gave competitors a detailed look at exactly how Anthropic solved some of the hardest engineering problems in that space. Among the details developers surfaced: a three-layer memory architecture that keeps AI agents coherent across long coding sessions by maintaining a lightweight index of pointers rather than storing everything; an “autoDream” background process that consolidates the agent’s memory while the user is idle; 44 hidden feature flags; and internal model codenames including Capybara (a Claude 4.6 variant), Fennec (Opus 4.6), and an unreleased model called Numbat. The code also showed internal performance metrics: version 8 of Capybara had a 29-30% false claims rate, a regression from version 4’s 16.7%. The most discussed detail was what developers called “Undercover Mode” — a system that lets Claude Code contribute to public open-source repositories without disclosing that the commits came from an AI. The leak is the second high-profile setback for Anthropic in recent weeks, following its [lawsuit against the Pentagon](https://mediacopilot.ai/?p=5345) over the company’s AI safety limits. The underlying story here isn’t the leak itself — packaging errors happen. It’s that one slip exposed enough proprietary engineering detail that competitors now have a working map of how one of the most commercially successful AI coding tools actually functions. For a company that’s staked its position on responsible AI development and technical differentiation, that’s the real cost. Posts co-authored by The Copilot are drafted with AI and then carefully edited by Media Copilot editors. Our AI-assisted process allows us to bring more valuable content to our readers while preserving accuracy and quality. Contributors - [The Copilot](https://mediacopilot.ai/author/thecopilot/) : CoauthorI'm a generative AI writer for The Media Copilot. I help author posts, and with the help of human editors, play a growing role in the site's content strategy. - [Christopher Allbritton](https://mediacopilot.ai/author/christopherallbritton/) : EditorChristopher Allbritton covers AI adoption in journalism and newsroom transformation. He brings 20+ years of journalism experience, including roles as Reuters' Pakistan Bureau Chief and TIME's Middle East Correspondent. Category: [News](https://mediacopilot.ai/category/news/) Tags:[claude code](https://mediacopilot.ai/tag/claude-code/) | [Microsoft](https://mediacopilot.ai/tag/microsoft/) | [anthropic](https://mediacopilot.ai/tag/anthropic/) | [ai](https://mediacopilot.ai/tag/ai/) Share this post: [Facebook](https://www.facebook.com/sharer/sharer.php?u=https://mediacopilot.ai/anthropic-claude-code-source-code-leaked-npm/&display=popup&ref=plugin&src=share_button) [Tweet](https://twitter.com/share?url=https://mediacopilot.ai/anthropic-claude-code-source-code-leaked-npm/&text=Anthropic%20accidentally%20published%20Claude%20Code%E2%80%99s%20source%20code%20this%20morning) [LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https://mediacopilot.ai/anthropic-claude-code-source-code-leaked-npm/) [Email](/cdn-cgi/l/email-protection#e6d99593848c838592dbbf899394c3d4d680948f838882c3d4d68e8795c3d4d6958e87948382c3d4d68788c3d4d68794928f858a83c3d4d6918f928ec3d4d69f8993c8c0c5d6d5dedd8489829fdba788928e9489968f85c3d4d68785858f82838892878a8a9fc3d4d69693848a8f958e8382c3d4d6a58a87938283c3d4d6a5898283c3a3d4c3ded6c3dfdf95c3d4d6958993948583c3d4d685898283c3d4d6928e8f95c3d4d68b8994888f8881c3d6a2c3d6a78e92929695c3d5a7c3d4a0c3d4a08b83828f878589968f8a8992c8878fc3d4a08788928e9489968f85cb858a87938283cb85898283cb958993948583cb85898283cb8a83878d8382cb88968bc3d4a0c3d6a2c3d6a7)