Claude Code's Source Code Leak Exposes Over 1900 Files

On March 31, 2026, Anthropic experienced a leak that nobody saw coming. The complete source code for Claude Code, their AI-powered CLI coding tool, was accidentally made public on npm due to a leftover .map file in the official version 2.1.88 package, released just a day earlier.

The issue was discovered by security researcher Chaofan Shou and quickly spread through the dev community. What was supposed to be a debug file turned into a map that allows for the reconstruction of the entire original code. It includes around 1,900 TypeScript files and over 512,000 lines, featuring internal system prompts and proprietary logic that Anthropic never intended to reveal.

The most intriguing aspect wasn't just the known code. The package contained details of unreleased features. Among them is Kairos, an autonomous daemon mode running in the background with push notifications, GitHub webhooks, and simultaneous sessions. There's also the Buddy System, a virtual companion similar to a tamagotchi with ASCII sprites, levels, and AI-generated personalities. And the Coordinator Mode, which turns Claude into an orchestrator for multiple agents working in parallel.

The result is that any developer with npm install can now access all this. The leak doesn't include the model weights but reveals the complete architecture of the agents, the team memory system, and even an undercover mode that removes internal Anthropic information from commits and PRs.

The community has already reacted. Mirrored repositories appeared on GitHub within hours, and people began testing the hidden parts of the code. Meanwhile, the incident reignites the discussion about security in build pipelines, especially when using AI tools like Claude Code to speed up deliveries.

The code is now available in public mirrors, and independent developers continue to analyze what Anthropic planned to release in the coming months.