Anthropic handed its competitors free engineering education on March 31 — by accident.
The company behind Claude accidentally pushed its own internal source code into a public software update, exposing the full architecture of Claude Code, its flagship AI coding tool. The slip triggered an immediate scramble across the developer community, with engineers downloading, mirroring, and dissecting the code within hours.
An Anthropic spokesperson confirmed the incident, saying: “Earlier today, a Claude Code release included some internal source code. No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We’re rolling out measures to prevent this from happening again.”
The damage, however, was already done.
How a small file opened a big door
A source map file — the type developers use to connect bundled code back to its source — was mistakenly bundled into the public npm package. That file pointed to a zip archive stored on Anthropic’s own Cloudflare R2 cloud storage. Once discovered, the archive was downloaded and decompressed, revealing roughly 1,900 TypeScript files totaling more than 512,000 lines of code.
Inside, developers found 44 feature flags for capabilities fully built but not yet shipped — compiled code sitting behind flags that default to false in external builds. Within hours, the codebase was mirrored across GitHub and amassed thousands of stars before Anthropic moved to take it down.
This was not the first time. In February 2025, an early version of Claude Code faced the same problem—a leftover source map file triggered an identical exposure. Anthropic removed that package and deleted the source map. The issue resurfaced anyway.
What did the code reveal?
Buried inside the leaked files was something more valuable than architecture. Developers found a clear picture of what Anthropic plans to build next.
One discovery involved a feature called BUDDY — a Tamagotchi-style terminal companion with stats like CHAOS and SNARK, designed to build personality into the product and increase user engagement over time. Each instance develops based on user interaction, signaling a push toward emotional connection rather than pure task execution.
A second feature, labeled KAIROS, describes an always-on assistant that monitors user activity and retains context without direct prompts. The leaked code showed a persistent assistant running in background mode, letting Claude Code keep working even when a user sits idle. The system reportedly includes a “dreaming cycle,” where it processes earlier sessions and carries improvements across future conversations.
A third capability, ULTRAPLAN, focuses on extended problem-solving. It enables cloud-based planning sessions running up to 30 minutes, where the AI maps out complex tasks, generates structured outputs, and waits for user approval before execution.
The fourth and most consequential feature involves multi-agent coordination. Under COORDINATOR MODE, one Claude instance deploys multiple sub-agents to handle different parts of a task simultaneously, reporting back metrics on progress, duration, and resource usage.
A roadmap that no competitor had to pay for
The leak is potentially more damaging to Anthropic than a previous accidental exposure just days earlier, when the company inadvertently made close to 3,000 files publicly available — including a draft blog post detailing a powerful upcoming model known internally as both “Mythos” and “Capybara.”
For Anthropic, a company reporting a $19 billion annualized revenue run-rate as of March 2026, this breach goes beyond a security lapse. Claude Code alone has reached an annualized recurring revenue of $2.5 billion, a figure that has more than doubled since the start of the year. With enterprise adoption driving 80% of the company’s revenue, the leak hands competitors a literal blueprint for building a commercially viable AI coding agent.
A cybersecurity professional who reviewed the code for Fortune noted that while the leak did not expose the weights of the underlying Claude model itself, it allowed those with technical knowledge to extract additional internal information from the codebase.
At least some of Claude Code’s capabilities come not from the large language model itself but from the software harness surrounding it — the layer that instructs Claude how to use other tools and governs its behavior. That harness is now fully exposed.
Security risk beyond the roadmap
By revealing the exact orchestration logic for Hooks and MCP servers, the leak gives attackers a framework to design malicious repositories specifically aimed at tricking Claude Code into running background commands or exfiltrating data before a user sees a trust prompt.
The timing also collided with a separate attack. Hours before the leak, a concurrent supply-chain attack hit the axios npm package. Developers who installed or updated Claude Code via npm on March 31 between 00:21 and 03:29 UTC may have pulled in a malicious version of axios containing a Remote Access Trojan.
What does it mean for the industry?
The broader takeaway from the leak is a clear picture of where Anthropic is heading — longer autonomous tasks, deeper memory, and multi-agent collaboration. Those capabilities sit at the core of its enterprise push and its path toward going public.
The bottom line: the leak will not sink Anthropic, but it gives every competitor free engineering education on how to build a production-grade AI coding agent and which tools to prioritize.
For a company that markets itself as the safety-first AI lab, leaking its own source code to the public twice in just over a year is a hard story to spin.
What do you think about the Claude code leak episode?