In Brief:
- A source map file left in Claude Code version 2.1.88 on npm exposed roughly 1,900 TypeScript files and more than 512,000 lines of proprietary source code.
- Developers digging through the code found 44 feature flags covering unshipped capabilities, references to future models and internal telemetry that tracks user frustration signals.
- Anthropic confirmed the exposure was caused by human error in its release packaging, saying no customer data or model weights were involved.
Anthropic’s Claude Code CLI shipped with its full source code visible to anyone who looked. A source map file accidentally included in version 2.1.88 of the npm package gave the public a direct line to the TypeScript behind one of the most widely used AI coding tools on the market.
Security researcher Chaofan Shou, an intern at blockchain security firm Fuzzland, spotted the exposure on Tuesday and posted about it on X. The 59.8MB map file referenced a zip archive hosted on Anthropic’s Cloudflare R2 storage bucket. Within hours, the archive had been downloaded, decompressed, and backed up on GitHub, where it was forked more than 41,500 times.
What’s in the code
The archive contained 1,906 source files spanning internal API design, telemetry systems, encryption tools and inter-process communication protocols. It wasn’t just infrastructure plumbing. Developers found 44 feature flags covering capabilities that are fully built but not yet shipped to users.
Among the unreleased features: background agents that run continuously with GitHub webhooks and push notifications, a system for one Claude instance to orchestrate multiple worker instances each with restricted toolsets, cron scheduling for agents, a full voice command mode with its own CLI entrypoint, browser control via Playwright and agents capable of sleeping and self-resuming without user input. Persistent memory across sessions was also built in.
The code also contained references to future models, including Opus 4.7, Sonnet 4.8 and a codename “Capybara.” Unreleased feature names found in the source include KAIROS, described as long-term memory, ULTRAPLAN for advanced planning, a “Buddy mode” and an “Agent Teams” system.
Telemetry and security measures
The source revealed that Anthropic tracks specific user behavior signals, including how often users swear at Claude (as a proxy for frustration) and how frequently they type “continue” (to measure response cutoffs). The code also includes protections designed to prevent other processes on a user’s machine from stealing session tokens and a system to verify that requests originate from a legitimate client.
Anthropic’s response
“Earlier today, a Claude Code release included some internal source code,” an Anthropic spokesperson told The Register. The company said no customer data or credentials were involved or exposed. “This was a release packaging issue caused by human error, not a security breach. We‘re rolling out measures to prevent this from happening again.”
This isn’t the first time it’s happened. In February 2025, an early version of Claude Code was exposed through the same source map issue, prompting Anthropic to pull the affected package and delete the file. The problem resurfaced with version 2.1.88. Multiple GitHub repositories had previously extracted and organized deobfuscated Claude Code source, including one that accumulated nearly 1,000 stars.
Software engineer Gabriel Anhaia, who published a technical analysis of the leak, said it should serve as a warning even for well-resourced teams. “A single misconfigured .npmignore or files field in package.json can expose everything,” Anhaia wrote.
No model weights, but plenty of architecture
To be clear: the leak is the TypeScript client code for the CLI tool. It does not include model weights, training data or anything that would let someone run their own version of Claude. But the full exposure of internal architecture, security mechanisms and telemetry logic means Anthropic’s implementation decisions are now transparent to competitors and the open-source community alike.
The original GitHub uploader has since repurposed his repository to host a Python feature port of Claude Code, citing concerns about legal liability for hosting Anthropic’s intellectual property. Forks and mirrors remain widely available.
Anthropic did not say whether it plans to request takedowns of the repositories.
