Anthropic did not intend to release the source code of its flagship coding agent, but a packaging error on Tuesday morning effectively made it public. Version 2.1.88 of Claude Code, pushed to the npm registry in the early hours, included a 59.8MB JavaScript source map — a debug file capable of reconstructing original code from its compressed form. A single misconfigured line in the ignore settings allowed the file to ship with the release. The company confirmed the incident was caused by human error and not a security breach, adding that no sensitive customer data or credentials were exposed.
Intern and researcher Chaofan Shou was among the first to identify the file, posting a download link to X at approximately 4:23 a.m. ET. The thread drew 16 million viewers before Anthropic pulled the npm package. By then, the internet had already archived 512,000 lines of code spread across 1,900 files representing a substantial portion of the project’s internal architecture. The exposed material included LLM API orchestration logic, multi-agent coordination systems, permission structures, OAuth flows, and 44 hidden feature flags tied to unreleased functionality.
Among the more unusual discoveries were two internal projects. The first, named Kairos, is described as an always-on background daemon that stores memory logs and performs nightly consolidation routines referred to as “dreaming.” The second, called Buddy, is a Tamagotchi-style AI companion featuring 18 species, rarity tiers, and character stats including debugging, patience, chaos, and wisdom. Internal code suggests a rollout for Buddy was planned for April 1 through 7. Researchers also found a subsystem called “Undercover Mode,” designed to prevent Claude from inadvertently revealing Anthropic’s internal codenames when contributing to open-source repositories. The injected system prompt reportedly instructs the model: “Do not blow your cover.”
Anthropic responded by issuing DMCA takedown notices against mirrors of the code appearing on GitHub. That effort, however, quickly ran into a legal obstacle. A Korean developer named Sigrid Jin, previously profiled in the Wall Street Journal for consuming 25 billion Claude Code tokens, woke at 4 a.m. to the news and used an AI orchestration tool called oh-my-codex to port the core architecture from its original language into Python. He published the result as claw-code before sunrise, and the repository accumulated 30,000 GitHub stars faster than any repository on record.
Gergely Orosz, founder of The Pragmatic Engineer newsletter, outlined the legal reasoning in a post on X. Because the Python version constitutes a clean-room rewrite rather than a direct copy, it qualifies as a new creative work and falls outside the reach of DMCA copyright claims. The argument rests on the distinction between reproducing protected expression and independently recreating underlying functionality. Legal observers noted the position is defensible, though the situation grows more complicated given questions about who actually authored the original code.
Anthropic’s own chief executive has implied that significant portions of Claude Code were written by Claude itself. A separate legal precedent adds further uncertainty: the DC Circuit upheld in March 2025 that AI-generated work does not carry automatic copyright protection, and the Supreme Court declined to hear a challenge to that ruling. If substantial sections of the leaked code were produced by an AI model, the strength of any copyright claim Anthropic might assert becomes less clear. These overlapping questions — clean-room rewrites, AI authorship, and copyright eligibility — place the incident at the intersection of several unresolved areas of law.
Decentralized infrastructure has further complicated Anthropic’s ability to contain the leak. An account operating under the name GitLawb mirrored the original source code to a decentralized git platform of the same name, stating the repository would never be taken down. A separate repository compiling Claude’s internal system prompts also circulated, offering prompt engineers and researchers additional insight into how Anthropic conditions its models. Unlike centralized platforms such as GitHub, which are legally obligated to comply with DMCA notices, decentralized systems lack a single point of failure that takedown requests can target. Within hours of the initial leak, enough mirrors existed across enough infrastructure to make full removal effectively impossible.
Originally reported by Decrypt.
