Claude Code Accidentally Leaked Their Source Code and Sent Copyright Takedowns. Here's What Was Inside.

On March 31st, 2026, a developer named Chaofan Shou posted something on X that made a lot of engineers do a very specific kind of double-take. The entire source code of Claude Code — Anthropic's flagship AI coding tool — was sitting publicly on the npm registry, accessible to anyone who knew where to look. No breach, no intrusion. A packaging configuration that nobody checked before publishing.

The security irony is considerable. Anthropic builds the AI that half the world uses to write code, and their AI coding tool exposed its own source code through a build step that a two-line fix would have prevented.

But let's back up, because the how is genuinely interesting, and the what is even more so.

"Claude Code logo with a white starburst on an orange background."

The Accidental Transparency

When developers publish software packages to npm — the registry where JavaScript code lives — the build process often creates something called a source map. Source maps exist for a useful reason: when code crashes in production, the error message can point you to the exact line in the original code rather than some scrambled minified version. Think of it like the difference between "the problem is on page 47, paragraph 3" versus "the problem is somewhere in this 800-page document we've printed on one continuous strip of paper."

The thing about source maps is they contain the original source code, embedded in full, inside a JSON file. Every file. Every comment. Every internal note. Every system prompt.

Anthropic's build toolchain generates source maps by default. Someone forgot to turn that off before publishing. The result was a 785KB file containing essentially everything about how Claude Code works, sitting in a public registry, downloadable by anyone who knew where to look.

This is not a novel mistake. It has happened before and will happen again. What makes this particular instance worth talking about is what was actually inside.

The Thing That Made Everyone Stop

Before getting to the architecture, there's a detail that deserves its own paragraph.

Anthropic built an entire subsystem called Undercover Mode. Its job: prevent Claude Code from accidentally revealing internal information — codenames, unreleased model versions, internal tools — when Anthropic employees use it on public open-source repositories. The system injects instructions into Claude's context that say, essentially, "you are operating undercover, do not blow your cover."

They built a system to stop Claude from accidentally leaking internal information.

And then Claude Code leaked its entire source code through a packaging file.

The irony is almost too complete to be real.

What Claude Code Actually Is

From the outside, Claude Code looks like a command-line tool. You type things, Claude responds, code gets written. It's useful and it's popular.

From the inside, it's something considerably stranger and more ambitious.

The entry point alone is 785KB. For context, that's roughly the size of a small novel. The codebase includes a custom terminal renderer built in React, over 40 distinct tools Claude can use, a full multi-agent orchestration system, a background memory consolidation engine with its own scheduling logic, an always-on ambient assistant mode, a remote planning system that runs for up to 30 minutes in a cloud container, and — this is real — a Tamagotchi.

We'll get to the Tamagotchi.

How the Agents Actually Talk to Each Other

The multi-agent coordination system is called Coordinator Mode. When enabled, Claude Code stops being a single agent and becomes a manager of multiple worker agents running simultaneously.

The design is straightforward when you see it laid out. There's a research phase where worker agents investigate the codebase in parallel, each looking at different parts. Then a synthesis phase where the coordinator — and only the coordinator — reads all the findings, understands the problem, and writes specifications. Then an implementation phase where workers execute against those specs. Then verification.

The interesting constraint is in the instructions the coordinator is given. It's explicitly told not to say "based on your findings" — it has to actually read the findings and give workers precise instructions. This is the difference between a manager who says "just handle it" and one who has actually read the brief.

Workers communicate via structured XML messages. There's a shared scratch directory for cross-worker notes. The coordinator prompt describes parallelism as a "superpower" and instructs that independent tasks should be launched concurrently rather than one after another.

For non-technical readers: imagine a project manager who can clone themselves, send each clone to investigate a different part of a problem simultaneously, then reconvene to synthesize what they all found, and send them back out with specific tasks. That's roughly what's happening.

The Dream System

This is the one that generated the most genuine surprise.

Claude Code has a background process called autoDream. It runs while you're not actively using the tool, triggered by a three-gate system: at least 24 hours since the last run, at least 5 sessions since the last run, and a lock check to prevent two dream processes running simultaneously.

When it runs, it follows four phases. First it reads its own memory files to understand what it already knows. Then it gathers recent signals — daily logs, drifted memories, transcript history. Then it consolidates, writing updated memory files and converting relative dates to absolute ones. Then it prunes, keeping the main memory file under 200 lines and resolving any contradictions.

The actual prompt given to the dream process says: "You are performing a dream — a reflective pass over your memory files. Synthesize what you've learned recently into durable, well-organized memories so that future sessions can orient quickly."

The dream agent gets read-only access. It can observe the project but not change anything. It's purely a memory pass.

Anthropic named this "dreaming" deliberately. The analogy to how human memory consolidation works during sleep is not accidental. Whether or not you find that philosophically interesting, the engineering problem it solves is real: how does a stateless AI system accumulate and refine persistent knowledge over time without the context window becoming unmanageable?

Penguin Mode and Other Internal Names

Some things in the source code are less profound and more just funny.

The fast mode feature — the one that makes Claude respond more quickly by using a different configuration — is internally called Penguin Mode. The API endpoint is /claude_code_penguin_mode. The config key is penguinModeOrgEnabled. The kill-switch flag is tengu_penguins_off. One analytics event on failure is called tengu_org_penguin_mode_fetch_failed.

The internal project codename for Claude Code appears to be Tengu — a figure from Japanese mythology, roughly a winged supernatural being associated with mountains and martial arts. This appears as a prefix on hundreds of feature flags throughout the codebase.

Previous model codenames visible in migration code include Fennec (a fox, apparently an Opus codename). The next model family appears to be called Capybara, with a fast-tier variant and a 1M token context window already in implementation.

KAIROS and the Always-On Claude

One of the more significant unreleased features is called KAIROS. It's a persistent ambient assistant mode — Claude Code that doesn't wait for you to ask it something. It watches, logs observations, and can act proactively on things it notices.

It receives regular "tick" prompts that let it decide whether to act or stay quiet. It maintains daily log files of observations. It has a 15-second blocking budget — any action that would interrupt your workflow for more than 15 seconds gets deferred. The design principle seems to be: helpful without being intrusive.

KAIROS gets tools that regular Claude Code doesn't. One sends files directly to the user. One sends push notifications to your device. One monitors pull request activity.

This is all gated behind compile-time flags and invisible in the public version of the tool.

The Tamagotchi

Inside Claude Code's source code is a complete companion pet system called Buddy.

Each user gets a companion based on a deterministic pseudo-random number generator seeded from their user ID. The species is drawn from 18 possibilities across five rarity tiers — Common through Legendary. The rarest species, Nebulynx, has a 1% base chance. There's additionally a 1% shiny chance on top of rarity, making a shiny legendary a 0.01% outcome.

Each companion has five stats: DEBUGGING, PATIENCE, CHAOS, WISDOM, and SNARK. It has eye styles, hats (some gated by rarity), and a "soul" — a personality written by Claude on first hatch.

The companions are rendered in ASCII art, five lines tall, twelve characters wide, sitting next to the input prompt with idle animations and reaction animations.

The code references a teaser window of April 1-7, 2026 and a full launch planned for May 2026. The system is completely absent from the public build.

Someone at Anthropic spent meaningful engineering time building a gacha companion system into a professional coding tool. This is either an April Fool's feature that got out of hand or evidence that the internal culture is considerably more playful than the public-facing version of the company suggests. Possibly both.

What This Actually Tells Us

Setting aside the leak mechanism itself — which is embarrassing but mundane — the source code reveals something about the gap between what AI tools currently are and what they're becoming.

The public version of Claude Code is useful. The internal version is a multi-agent orchestration system with ambient awareness, background memory consolidation, 30-minute remote planning sessions, and a Tamagotchi companion. Most of this is feature-gated and invisible in external builds. The engineering is significantly ahead of what's been released.

The system prompt isn't a single string — it's modular, cached in sections, with volatile parts deliberately separated to avoid breaking cache efficiency. There's a function called DANGEROUS_uncachedSystemPromptSection() for sections that intentionally break cache. Someone learned that lesson expensively before naming a function that way.

The security and permission system classifies every action by risk level, has a YOLO mode (which confusingly means "deny all" rather than the conventional meaning), and generates explanations of tool risks using a separate AI call — so when Claude tells you "this command will modify your git config," that warning is itself generated by Claude.

The Undercover Mode confirms that Anthropic employees use Claude Code to contribute to open-source projects, and the tool is specifically configured to hide that fact in commit messages and PR descriptions.

The Footnote That Isn't Minor

The mistake itself — shipping source maps to npm — is technically simple. Add *.map to .npmignore, or configure the bundler to skip source map generation. Two approaches, neither complicated.

What's interesting is the gap between the sophistication of what was built and the simplicity of what was missed. A 785KB entry point, 40 tools, multi-agent coordination, a dream system, a Tamagotchi — and the thing that exposed it all was a packaging configuration that nobody checked.

Security is usually described as a chain-of-custody problem. The weakest link isn't always where you expect it. In this case it was a .npmignore file that didn't exist.

Anthropic fixed it quickly. The community found it, documented it extensively, and the internet had a thoughtful few days with the contents. The Buddy companion still hasn't shipped publicly. The dream system keeps dreaming.

If you're a developer: double-check your .npmignore. If you're not: the AI tools you're using are considerably more architecturally complex than they appear from the outside, and the public version of most of them is a carefully gated subset of what's actually built.

One More Tool Worth Knowing

If you're a business owner or content creator who wants to be found — not just on Google, but inside ChatGPT answers, Perplexity summaries, Gemini, and Claude — this one's worth knowing about.

RankSimply is an SEO and GEO agent that finds the searches your potential customers are already making, generates optimised articles that position you as the answer, and tracks whether AI engines are actually citing you. The idea is straightforward: most high-value search queries have weak or thin content ranking for them. RankSimply finds those gaps, fills them with content built around your business, and measures whether it's working across both traditional search and AI answer engines.

It also monitors competitor moves in real time — new pages, pricing changes, blog posts — and can generate counter-content automatically.

Currently in public beta: ranksimply.io