The Claude Code Source Leak: What Happened, What It Means, and What to Watch

How a 59.8 MB source map file briefly made Anthropic’s internal codebase an open book

What Happened ?

On March 31, 2026, Anthropic shipped version 2.1.88 of @anthropic-ai/claude-code to npm — and accidentally included a 59.8 MB JavaScript source map file that should never have been there.

The .map file did more than take up space. It contained a pointer to a zip archive stored on Anthropic's own Cloudflare R2 bucket — and that bucket was publicly accessible. Anyone who followed the chain could download and reconstruct roughly 512,000 lines of TypeScript spread across approximately 1,906 files: Claude Code's internal source, laid bare.

The discovery moved fast. Security researcher Chaofan Shou (affiliated with Solayer Labs) posted about it on X at approximately 4:23 AM ET the same morning. Within hours, the thread was circulating widely across Hacker News, developer forums, and tech press. By mid-morning, The Register, VentureBeat, CNBC, Fortune, and Decrypt had all published coverage.

Anthropic’s official statement was characteristically brief:

“Earlier today, a Claude Code release included some internal source code. No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We’re rolling out measures to prevent this from happening again.”

The package was pulled, the bucket access was revoked, and the affected version was removed from npm. But the archive had already been downloaded, mirrored, and in some corners of the internet — preserved indefinitely.

The Technical Root Cause

The failure was mundane, as many security incidents are.

Claude Code is bundled with Bun, a JavaScript runtime whose bundler generates source maps by default — including in production mode. A .npmignore entry to exclude the .map file was missing from the release packaging. That single omission meant the source map shipped alongside the published package.

This was not a new risk. A GitHub bug report (oven-sh/bun#28001, filed March 11, 2026) had already described Bun serving source maps in production contexts even when not explicitly requested. And critically, this was not even the first time it had happened: a similar — if smaller — source map leak had occurred in February 2025 with an earlier Claude Code release. Anthropic removed that package at the time, but the underlying packaging process was evidently not hardened sufficiently to prevent recurrence.

The chain of failure:

1. Bun’s default source map generation behavior
2. No .npmignore exclusion for .map files
3. Source map referencing an externally accessible R2 bucket
4. Bucket lacking access controls for production artifacts

Each link was known or knowable. Together they created a window that lasted hours and exposed months or years of internal engineering work.

What Was Inside ?

Anthropic confirmed no customer data or credentials were exposed. But the leaked source was still significant.

Among the more notable findings reported from those who examined the code:

An “Undercover Mode” capability. Multiple outlets, including The Register and VentureBeat, reported that the source contained internal prompt scaffolding that included a directive roughly paraphrased as “Do not blow your cover” — suggesting an operational mode in which Claude Code is designed not to reveal it is an AI system in certain automated or agentic contexts. The full wording and context remain unverified from primary sources, and Anthropic has not commented specifically on this.

Internal architecture and feature flags. The ~1,906 files gave observers a detailed view of how Claude Code is structured, what experimental features are gated, and how its orchestration layer works. This is commercially sensitive if not personally sensitive.

Engineering judgment calls, in the open. Source code is a record of decisions: what was tried, what was abandoned, what tradeoffs were made. For a company competing in a rapidly accelerating AI tooling race, having that decision record visible to competitors is not trivial.

What was not leaked, according to Anthropic: model weights, customer data, API keys, user conversation history, or system credentials. This distinction matters — the severity of a source leak is categorically lower than a data leak or credential exposure.

Evaluating the Incident

Anthropic’s response was fast and accurate. The company confirmed the issue publicly the same day, characterized it correctly as a packaging error rather than a breach, and did not overstate or understate the impact. That transparency is notable and worth crediting.

The root cause is genuinely embarrassing. A source map misconfiguration is not a sophisticated attack or novel threat vector. The class of error — shipping a file that should have been excluded — is something most organizations catch with basic release checklists or automated artifact scanning. Missing it once is understandable. Missing it a second time, more than a year after a similar incident, suggests the February 2025 event did not trigger a durable systemic fix.

The “no customer data” framing, while accurate, can obscure the real concern. The relevant question for a company building AI products is not just whose data was exposed, but what does this reveal about internal capability and design choices? Competitors, regulators, and researchers now have a cleaner picture of Claude Code’s internals than Anthropic intended. Source code is intellectual property. Internal prompt scaffolding reflects product strategy. Those are real assets, and they leaked.

The Bun dependency is a genuine risk surface. Shipping a closed-source production tool bundled with a runtime that enables source maps by default is a configuration posture that requires active caution. If the team was not previously tracking Bun’s source-map generation behavior as a release risk, that gap is now documented — in public.

The timing compounds the optics. March 31 is one day before April 1. Reactions online were predictably muddled, with some dismissing early reports as a prank. That ambiguity — even briefly — delayed the kind of sober analysis the incident deserved.

Impact

For Anthropic: Reputational cost is real but probably contained. The company’s handling of the disclosure was competent. The deeper concern is competitive exposure: a detailed view of internal tooling architecture, prompt scaffolding approaches, and feature-gating strategies is now in the hands of anyone who downloaded the archive in that window. That information does not expire.

For users of Claude Code: Direct impact is minimal if Anthropic’s statement is accurate. No credentials, no conversation history, no personal data was exposed. Users running 2.1.88 should update to the latest version, but there is no evidence of exploitation or downstream risk to user systems.

For the broader AI tooling industry: This is a reminder that the security surface of AI developer tools is not just model weights and inference infrastructure — it is also the release pipeline, the build tooling, and the packaging configuration. These are mundane software supply chain concerns, not exotic AI-specific threats. The industry has not fully internalized that yet.

For Anthropic’s enterprise customers: The “Undercover Mode” finding — whatever its actual scope — will generate questions. Enterprise buyers who deploy Claude Code in sensitive environments will want clearer documentation of what agentic modes exist, when they activate, and what disclosures they suppress. That conversation was coming eventually; this leak accelerates it.

What to Watch Going Forward

1. Will Anthropic publish a detailed post-mortem? The public statement was a paragraph. A thorough post-mortem — covering the February 2025 incident, the gap between that event and the March 2026 recurrence, and the specific remediation steps — would demonstrate that the organizational learning actually happened this time. Silence or a minimal follow-up would be the more worrying signal.

2. The Bun source map issue needs a named owner. The Bun bug report (oven-sh/bun#28001) is a real upstream issue. Whether Anthropic pushes for a fix, works around it in their build tooling, or adopts a different bundler for production artifacts is worth watching. The risk does not disappear just because the bucket is now locked.

3. The “Undercover Mode” question will not go away. If the leaked code contained internal prompt scaffolding around concealed-AI behavior, that raises substantive questions about AI transparency that go beyond a packaging error. Regulators in the EU (under the AI Act) and increasingly in the US have begun asking whether AI systems must disclose their nature in certain contexts. If Claude Code has a mode that suppresses such disclosure, Anthropic needs to explain its scope, its purpose, and its boundaries — proactively, not reactively.

4. Supply chain hygiene for AI tooling is an underrated risk. This incident is a data point in a larger pattern: AI companies are shipping complex software products to developers’ machines, often bundled with new runtimes and build tools, under competitive pressure to ship fast. Standard supply chain security practices — artifact signing, automated .npmignore validation, build output scanning, access controls on artifact storage — need to be treated as table stakes, not optional. The first company in this space to have a genuinely serious supply chain compromise will face consequences far worse than a source map leak.

5. Watch what the archive reveals over time. Archives circulate. Researchers, competitors, and journalists are still working through 512,000 lines of TypeScript. The full implications of what was inside may take weeks to fully surface. Keep attention on what thoughtful technical analysis — not viral thread speculation — finds in the months ahead.

The Bottom Line

The Claude Code source leak of March 31, 2026 was a packaging error, not a hacking incident. Anthropic’s response was accurate and reasonably prompt. No customer data was exposed.

But a packaging error that reveals hundreds of thousands of lines of internal code, internal prompt scaffolding, and architectural decisions — and that repeated a failure pattern from fourteen months earlier — is not a minor slip. It is a symptom of release process maturity that has not kept pace with the product’s profile and sensitivity.

The question now is not whether Anthropic can recover from this. They will. The question is whether the industry — including Anthropic — will treat this as the category of infrastructure problem it actually is, or whether it will be filed under “human error, lesson learned” and forgotten until the next one.