How Anthropic Accidentally Exposed 512,000 Lines of Its Most Valuable Source Code — and What Every Organization Can Learn From It

At 4:23 AM Eastern Time on March 31, 2026, an intern at Solayer Labs posted a discovery on X that would define one of the most consequential intellectual property incidents in the brief history of the commercial AI industry. A publicly available npm package — @anthropic-ai/claude-code version 2.1.88 — contained something it was never supposed to: a 59.8 MB JavaScript source map file embedding the complete, unobfuscated TypeScript source code of Claude Code, Anthropic's terminal-based AI coding agent.

The post included a direct download link. Within hours, the codebase had been mirrored across GitHub and forked tens of thousands of times. By the time Anthropic issued its first public statement, the damage was effectively irreversible.

#

What Was Exposed

Claude Code is not the underlying AI model itself. Claude's weights — the trained parameters that constitute its intelligence — were not part of the leak. What was exposed was the software architecture that wraps that intelligence and makes it commercially useful: the orchestration logic, the permission and execution systems, the memory consolidation mechanisms, the internal feature flags, and the product roadmap embedded in the code comments.

The leaked file contained approximately 513,000 lines of unobfuscated TypeScript across 1,906 files. Among its most significant disclosures were internal codenames for unreleased models — Capybara and Fennec, corresponding to variants of Claude 4.6 — along with performance benchmarks, engineering constraints, and the architecture of an autonomous background agent mode referred to internally as KAIROS.

The exposure was compounded by a coincidence of timing. In the same hours that the source code was spreading across the internet, a separate and unrelated supply chain attack had introduced malicious versions of the widely-used Axios npm library, containing embedded Remote Access Trojans. Threat actors moved quickly to exploit the confluence of both events, publishing fake GitHub repositories purporting to host the "leaked Claude Code" as a vehicle for distributing Vidar infostealing malware.

#

What Went Wrong

Anthropic's own statement was unambiguous: this was a release packaging error caused by human error, not a security breach in the conventional sense. No attacker penetrated Anthropic's systems. No vulnerability was exploited. A source map file — a tool intended to assist internal debugging by mapping compiled JavaScript back to its original TypeScript — was mistakenly included in a public npm package release.

The error is technically straightforward to understand. Build pipelines that produce software packages for public distribution must explicitly exclude internal artefacts. When that exclusion is not enforced — whether through a misconfigured build script, a missing .npmignore entry, or an absent review step — internal files follow the code into production distribution.

The deeper issue is one of process governance. A file of nearly 60 MB containing 500,000 lines of proprietary source code was included in a public release without triggering any automated or manual check that identified its presence before publication. For an organization of Anthropic's scale and the commercial sensitivity of the asset involved, that gap represents a process failure of significant consequence.

#

The Downstream Risk

Beyond the intellectual property dimension, the leak has created a durable security risk that will outlast any DMCA enforcement action. With full source visibility, threat actors can identify and weaponize existing vulnerabilities with a precision that was previously unavailable to them. Two CVEs — CVE-2025-59536 and CVE-2026-21852 — covering remote code execution and API key exfiltration paths, were identified in the exposed codebase and are now substantially easier to exploit with the underlying logic visible.

From a legal standpoint, the situation is complicated by an emerging question in intellectual property law. Anthropic's own engineering leadership has acknowledged that significant portions of Claude Code were written by Claude itself. A January 2025 ruling by the U.S. Copyright Office, left intact by the Supreme Court's March 2026 refusal to review Thaler v. Perlmutter, holds that works predominantly generated by AI without meaningful human authorship are not eligible for copyright protection. The question of whether Anthropic can enforce copyright over a codebase substantially authored by its own AI product remains unresolved.

#

What Organizations Should Take From This

The Claude Code leak is instructive not because Anthropic is an unusually negligent organization, but because it demonstrates how a single process gap in a routine operational function can produce consequences of a scale and permanence that no post-incident response can fully address.

For any organization that manages proprietary software and uses automated build and distribution pipelines, the incident warrants an immediate audit of what those pipelines include, exclude, and verify before publication. Source maps, configuration files, environment variable references, and internal documentation represent categories of sensitive artefact that should be explicitly accounted for in package assembly and verified as absent before any public release.

The technical fix is straightforward. The organizational discipline required to apply it consistently is the harder problem — and the one that Anthropic's experience demonstrates cannot be left to assumption.

---
This article will be updated as new information emerges. Last updated: April 2026.