Claude Code Source Code Exposed: What Happened and What It Revealed

CTO

31 March 2026

What Happened

On 31 March 2026, security researcher Chaofan Shou discovered that Anthropic's Claude Code CLI tool had its complete source code exposed through a misconfigured npm package. The exposure was not a security breach or hack. It was a packaging error, a .map sourcemap file that should have been excluded from the production build was accidentally included in the npm registry.

Sourcemap files are standard debugging tools used during development. They map minified production code back to the original source. When included in a published package by mistake, they effectively expose the entire unminified codebase. As software engineer Gabriel Anhaia noted, "A single misconfigured .npmignore or files field in package.json can expose everything."

The sourcemap file referenced an unobfuscated TypeScript source, which pointed to a zip archive hosted on Anthropic's Cloudflare R2 storage bucket containing the full codebase.

How It Spread

Once discovered, the exposed code was quickly backed up to GitHub repositories. The most notable backup, hosted by a user called Kuberwastaken, was forked more than 41,500 times before the original uploader replaced the repository content with a Python port, citing liability concerns. Despite this, numerous mirrors remained accessible across GitHub.

The incident gained significant attention on Reddit's r/ClaudeAI community and was covered by multiple technology publications including The Register and VentureBeat.

What the Code Revealed

The exposed archive contained approximately 1,900 TypeScript files totalling over 512,000 lines of code. The codebase provided a detailed look at how a production AI coding agent is built, including:

Architecture: Claude Code uses a 785KB main.tsx entry point with a custom React terminal renderer. The tool includes over 40 built-in tools with a permission-based access control system, multi-agent orchestration capabilities, and a coordinator mode for managing complex tasks.

Unreleased features: The code contained several features gated behind compile-time flags that had not been publicly announced. These included a persistent assistant mode, remote planning sessions with extended thinking time, and a background memory consolidation system that processes session logs into durable memories.

Permission system: The source revealed a machine learning-based auto-approval classifier for tool permissions, alongside the manual permission controls that users interact with directly.

Prompt caching: The code showed implementation details for prompt caching with static versus dynamic boundary markers, a technique for reducing API costs and latency.

Anthropic's Response

Anthropic responded promptly, confirming the incident was "a release packaging issue caused by human error, not a security breach." The company stated that no customer data or credentials were exposed and that it was "rolling out measures to prevent this from happening again."

It is worth noting that Claude Code's internals had been partially reverse-engineered by the community before this incident, with dedicated websites tracking exposed features and system prompts. The full source exposure, however, provided a far more complete picture than previous efforts.

What This Means for AI Development Tools

The incident highlights a few important points for the AI industry:

Build configuration matters. Even the most sophisticated AI companies can be caught out by basic packaging mistakes. The .npmignore and files fields in package.json are critical gatekeepers for what gets published to npm. Automated checks in CI/CD pipelines can catch these issues before they reach production.

AI agent architecture is maturing. The exposed codebase showed a well-structured, production-grade AI agent with sophisticated tool management, permission systems, and memory capabilities. This gives the wider developer community a reference point for how complex AI coding tools are built at scale.

Transparency has value. While accidental, the exposure gave developers and researchers insight into how AI coding assistants work under the hood. Several commentators noted that the architectural patterns, particularly around tool orchestration and permission management, could inform the broader open-source AI tooling ecosystem.

Key Takeaway

This was a routine packaging error with outsized consequences. No customer data was compromised, and the exposed code revealed a thoughtfully engineered product. For development teams working with npm packages, it serves as a timely reminder to audit your build configurations and ensure sourcemaps and other development artefacts are excluded from production releases.

Sources

This article was compiled from the following sources:

Ready to put AI to work in your business?

Book a free 30-minute discovery call. We will discuss your goals, identify quick wins, and outline a practical plan to get started.

Book a discovery call