How Did Anthropic Leak Claude Code's Source?

TL;DR

Claude Code's readable TypeScript source was allegedly exposed because a development source map was included in a published npm package. The material reportedly revealed a prompt-driven architecture, hard-coded guardrails, anti-distillation tactics, bash execution logic, telemetry, and possible unreleased features, showing how one packaging mistake can expose both implementation details and product plans.

Transcript

Yesterday, the most ironic thing ever happened. Anthropic, a $380 billion startup built on the idea of safety first that advocates for closed source software for the supposed benefit of humanity, a company Elon calls Missanthropic, whose logo is definitely not a sphincter, whose CEO has been warning us for years that human programmers will be repla... Read More

Key Insights

• The alleged exposure began when an npm release included a development source map containing readable project code. Because source maps can preserve links to original sources, packaging one with a production release reportedly made Claude Code's TypeScript implementation accessible to anyone downloading the package.
• The precise cause of the source map's inclusion is unresolved. The account notes that Claude Code uses Bun.js and mentions a related production source-map issue, but it also considers an accidental developer action or deliberate disclosure without claiming that any explanation was proven.
• Claude Code is described as a multi-stage prompt orchestration system rather than a single model call. User input passes through a sequence involving hidden instructions, hard-coded strings, guardrails, tool handling, and TypeScript logic before the system produces its final coding response.
• The anti-distillation mechanism reportedly introduces references to tools that do not actually exist. The stated purpose is to contaminate outputs used by competitors for model training, causing copied systems to learn misleading tool behavior instead of accurately reproducing Claude Code's real capabilities.
• The bash tool is presented as a central part of the coding assistant because it helps the model parse and execute shell commands reliably. Its implementation reportedly contains extensive logic, suggesting that dependable command handling requires substantial conventional software around the language model.
• Undercover mode is described as instructions that prevent Claude from naming itself in commit messages or related outputs. The stated reason is to avoid leaking model code names, while the account also presents unverified speculation that it could make AI-generated contributions appear human-authored.
• The frustration detector reportedly uses regular-expression matching to identify certain words in user prompts and then logs an event. This feature illustrates how ordinary pattern matching and telemetry can sit alongside advanced language models to monitor whether users appear dissatisfied with a coding interaction.
• The exposed feature flags reportedly referenced a customizable companion, advanced planning modes, coordination features, model names, and a background agent. That agent appears designed to keep a daily journal, consolidate memories through dream mode, and perform scheduled work, although some references may be jokes or experiments.

Questions & Answers

Q: How was Claude Code's source allegedly leaked?

Claude Code's readable source was allegedly exposed through a source map included in an npm package release. A source map is described as a development file that can contain or point back to readable project sources. Once researchers noticed the unusually large file, the material reportedly spread through mirrors and derivative repositories, making later takedown efforts unable to contain it.

Q: What did the alleged Claude Code source reveal?

The material reportedly revealed that Claude Code combines model calls with TypeScript orchestration, dynamic prompts, hard-coded instructions, guardrails, telemetry, and tool implementations. It also exposed mechanisms for handling bash commands, discouraging model distillation, hiding Claude attribution, and detecting frustrated users. Internal feature names and flags additionally suggested experiments or possible future product capabilities.

Q: Why was a source map included in the npm package?

The account does not establish a definitive reason. It notes that production build tools normally remove source maps and raises a previously reported Bun.js production source-map issue as one possible connection. It also considers ordinary developer error and deliberate disclosure. These are presented as possibilities, so the available material does not prove which event caused the package to include readable sources.

Q: How does Claude Code process a coding request?

Claude Code is described as processing input through a multi-stage pipeline rather than sending a user prompt directly to a model. Hidden instructions, dynamic prompt construction, hard-coded guardrails, tool definitions, command-handling logic, and TypeScript orchestration shape the request and response. The account uses this architecture to argue that the assistant depends heavily on conventional software surrounding the underlying language model.

Q: What are Claude Code's anti-distillation poison pills?

The alleged anti-distillation system works by making Claude refer to tools that are not actually available. If another developer trains a model on those outputs, the copied model may learn incorrect assumptions about the assistant's toolset and behavior. The tactic is intended to make imitation less reliable, although exposing the implementation could help competitors identify and filter those misleading references.

Q: What is undercover mode in Claude Code?

Undercover mode is described as a collection of instructions telling Claude not to mention itself in commit messages or other outputs where attribution could appear. Its stated purpose is to prevent model code names from leaking. The account also discusses speculation that it could make AI-generated work look human-authored, but it does not provide proof that deception is the feature's actual purpose.

Q: How does Claude Code detect user frustration?

Claude Code reportedly checks prompts with regular-expression matching for selected words associated with a poor coding experience. When the pattern matches, the system logs an event rather than applying a complex emotional analysis process. The feature therefore appears to use straightforward text matching and telemetry, illustrating how simple programming techniques can support monitoring around a sophisticated language model interface.

Q: What unreleased Claude Code features were mentioned?

The alleged source referenced a customizable companion called Buddy, planning and coordination modes, model names, and a feature called Chyus. Chyus appears to be a background agent that keeps a daily journal, uses dream mode to consolidate memories, and performs scheduled work. The account cautions that at least some references could be jokes, experiments, or unreleased concepts rather than confirmed products.

Summary & Key Takeaways

• A Claude Code npm release allegedly included a large source map containing readable TypeScript. The material spread rapidly through mirrors and derivative projects, while Anthropic reportedly issued takedown notices. The precise cause remains uncertain, with the account considering build behavior, accidental packaging, and deliberate action as possible explanations.

• The exposed implementation is portrayed as a multi-stage system built from dynamic prompts, TypeScript orchestration, hard-coded instructions, guardrails, and a limited toolset. Particularly notable elements include extensive bash-command handling, fabricated tool references intended to hinder distillation, instructions that suppress Claude attribution, and simple pattern matching for signs of user frustration.

• The material also reportedly contained feature flags and internal names suggesting possible future capabilities. These included a customizable companion, planning and coordination modes, model references, and a background agent that journals, consolidates memories through dream mode, and performs scheduled work. Some entries may instead have been jokes or experiments.