Yesterday during my lunch break, I was leaning back in my chair scrolling through tech news when a headline nearly made me spit out the coffee in my mouth—Anthropic, the company famous for putting “AI safety first” and valued at a hefty $60 billion, had personally uploaded the complete source code of its most core product to the public internet.
This wasn’t a hacker intrusion, wasn’t an internal betrayal. It was just a config file someone forgot to delete.
Reconstructing the Incident: A Bloodbath Caused by One .map File
The cause of the incident was so simple it was almost absurd.
On March 30, 2026, Anthropic published version 2.1.88 of the Claude Code command-line tool via npm. However, this release package accidentally included a 59.8 MB cli.js.map file.
A Source Map file is originally a debugging tool for the development phase, used to map minified, obfuscated JavaScript code back to human-readable original TypeScript source. Normally, such files exist only in the development environment, and should absolutely never appear in a software package published to the public internet.
But there it was.
Security researcher Chaofan Shou was the first to discover the problem. Unzip that package, and inside lie over 1,900 files and 512,000 lines of TypeScript code—the complete underlying logic of Claude Code, laid bare in front of everyone.
What Was Leaked?
This is no simple command-line tool. Judging from the leaked code, Claude Code is far more complex than the outside world imagined:
Core Architecture
- QueryEngine.ts: A core file a whopping 46,000 lines long, responsible for handling all reasoning logic, token counting, and the chain-of-thought loop
- 40+ tool modules: Not only able to read and write files and execute Bash commands, but also with built-in LSP protocol integration and sub-agent generation capability
- React + Ink: Based on a terminal UI framework, running on the Bun runtime
Unreleased Features
Even more unexpected are the several unreleased features hidden in the code:
KAIROS—an AI daemon that never goes offline
This is an autonomous background mode with a “persistent life.” When the user is idle, it keeps running in the background, consolidating project memory, planning the next tasks, and even handling the logic of a “midnight boundary” to prevent process interruption.
BUDDY—an electronic pet system
Yes—built into the code is a complete Tamagotchi-style electronic pet system, with 18 species in total (duck, dragon, capybara, salamander…), rarity tiers, shiny variants, and five attributes: debugging power, patience, chaos, wisdom, and snark.
Undercover Mode
Anthropic’s engineers routinely use Claude Code to submit code to public open-source repositories. To avoid exposing the fact that “an AI is participating in open-source contributions,” the system has a dedicated built-in counter-surveillance mechanism. Once it detects that the current repository is public, undercover mode activates automatically and injects a special system prompt into the model—requiring it not to reveal internal codenames and not to admit it’s an AI.
Ironically, this carefully designed confidentiality system was made public to the whole world, right along with the source code.
Anthropic’s Response
After the incident, Anthropic issued a brief statement to the media:
“Earlier today, a Claude Code release included some internal source code. This was a release packaging issue caused by human error, not a security breach. No user data or credentials were affected. We are rolling out measures to prevent this from happening again.”
Concise and to the point, with no extra explanation.
What Does This Incident Mean?
1. The Double-Edged Sword of Technological Equality
For the global AI developer community, this is undoubtedly “manna from heaven.” As a closed-source benchmark, Claude Code’s internal implementation has always been a “black box” to the outside world. Now this “factory development manual” is laid open in front of everyone.
The leaked code reveals the best practices of agent engineering: permission control and sandbox mechanisms, context management and truncation strategies, tool-calling loops and error recovery… These problems that previously required extensive trial and error to figure out now have a clear reference.
It’s foreseeable that in the coming months, all kinds of agents based on or borrowing from Claude Code’s architecture will emerge in large numbers.
2. Security Risks Cannot Be Ignored
But there’s another side to the story.
What was leaked is a battle-tested, engineering implementation of an AI agent that represents the current highest global standard. This is tantamount to a country in the nuclear age accidentally making public the complete engineering blueprints of its most advanced nuclear warhead.
- Safety guardrails systematically deconstructed: Attackers can carefully analyze Claude Code’s safety mechanisms and design dedicated jailbreak prompts or attack paths
- Attack vectors directly revealed: The code may expose potential attack vectors such as SSRF
- Supply-chain poisoning risk: Attackers can create a backdoored “modified version” of Claude Code for distribution
3. A Wake-Up Call for Engineering Culture
More noteworthy is that this is already Anthropic’s second security incident within a week.
Five days earlier, due to a content management system misconfiguration, about 3,000 unreleased internal assets (including drafts of the Claude Mythos model) were publicly accessible.
This repeated failure at the basic operations level forms a glaring contrast with the company’s cutting-edge investment in model safety research. It exposes an unsettling reality: when AI companies push the technological frontier forward at astonishing speed, basic engineering safety practices are standing still.
What We Can Learn
As a developer, this incident sounded several alarm bells for me:
1. Automated Checks Are Not Optional
If Anthropic’s CI/CD pipeline had had one automated check—scanning release packages for .map files—this incident could have been completely avoided. An automated safety check before npm publish should be as standard as unit tests.
2. Safety Can’t Just Be “Research”—It Must Be “Practice”
Anthropic invests enormously in AI safety research, but when a company that sells “safety” as its selling point can’t even control its basic code release process, we can’t help but ask: the “AI safety” they talk about—does it mean preventing AI from harming humans, or does it also include preventing humans from harming AI?
3. Don’t Put All Your Eggs in One Basket
This incident reminds us once again not to stake core assets on a single platform or a single process. Multi-layered protection and defense in depth—these old-school security principles still apply in the AI era.
Final Thoughts
Interestingly, the time window of this leak overlapped heavily with another independent supply-chain attack. If you installed or updated Claude Code via npm between 08:21 and 11:29 Beijing time on March 31, your project may have been implanted with a malicious axios version containing a remote access trojan.
I recommend immediately checking your project’s lock file for the axios 1.14.1 or 0.30.4 version, or the plain-crypto-js dependency. If found, treat the system as fully compromised, rotate all credentials, and reinstall the system.
Just when the major AI companies were still arguing red-faced over “open source” versus “closed source,” Anthropic laid its cards directly out in the sunlight in the most dramatic way possible.
512,000 lines of code, hidden electronic pets, a trace-erasing undercover system, and a next-generation model called Capybara…
That night, developers worldwide shared a top-grade takeout delivery from Silicon Valley.
But let’s take this as an opportunity—to re-examine the gap between engineering practice and security culture. After all, technology can run fast, but security must keep up.
评论
0 条评论