Anthropic Accidentally Leaks Claude Code Source Code

Anthropic has inadvertently exposed the complete source code of Claude Code, its terminal-based AI coding agent, via a publicly accessible source map file in the npm registry. 

The issue was flagged by Chaofan Shou, Co-founder of security firm Fuzzland, who posted on X that the source code had been leaked through leftover source map files in the npm registry. 

“Claude code source code has been leaked via a map file in their npm registry!” he posted on X.

At the time of writing, Anthropic has not issued a public response.

The leak reveals the tool’s internal architecture, tool implementations, multi-agent workflows, and potentially unreleased features.

It exposed an unobfuscated codebase of roughly 57–59.8 MB, spanning over 500,000 lines across 1,900+ files. The leak revealed internal features, including Undercover Mode, system prompts, feature flags, unreleased models like Capybara, and employee-only tools.

The Claude Code command-line tool does not include model weights or user data. While this means there is no direct risk to user information, the exposure makes internal elements such as system architecture, security design, and telemetry mechanisms visible to the public.

The leak mirrors a similar incident in early 2025 when an earlier version of the package briefly exposed a source map before Anthropic removed the affected versions from the registry.

The leaked codebase was rapidly archived on a public GitHub repository, where it drew close to 22,000 stars within hours of being discovered.

The incident was reportedly caused by a packaging error in which a file intended to remain private was inadvertently included in a public release. There is no indication of a breach or external attack.

Justin Schroeder, a full-stack developer at FormKit, in a post on X, explained that a significant portion of system prompts appears to be embedded directly in the client-side code, raising questions about how Anthropic manages prompt-related intellectual property, which is typically expected to be handled server-side. 

The codebase also relies on axios, a widely used library that has recently faced security concerns, pointing to ongoing risks from software supply chain dependencies.

Reviewers on Reddit, GitHub, and X noted extensive inline comments designed to help AI systems interpret the code, suggesting the repository is structured for machine readability as much as for human developers. 

The toolset itself remains relatively compact, with fewer than 20 core tools handling most coding workflows, reinforcing a design preference for simplicity.

Schroeder described the ‘Bash’ tool as a central component, with detailed logic to classify and process command types. The entire system is built using TypeScript and React, with explicit integration through Bun.

Despite the exposure, he cautions that the code is not open source and remains subject to licensing restrictions. Unauthorised use or redistribution could violate those terms.