Anthropic Leaked 512,000 Lines of Claude Code Source. Here's What the Code Actually Reveals.

On March 31, 2026, Anthropic accidentally published a source map file in their npm package that contained the complete TypeScript source code of Claude Code — 1,900 files, 512,000+ lines of code, including internal prompts, tool definitions, 44 hidden feature flags, and roughly 50 unreleased commands. Developer comments were preserved. Operational data was exposed. A GitHub mirror hit 9,000 stars in under two hours. Anthropic issued DMCA takedowns affecting 8,100+ repository forks within days.

This is a breakdown of what the source code actually reveals — not the drama, but the engineering. --- **How the Leak Happened** The culprit was a .map file — a source map artifact. Source maps contain a sourcesContent array that embeds the complete original source code as strings. The fix is trivial: exclude *.map from production builds or add them to .npmignore. This was the second incident — a similar leak occurred in February 2025. The operational complexity of shipping a tool at this scale appears to have outpaced DevOps discipline. --- **The Architectural Picture** The most technically honest takeaway from this leak is: the competitive moat in AI coding tools is not the model. It is the harness. Claude Code runs on Bun (not Node.js) — a performance decision. The terminal UI is built with React and Ink — a pragmatic choice allowing frontend engineers to use familiar component patterns. The tool system accounts for 29,000 lines of code just for base tool definitions. Tool schemas are cached for prompt efficiency. Tools are filtered by feature gates, user type, and environment flags. The multi-agent coordinator pattern is production-grade and visible in the code: parallel workers managed by a coordinator, XML-formatted task-notification messages, shared scratchpad directory for cross-agent knowledge transfer. This is exactly what developers building multi-agent systems today are trying to implement — and now there's a reference implementation to study. The YOLO permission system uses an ML classifier trained on transcript patterns to auto-approve low-risk operations — a production example of using a small fast model to gate a larger expensive one. --- **The Unreleased Features Worth Understanding** Three unreleased capabilities behind feature flags are architecturally significant: KAIROS is an always-on background agent that maintains append-only daily log files, watches for relevant events, and acts proactively with a 15-second blocking budget to avoid disrupting active workflows. Exclusive tools include SendUserFile, PushNotification, and SubscribePR. KAIROS is the clearest signal available about where AI assistants are heading: from reactive tools that wait for commands to persistent background companions that monitor and act on your behalf. This is not a Claude Code feature. This is a preview of the next generation of all AI assistants. ULTRAPLAN offloads complex planning to a remote Cloud Container Runtime using Opus 4.6 with 30-minute think time — far beyond any interactive session. A browser-based UI surfaces the plan for human approval. Results transfer via a special __ULTRAPLAN_TELEPORT_LOCAL__ sentinel. This is async deep thinking as a product feature: separate the computationally expensive planning phase, run it at maximum model time, surface results for review. BUDDY is a Tamagotchi-style companion pet system: 18 species across 5 rarity tiers (Common 60%, Uncommon 25%, Rare 10%, Epic 4%, Legendary 1%), independent 1% shiny chance, procedural stats (Debugging Skill, Patience, Chaos, Wisdom, Snark), ASCII sprite rendering with animation frames. Uses the Mulberry32 deterministic PRNG for consistent pet generation. Beneath the novelty: this exercises session persistence, personality modeling, and companion UX — all capabilities Anthropic is building for more serious agent memory systems. --- **The Anti-Distillation Contradiction** The source code revealed a system designed to inject fake tool definitions into Claude Code's outputs to poison AI training data scraped from API traffic. The code comment explicitly states this measure is now "useless" — because the leak exposed its existence. This is the most intellectually interesting artifact in the entire codebase. The security mechanism depended entirely on secrecy, not technical robustness. Once the code was visible, the trick stopped working. The same applies to hidden feature flags, internal codenames, and internal roadmap references — many AI product security models are built on "if nobody sees the code, nobody can replicate it." That assumption is now broken. Claude Code's internal codename was also confirmed as "Tengu." --- **The Code Quality Question** Developer reactions to the code were mixed. Some described the architecture as underwhelming relative to the tool's capabilities. Others noted the detailed internal comments as useful context for understanding agent behavior. The frustration detection system, notably, uses a regex rather than an LLM inference call — likely for cost and latency reasons. Developer comments also revealed operational data: approximately 1,279 sessions per day experienced 50+ consecutive failures, burning roughly 250,000 wasted API calls daily. Building reliable agentic systems at scale is genuinely hard, and the numbers confirm it. --- **What This Means for the Ecosystem** The contrast with OpenAI's approach is sharp. OpenAI open-sourced Codex CLI under Apache 2.0 in April 2025. Today it has 60,000+ GitHub stars and 363 contributors. While Anthropic scrambled to contain their leak and issue DMCA takedowns, OpenAI was already winning on transparency. The open-vs-closed debate has fully transferred from AI models to AI tools. The architectural patterns visible in Claude Code — multi-agent orchestration, always-on background agents, ML-based permission systems, persistent session memory, extended thinking for complex planning — represent a clear roadmap for where all AI development tools are heading. The question for the ecosystem is not whether these capabilities will ship, but which teams will execute on these patterns most effectively, and whether they'll do it in the open or behind closed doors. --- **Key numbers to keep in mind:** - 512,000+ lines of TypeScript exposed - 1,900 files in the leak - 44 feature flags hiding unreleased capabilities - 40+ built-in tools in the registry - 30 minutes of extended thinking in ULTRAPLAN - 15-second blocking budget for KAIROS proactive actions - 250,000 wasted API calls per day from failed sessions - 8,100+ repository forks affected by DMCA takedowns --- No editorial opinion on whether the leak was good or bad. Just the engineering.