Another Anthropic Leak... This Time, Claude Code's Source Code

A security researcher discovered and shared a link on X (formerly Twitter) to Anthropic's Claude Code source code, a command-line interface (CLI) tool for developers to interact with Claude models. The post quickly amassed millions of views and thousands of GitHub forks before Anthropic could scrub old versions of their public NPM package. This accidental exposure—caused by a forgotten .map.js debugging file—revealed over 500,000 lines of TypeScript across 1,900 files, including tools, permissions, internal codenames, and a roadmap of 44 unreleased product releases already built and awaiting launch.

How the Leak Occurred

The code became publicly accessible through Anthropic's own NPM package for Claude Code, which inadvertently included a source map file linking to a zip of the full codebase in their cloud storage. Anyone could download it directly. This marks the second such leak in five days, following one about unreleased models. Ironies abound: Anthropic's "undercover mode"—designed to strip internal codenames like animal references (e.g., Capybara) from public commits—failed here due to a build oversight. Developers have already forked the code, plugging in open-source models like DeepSeek or Qwen to create custom versions, treating it as a reusable "chassis" or harness around any AI "engine."