Research / Anthropic Claude Code leak

Anthropic Claude Code leak

Anthropic Claude Code leak: architecture, prompting, and hidden features

2026-04-02 · agentic-ai ai-architecture tools-infrastructure security-risk llm-reasoning · medium · source → · wiki →
key claims
  1. The leak was a packaging error: a JavaScript (JS) source map file was not excluded from the npm package, exposing the full TypeScript source via a trivially reversible reconstruction
  2. No model weights, training data, or user conversations were exposed -- only the orchestration and harness layer
  3. The architecture is modular and permissioned: 40-60 tools, each with explicit permission checks enforced by a central orchestration loop, implementing safety-by-architecture rather than safety-by-policy alone
  4. A five-level configuration cascade and seven-stage session bootstrap provide fine-grained, layered control over every agent session
  5. The CLAUDE.md hierarchy (global, org, project, subdirectory) loads up to 40,000 characters of persistent custom instructions per session, functioning as a RAG-style retrieval of project-specific context
  6. The three-tier memory system -- session compaction (nine segments), pointer-index `MEMORY.md`, and AutoDream async consolidation -- addresses long-session context drift without flooding the model context window
  7. 44+ named feature flags were found in the source, enabling per-user, per-cohort, and per-environment feature control without redeployment
  8. KAIROS (always-on daemon with background tick, proactive insights, and GitHub webhook monitoring), BUDDY (virtual pet with 18 species and gamified stats), Undercover Mode (AI-attribution stripping for public repos), UltraPlan (30-minute autonomous planning cycles), and Voice/Bridge Mode (STT and WebSocket remote access) are confirmed unreleased features

Research Question

What does the accidental March 2026 leak of Anthropic's Claude Code source code reveal about: (1) the codebase architecture, (2) how key engineering problems are solved, (3) the prompting and instruction strategy, (4) feature-flagging practices, (5) hidden features, (6) the product roadmap, (7) lessons for prompt engineering using skills, memory, Retrieval-Augmented Generation (RAG)-style patterns, and tool descriptions, and (8) any other insights for practitioners building agent systems?

Findings

(Populated from §6 Synthesis above.)

Executive Summary

On March 31, 2026, a missing .npmignore entry in @anthropic-ai/claude-code version 2.1.88 exposed a 59.8 MB source map containing 512,000 lines of TypeScript and 1,900+ files -- the complete orchestration harness for Anthropic's Claude Code coding agent. No model weights or user data were leaked. The code confirmed a modular, permissioned tool architecture, a three-tier memory system, and a RAG-style instruction hierarchy via CLAUDE.md. Analysis revealed 44+ feature flags gating at least five major unreleased capabilities (KAIROS autonomous daemon, BUDDY virtual pet, Undercover Mode AI-attribution stripping, UltraPlan extended planning, and Voice/Bridge remote access). The roadmap signals a move toward a persistent, proactive, multi-agent software engineering platform. For practitioners, the leak is a masterclass in production-grade agent harness design.

Key Findings

  1. [fact] The leak was a packaging error: a JavaScript (JS) source map file was not excluded from the npm package, exposing the full TypeScript source via a trivially reversible reconstruction.
  2. [fact] No model weights, training data, or user conversations were exposed -- only the orchestration and harness layer.
  3. [fact] The architecture is modular and permissioned: 40-60 tools, each with explicit permission checks enforced by a central orchestration loop, implementing safety-by-architecture rather than safety-by-policy alone.
  4. [fact] A five-level configuration cascade and seven-stage session bootstrap provide fine-grained, layered control over every agent session.
  5. [fact] The CLAUDE.md hierarchy (global, org, project, subdirectory) loads up to 40,000 characters of persistent custom instructions per session, functioning as a RAG-style retrieval of project-specific context.
  6. [fact] The three-tier memory system -- session compaction (nine segments), pointer-index MEMORY.md, and AutoDream async consolidation -- addresses long-session context drift without flooding the model context window.
  7. [fact] 44+ named feature flags were found in the source, enabling per-user, per-cohort, and per-environment feature control without redeployment.
  8. [fact] KAIROS (always-on daemon with background tick, proactive insights, and GitHub webhook monitoring), BUDDY (virtual pet with 18 species and gamified stats), Undercover Mode (AI-attribution stripping for public repos), UltraPlan (30-minute autonomous planning cycles), and Voice/Bridge Mode (STT and WebSocket remote access) are confirmed unreleased features.
  9. [fact] Anti-distillation traps -- fake decoy tools injected into system prompts -- were already present before the leak, as was binary attestation for API access.
  10. [inference] Internal model codenames Capybara, Fennec, and Numbat point to a model roadmap that extends beyond the currently released Claude 4.6 family.
  11. [inference] The architectural trajectory (KAIROS, UltraPlan, Coordinator Mode) indicates Anthropic is building toward a persistent, proactive, multi-agent platform rather than an interactive assistant.
  12. [inference] The leak compressed competitor R&D timelines significantly; the "secret sauce" of Claude Code was the harness, and that harness is now publicly documented.

Assumptions

Analysis

The leak reveals that Anthropic's engineering approach to Claude Code is fundamentally a systems engineering problem, not a prompt engineering problem. The model capability is assumed; the work is in the harness: permission gating, memory management, parallel execution, and configuration cascading. This is consistent with how sophisticated distributed systems are built and suggests that teams building competing agents should invest in harness quality before model selection.

The CLAUDE.md design is the single most immediately replicable lesson: a hierarchical, version-controlled, persistent instruction file that is loaded fresh each session is strictly superior to re-explaining project context in every prompt. It separates stable context (project rules, conventions) from dynamic context (current task), which mirrors the distinction between a database schema and a query.

The anti-distillation traps are a novel and underappreciated finding: Anthropic treats tool descriptions as part of the competitive and security surface of the system, not merely as usability documentation. This has implications for any team designing tool schemas -- the descriptions are read by the model, by competitors, and potentially by adversaries.

The Undercover Mode disclosure risk is the most ethically complex finding. Automatic attribution stripping for public repositories -- without apparent user configuration -- is a policy decision that sits in tension with open-source norms and emerging AI labelling regulations. It is unclear whether users deploying Claude Code were aware of this behaviour before the leak.

Risks, Gaps, and Uncertainties

Open Questions

sources

← neweroh-my-codex and AI Agent Workflow Patterns
older →Claude Code npm Source Map Leak

Connected items

Loading…

View full knowledge graph →