What the Claude Code leak revealed about the future of Anthropic's AI agents

Anthropic ($380 billion valuation) accidentally published the entire source code of Claude Code version 2.1.88 — not as the result of a hack, but due to a trivial npm package configuration error. The public archive, weighing in at 59.8 MB, contained the full source code complete with developer comments and TODO markers. A security researcher discovered the leak in the early morning hours, and his tweet racked up 21 million views. Anthropic pulled the package within hours, calling it a release packaging error, but it was too late — mirrors of the repository had already spread across the internet.

Hidden agents and background thinking

The code contains 44 feature flags concealing 20+ unreleased features. The headline discovery is KAIROS, an autonomous background agent (mentioned in the code more than 150 times). Unlike the standard Claude, which operates on request, KAIROS is designed as a persistently active background mode. It receives periodic tick prompts to determine whether proactive action is needed, keeps its own logs, and subscribes to events.

Even more intriguing is the Sleep subsystem — background memory consolidation. When the user is inactive, KAIROS launches a sleep process: it analyzes the day's transcripts, resolves contradictions, turns vague guesses into solid facts, and forms long-term memory. For complex tasks, there's a Dream Planner — a feature that delegates planning to a remote claude-opus-5-5 session with a 30-minute thinking limit.

Undercover Mode and the ethics scandal

The file undercover_mode.ts (around 90 lines) sparked outrage. The mode injects a system prompt that strictly forbids the AI from mentioning that it is artificial intelligence, and strips any Anthropic attribution from commits to external repositories. The mode activates automatically for employees and has no off switch. Defenders claim it protects codenames (like KAIROS) from leaking, but critics on Hacker News raised a fair question: if a tool is programmed to hide its identity in commits, what else is it willing to hide?

Protection against competitors and the reality of the code

The code also revealed Anti-Distillation mechanisms designed to protect against competitors recording API traffic. The first injects fake tool definitions into requests to "poison" training data for interceptors. The second cryptographically hashes chain-of-thought reasoning between tool calls, so that interceptors only get summaries rather than the full thinking process. Both mechanisms are easily bypassed using proxy servers.

Tucked away inside the terminal agent was a full-fledged tamagotchi — a project called Capybara Quest, featuring creatures like capybaras, axolotls, ghosts, and chonks. It implements gacha mechanics with rarity tiers ranging from common to legendary (a 1% drop chance), along with hats and stats for CHAOS, WISDOM, and SNARK. Judging by the date stamp friend-2026-401, this was an April Fools' joke whose release had been planned for May.

The codebase itself revealed a human side: main.tsx weighs in at 1 MB with 4,683 lines of code, the code contains 460 eslint-disable comments, 50+ DEPRECATED functions are still actively used in production, config.ts contains 9 empty catch blocks, and one error handler bears the comment "// TODO: figure out why."