Anthropic accidentally leaks Claude Code source through npm source maps

Anthropic mistakenly exposed the Claude Code source through .map files in a published npm package. The leak offered a rare look at the internal architecture of one of the most prominent AI coding tools and showed how many features the company still keeps behind flags.

How the leak happened

The cause was mundane: the package shipped with source map files, which developers normally use for debugging. These files hold not only a mapping between the built bundle and the sources, but also the full text of the original files in the sourcesContent field. If such .map files are not excluded from publishing via .npmignore or build settings, anyone can extract the real source code. According to the article's analysis, this is exactly what happened with Claude Code, which is built with Bun, where source maps must be disabled explicitly.

As a result, what leaked was not a stripped-down release client but practically the entire internal codebase of the CLI: a large main.tsx, dozens of tools, system prompts, feature flags and internal subsystems.

The most ironic part is that the code contains a dedicated Undercover Mode, meant to protect Anthropic's internal information in public commits. The company designed a disguise for the model's communication with the outside world, yet tripped on the most mundane step: packaging the npm package.

What was found inside

The leaked contents show that the public Claude Code is noticeably more modest than the internal version. The code revealed modes and services that are either hidden behind compile-time flags or available only to Anthropic employees. These are not cosmetic toggles but fairly mature mechanisms: a persistent proactive assistant, remote planning sessions, background memory processes and orchestration of multiple agents.

In effect, the leak exposed not only the product's implementation but also its roadmap: it shows which features are already built, what they are called internally and what restrictions apply to them.

• Buddy — a Tamagotchi-style terminal companion with ASCII animation, rarity, a "soul" and procedural parameters.
• KAIROS — an always-on assistant that keeps logs, receives ticks and can act proactively without waiting for a command.
• ULTRAPLAN — offloading complex planning to a remote 30-minute CCR session on Opus 4.6, with the result confirmed in the browser.
• Dream — a background memory consolidation system that periodically rereads logs and updates memory files in strict phases.
• Coordinator Mode — a multi-agent mode in which one agent assigns tasks while several workers investigate, implement and verify changes in parallel.

"Parallelism is your superpower."

One feature stands out: a cover mode for Anthropic employees working in public repositories. It forbids mentioning internal codenames, unreleased model versions, internal links and even the fact that an AI may have prepared the changes.

The leak also exposed hidden API beta headers, internal codenames such as Tengu and Fennec, and a broader set of tools than an ordinary user sees. All of this shows that Anthropic has long been building inside Claude Code not just a CLI but a full agent platform with memory, a swarm of workers and several levels of autonomy.

What this means

This is an important leak for two reasons. First, it shows clearly how fast AI development tools are advancing beyond public releases. Second, it is a reminder that even a strong engineering team can make a simple supply-chain mistake when publishing a package.

In Claude Code's case, the source told more than any presentation: Anthropic already has groundwork for proactive assistants, deep planning and multi-agent work. It is also a warning for anyone distributing AI products via npm: feature flags and internal rules save nothing if raw sourcesContent goes out the door.