Anthropic Goes Open Source

A packaging error exposed the inner workings of Claude Code and the internet wasted no time.

Claude Code, Anthropic’s terminal-based AI coding agent, has become the company’s most commercially important product. Over 100,000 developers use the tool, and its annualized run-rate revenue reached $2.5 billion as of early 2026, having doubled since January. On March 31, a routine npm release exposed the tool’s full source code to the public, giving competitors and researchers a detailed look at the system behind those numbers.

The source leak

On March 31, Anthropic shipped Claude Code version 2.1.88 to the public npm registry with a 59.8-megabyte debugging source map that pointed to a zip archive of the full codebase on the company’s Cloudflare R2 storage. Security researcher Chaofan Shou spotted the file and broadcast it on X before dawn, and developers mirrored the roughly 512,000-line TypeScript codebase on GitHub and forked it tens of thousands of times within hours. Anthropic confirmed that no customer data or credentials were exposed and described the incident as a release packaging issue caused by human error. The leak came days after a separate incident in which descriptions of Anthropic’s upcoming Mythos model had surfaced in a publicly accessible data cache. The exposure may have originated from a known bug in Bun, the JavaScript runtime that Anthropic acquired in late 2025, which served source maps in production mode despite documentation stating otherwise.

Under the hood

Most developers had assumed that Claude Code wrapped Anthropic’s API in a polished command-line interface. The leaked code revealed a substantially more complex system. The architecture uses a hub-and-spoke topology in which a central coordinator decomposes requests into discrete tasks, dispatches them to specialized sub-agents that each maintain their own context window and tool permissions, runs those tasks in parallel, and merges the results through quality gates. A three-layer memory system addresses a problem that Anthropic’s internal comments called “context entropy,” the tendency for long-running AI sessions to degrade as the context window fills. The first layer stores lightweight pointers that remain permanently loaded, while the second holds detailed project knowledge and fetches it on demand, and the coordinator consults both layers to prevent the hallucination drift that plagues extended sessions.

Undercover Mode drew the most discussion. Activated when Anthropic employees contribute to public repositories, the configuration instructs the agent to strip references to internal codenames like Capybara and Tengu, remove AI co-authorship attribution from commits, and suppress any mention of Claude Code itself. Analysts noted that the mode can be forced on, but the code provides no mechanism to force it off. Critics argued that the practice conflicts with open-source transparency norms, particularly the Developer Certificate of Origin, which assumes clear authorship. A separate anti-distillation system injects fake tool definitions into API responses when it detects that outputs may be recorded to train competing models. A frustration detector scans user prompts for profanity and negative phrases using regex pattern matching and logs the result as telemetry, a feature that drew privacy concerns from researchers who study behavioral data collection. The codebase also contained 44 feature flags governing capabilities in various stages of readiness. Roughly 20 controlled features that had been built but had not yet shipped, including a background daemon called KAIROS and a memory consolidation process called autoDream that operates while the user is idle.

No going back

The competitive implications registered fastest in China, where developers on Zhihu and Juejin published detailed analyses of the orchestration patterns despite being blocked from using Claude by Anthropic’s product policy. A viral post on Zhihu concluded that the system’s advantage lay in the agentic harness wrapped around the model, drawing millions of views. Anthropic filed DMCA takedown requests against thousands of GitHub repositories and later scaled them back after the requests caught more than intended. A concurrent, unrelated supply chain attack on the axios npm package introduced a trojanized dependency during a narrow window on March 31, and anyone who installed or updated Claude Code via npm during those hours may have pulled the compromised version. Anthropic has since recommended migration to the native installer, which uses a standalone binary independent of the npm dependency chain.

We have the technology

The consensus from independent analyses identified the orchestration harness as the source of Claude Code’s competitive advantage. Anthropic has continued shipping updates on a roughly biweekly cadence since the leak, but developers in multiple countries had already rewritten the leaked architecture patterns in other languages within days, sidestepping the copyright takedowns entirely.