Anthropic accidentally leaked Claude Code’s entire source code
Anthropic accidentally published the entire Claude Code source code to npm. A misconfigured build file did what no hacker could.
Security researcher Chaofan Shou discovered today that Anthropic published the complete source code for Claude Code — their flagship agentic CLI tool — to the npm registry through a build configuration error.
The cause was mundane. A source map file was included in the production npm package. Source maps are debugging tools that map minified code back to the original source. Including one in a public npm publish is the equivalent of shipping your entire codebase in readable form.
The numbers are significant.
- Files exposed: Approximately 1,900 TypeScript source files.
- Lines of code: 512,000 plus.
- Internal tools revealed: Around 40, including Bash, Grep, WebFetch, MCP implementation, and agent orchestration.
- Affected version: v2.1.88.
The leaked code has already been archived to a public GitHub repository. The code cannot be pulled back.
What the leak revealed is genuinely interesting beyond the embarrassment. Claude Code runs on Bun rather than Node, uses React with Ink for terminal UI rendering, and includes a multi-agent orchestration system capable of spawning sub-agents for parallel tasks. The query engine alone is 46,000 lines.
The community reaction has two distinct threads.
The first is irony. Anthropic builds an AI coding tool designed to help engineers write better, more reliable code. That tool was undone by a misconfigured .npmignore file — the kind of mistake a junior developer gets warned about on their first day.
The second is genuine excitement. Claude is widely considered the best AI model available, and Claude Code the best AI coding tool. Developers have been curious for a long time about how Anthropic actually built it.
The leaked code gives them exactly that — a rare look at the internal architecture of a production-grade agentic coding system from the team that built it.
Bottom line: An AI tool built to prevent developer mistakes was shipped with one of the most basic developer mistakes possible. And everybody is profiting from it. Well, except for Anthropic.
Check out the Claude Code repository on GitHub.
Get the core business tech news delivered straight to your inbox. We track AI, automation, SaaS, and cybersecurity so you don't have to.
Just read what you want, and be done with it.
