Claude Code Source Leak: What It Revealed and What Shipped Since

Half of what went viral about the Claude Code source leak was wrong, and I know because I published some of it. Six months later the changelog has answered most of the open questions, so here’s the leak graded against what Anthropic actually shipped.

What Actually Leaked on March 31, 2026?

At 22:36 UTC on March 30, Anthropic published @anthropic-ai/claude-code 2.1.88 to npm. The package carried a source map, a debugging file that maps minified JavaScript back to the original code, and the map pointed to a zip archive on Anthropic’s Cloudflare R2 storage. Security researcher Chaofan Shou spotted it on March 31. The Register counted “some 1,900 TypeScript files consisting of more than 512,000 lines of code.”¹

Anthropic’s statement was short: “This was a release packaging issue caused by human error, not a security breach.” No customer data or credentials were involved, and no model weights either; this was the client, the program that runs on your laptop.¹ Version 2.1.88 is gone from npm today (the registry still lists its publish time, but asking for the version returns “version not found”), and the changelog jumps straight from 2.1.87 to 2.1.89.

On March 31 Anthropic filed a DMCA notice against one GitHub mirror, and GitHub applied it to the whole fork network of about 8,100 repositories. A day later Anthropic narrowed it to the original repo and 96 named forks.² The code is still out there, but I won’t link it. You don’t need it to understand the design, and the analysis sites (the best is the unofficial ccunpacked.dev) cover it without making you a redistributor.

One rumor worth killing: the same night, attackers hijacked a maintainer account and published poisoned axios versions 1.14.1 and 0.30.4.³ Some coverage warned that anyone who updated Claude Code in that window might have pulled in the poisoned axios. The neighboring releases, 2.1.87 and 2.1.89, list no runtime dependencies on npm at all, so installing Claude Code didn’t pull axios. Running npm install in your own project between roughly 00:21 and 03:30 UTC on March 31 could have. Check that instead.

How Should You Read Leaked Source Code?

Treat it like a set of blueprints left on a bus. Blueprints show rooms the builder hasn’t finished, rooms that will be cut in the next revision, and a few that were only ever a joke on the margin. They don’t tell you which ones get built.

The leak’s feature flags are those unfinished rooms. A flag is a boolean that keeps compiled code switched off in the public build, and when 512,000 lines spill out, every flag reads like a promise. Reporters counted them (the “44 flags” figure came from secondary write-ups; none of the primary coverage I checked gives a count), named them, and called the list a roadmap.

It was a roadmap. Roadmaps change.

What Does Claude Code’s Agent Loop Look Like?

The loop itself was never a secret, and Anthropic documents it plainly. Claude works through three phases: “gather context, take action, and verify results,” and “these phases blend together.”⁴ In code terms, the model answers with tool calls, the harness runs them and feeds the results back, and the loop repeats until the model answers with plain text. You can interrupt at any point: press Esc to cancel, or type a correction that Claude reads after the current tool calls finish.

This is where my first version of this post went wrong, and it’s worth a paragraph. I wrote that the master loop was “internally codenamed nO” and ran beside an async queue called h2A. Those names didn’t come from the leak. They come from a PromptLayer article published August 29, 2025, seven months earlier, built on community reverse engineering of the shipped JavaScript.⁵ And nO and h2A look exactly like what a minifier produces when it shortens variable names. I took a minified variable name for a codename and dressed up an old blog post as fresh leak analysis.

Claude Code also persists more than I claimed. My first version said the public build had “no session persistence whatsoever,” which was false even then:

claude --continue        # reopen the latest session in this directory
claude --resume          # pick any saved session from a list
ls ~/.claude/projects/   # every session is a plaintext JSONL transcript here

--continue and --resume have been around since April 2025, and sessions are written “continuously to local transcript files as you work.”⁶ What carries knowledge between sessions is CLAUDE.md, which you write, and auto memory, which Claude writes and which has been on by default since version 2.1.59 in February 2026.⁷

What Tools Does Claude Code Have?

My first version printed a table of tool names like read_file, dispatch_agent, and todo_read. Those were wrong too. dispatch_agent was a real name back in the v0.2 builds of early 2025; v0.2.82 renamed the tools “for consistency,” and the sub-agent tool became Task, then Agent in 2.1.63. Today’s names are the exact strings you write in permission rules and hook matchers, and they’re PascalCase:⁸

One surprise for hook authors: on macOS, Linux, and WSL, Glob and Grep are left out of the default set. Claude runs find and grep through Bash instead (embedded builds of bfs and ugrep), so your hooks and permission rules see those searches as Bash calls. There’s no built-in computer or web_browser tool. Browser control is the separate Claude in Chrome integration, and MCP tools show up under their own mcp__server__tool names. The planning tools changed as well: TodoWrite is off by default now, and the newest models get no checklist tool unless you ask for one, because they track multi-step work without it.

Sub-agents aren’t limited to “one at a time,” as I claimed. The docs say Claude can “spawn multiple subagents to work simultaneously,” up to 20 in a session.⁹ They can’t nest forever, but the depth limit has moved around: up to five layers in 2.1.172, no nesting at all in 2.1.217, and three layers since 2.1.219. If you liked the old flat rule, it’s one variable away:

export CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1   # subagents can't spawn their own

How Does the Permission Classifier Decide?

The leak write-ups described a “four-layer decision pipeline” ending in a Sonnet classifier “always” running at temperature=0. The real system had shipped a week before the leak, on March 24, 2026, as auto mode, and Anthropic explained it in an engineering post the next day.¹⁰ The temperature=0 detail and the quoted classifier prompt appear in no official source, so I’ve dropped them.

The motivation is a statistic I keep quoting at people: users approve 93% of permission prompts. Past a certain point, the prompt stops being a safety check and turns into a reflex. Auto mode replaces most prompts with a decision order where “the first matching step wins”: your allow, ask, and deny rules; then automatic approval for reads and edits inside the working directory; then a classifier for everything else, which hands Claude the reason when it blocks.¹¹

1
{
2
  "permissions": {
3
    "defaultMode": "auto",
4
    "allow": ["Bash(npm test)"],
5
    "deny": ["Bash(git push *)", "WebFetch"]
6
  }
7
}

Two details matter more than the layer count. First, entering auto mode drops your broad allow rules (Bash(*), wildcarded interpreters, package-manager run commands), while narrow ones like Bash(npm test) keep working. Second, the classifier sees your messages, the agent’s tool calls, and your CLAUDE.md, but tool results are stripped. That’s the prompt-injection defense: hostile text arrives through tool results, so the judge never reads it.

The classifier runs on Claude Sonnet 5 by default these days, not “always Sonnet” (at launch it ran on Sonnet 4.6, and server-side configuration can override it). Anthropic also published the misses: on 52 real overeager actions, the full pipeline let 17% through. I respect that number more than any benchmark chart. Auto mode is good, but it’s not a substitute for reading the diff on production infrastructure.

Which Hidden Features Have Shipped Since the Leak?

Here’s the blueprint graded against the building, using version numbers from the changelog and dates from npm publish times.¹²

Look at the shape of that table. Five of the “hidden” rooms were already open to the public before March 31 (voice, browser control, agent teams, cron, and auto memory), and the leak just showed the scaffolding around them. Two shipped and were torn down within months. The always-on agent everyone was most excited about arrived as a handful of small, boring parts instead of one big named feature. That’s how product teams actually build, and no blueprint shows it.

Agent teams are still experimental, so here’s the switch if you want the closest thing to Coordinator Mode:¹³

export CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1   # a lead, teammates, a shared task list, and a mailbox

What Does the Leak Teach You About Building Agents?

The design lesson I’d steal holds up better than my facts did: put deterministic checks in front of the expensive judgment. Rules resolve first, the cheap automatic approvals come second, and the model-based classifier only sees what’s left. You can add your own deterministic layer with hooks, which see every tool call before the permission prompt does, and package isolated tasks with forked skills. For a different take on the same harness problems, compare how ForgeCode structures its agent.

The research lesson is the one I paid for. A leak isn’t evidence of a roadmap, a minified variable isn’t a codename, and a blog post from August 2025 doesn’t become news because it gets reposted next to a leak. Next time a vendor’s code spills, read the changelog for six months before you write the explainer. It’s slower. It’s also right.