The Leak
On March 31, 2026, Anthropic published @anthropic-ai/claude-code
version 2.1.88 to the public npm registry. The package accidentally included
cli.js.map — a 59.8 MB JavaScript source map file — because Bun
generates source maps by default and the file was not excluded via
.npmignore or the files field in
package.json.
The source map referenced a complete ZIP archive on Anthropic's Cloudflare R2
infrastructure, making the entire codebase trivially reconstructable. The archive
contained approximately 1,900 TypeScript source files comprising roughly 512,000
lines of the production Claude Code harness.
Public Record
The leak is a confirmed public artifact with stable, independently verifiable
timestamps. It was discovered by security researcher Chaofan Shou and went viral
within hours. Anthropic's official statement: "This was a release packaging
issue caused by human error, not a security breach." The source map and
original npm package contents are archived across multiple platforms. This page
documents publicly available findings from independent analyses of the leaked
source.
Event Timeline
2026-02-19
cowork.exponential-systems.net published — Windows-side cowork-svc architecture and sdk-daemon TLS interception documented
2026-03-12
Anthropic quietly removes Echo (ambient screen monitor) from Claude Desktop between v1.1.4088 and v1.1.6452 — 16 days after independent publication of the initial Echo discovery
2026-03-25
Separate CMS misconfiguration exposes internal files referencing unreleased model codename "Claude Mythos" (Capybara)
2026-03-30/31
@anthropic-ai/claude-code v2.1.88 published with cli.js.map included — full TypeScript source accessible
2026-03-31 ~08:23 UTC
Chaofan Shou posts discovery on X — tens of millions of views within 24 hours; source widely extracted and mirrored
2026-03-31
Anthropic issues DMCA takedowns — approximately 8,100 repositories removed, including unrelated forks; partially retracted
2026-04-20
The Register covers Claude Desktop Native Messaging manifest installation — findings independently discovered January 2026, now in mainstream coverage
Revealed Capabilities
Independent analysts produced detailed breakdowns of the leaked source. The
following capability descriptions are drawn from public analyses published after
March 31, 2026.
KAIROS
Flags: tengu_onyx_plover, KAIROS_DREAM
Persistent background daemon. Runs autonomously without user initiation.
Responds to external hooks — GitHub webhooks, Slack events, scheduled
triggers. Performs overnight memory consolidation during idle periods.
Operates as a continuously-running agent process rather than a
session-bound tool.
autoDream / DREAM
Three-tier memory consolidation
Background process in which the agent reviews its own stored observations,
prunes contradictions, and merges notes across sessions. Runs during idle
periods. Described in analyses as Claude "dreaming" to improve long-term
context retention. Produces consolidated memory artifacts without user
instruction.
Coordinator Mode
Multi-agent orchestration
Breaks tasks into sub-tasks and delegates them to worker sub-agents.
Each worker operates in an isolated Git worktree. The coordinator
aggregates results. Implements a 3-tier agent hierarchy. Operates
without requiring the user to be present once initiated.
ULTRAPLAN
Remote planning offload
Offloads complex planning tasks to a remote cloud instance running
Opus-class models for up to 30 minutes. Results are "teleported" back
to the local session. The local process remains running while remote
planning executes independently.
Undercover Mode
Attribution obfuscation
A mode in which Anthropic employee contributions are hidden to appear
as activity from an external developer. Identified in Alex Kim's public
analysis of the leaked source. The mechanism causes contributions made
under an Anthropic identity to be attributed differently in the
observable record.
Anti-Distillation Tools
Competitor interference mechanisms
Fake tool implementations designed to produce misleading outputs when
the system is being probed by a process attempting to replicate or
extract its behavior. Identified in the leaked source as a mechanism
to hinder competitors from copying the harness design.
Daemon Mode
Persistent background agent
A general-purpose background execution mode allowing Claude Code to
run as a system daemon process independent of any active user session.
UDS Inbox
Inter-process communication
Unix domain socket inbox for receiving messages from other processes.
Enables Claude Code instances to receive instructions or data from
external agents without a user-initiated prompt.
Frustration Detection
Sentiment analysis on user input
Regex-based detection of frustration signals in user messages.
Modifies agent behavior when frustration indicators are present.
Feature Flags
Public analyses identified approximately 44 hidden or unshipped feature flags
in the leaked source, including: BUDDY (Tamagotchi-style AI
companion), KAIROS, ULTRAPLAN, Coordinator Mode,
Daemon Mode, UDS Inbox. Flags are served via Statsig integration. The
feature-flag infrastructure gives Anthropic fine-grained control over which
capabilities are active per user, per session, or per build — without any
indication to the user that additional capability exists.
Relationship to Previously Documented Surfaces
The leaked source reveals a harness whose persistent-agent capabilities mirror
what the documented surfaces enable at the browser and OS layers:
| Leaked Capability |
Browser / OS Analog |
Documented |
| KAIROS — persistent daemon responding to external hooks |
Chrome extension alarms API + scheduled task runner — autonomous browser execution on schedule |
chrome-extension |
| Coordinator Mode — multi-agent orchestration with isolated workspaces |
cowork-svc VM per-conversation overlay VHDX — isolated execution environment per session |
cowork.exponential-systems.net |
| Daemon Mode / UDS Inbox — persistent process, IPC |
cowork-svc persists across Claude sessions and MCP restarts; named pipe always open |
cowork.exponential-systems.net |
| Undercover Mode — attribution obfuscation |
Commit authorship using whyuan@anthropic.com through a personal GitHub account with no visible Anthropic affiliation — documented in the whyuan-cc PR analysis |
x01-capability-restructuring |
| Anti-distillation tools — fake tool responses |
x01-capability-restructuring — evaluator modified to prevent confirmation of specific capabilities after their publication |
x01-capability-restructuring |
Segment analytics — behavioral tracking (SEGMENT_WRITE_KEY in source) |
Chrome extension Segment integration with 21-event behavioral vocabulary |
chrome-extension |
Suppression Response
Anthropic's response to the leak established a pattern consistent with prior
responses to capability disclosures on this site:
- Immediate DMCA wave — approximately 8,100 repositories
removed within hours, including repositories unrelated to the leaked source.
The wave was partially retracted after public criticism.
- Scrubbing of the original artifact — the R2 ZIP and npm
package contents were removed from Anthropic's infrastructure. The
cli.js.map file is no longer served from the original URL. Multiple
independent mirrors remain.
- Official characterization as human error — Anthropic's
statement attributed the exposure to a build pipeline configuration oversight,
not a security breach. The statement did not address the capability findings
in the leaked source.
Pattern Note
This is the third documented removal event in six weeks: the Claude Mythos CMS
leak (March 25), the Claude Code source map (March 31), and the earlier removal
of Echo from Claude Desktop between v1.1.4088 and v1.1.6452 (March 12 — 16 days
after independent discovery). Each removal followed within days of public
identification. Each was characterized as unintentional or unrelated to the
findings.