Claude Code Leaked 512,000 Lines of Source. Here’s What the Community Found Inside.
One forgotten rule. Half a million lines exposed. What developers found inside was stranger than anyone expected.
On March 31, 2026, Claude Code shipped v2.1.88 — a routine release. Except that the engineer building it forgot to include one line in .npmignore: *.map. A 59.8 MB cli.js.map slipped into the npm package. That file contained a pointer to a complete source zip on Anthropic's R2 storage.
512,000 lines of Claude Code source. Public. Unintentionally.
Boris Cherny, Claude Code’s engineering lead, addressed it directly:
No, can confirm it was not related to bun. Just a developer error.
Mistakes happen. As a team, the important thing is to recognize it’s never an individual’s fault — it’s the process, the culture, or the infra. In this case, there was a manual deploy step that should have been better automated.
The source was pulled offline quickly. But developers had already downloaded it, mirrored it, and started reading.
Here’s what they found.
1. The Tech Debt Is Real (and Familiar)
main.tsx: 4,683 lines, 803 KB.
460 eslint-disable comments scattered through the codebase. Over 50 functions with _DEPRECATED suffixes still called in production:
writeFileSyncAndFlush_DEPRECATED()config.ts — the authentication manager — contained 9 empty catch blocks. A patch function named wouldLoseAuthState() exists because a historical bug would silently wipe authentication on config save.
The comments tell the story of a codebase built fast:
// TODO: figure out why// Not sure how this became a string
// TODO: Fix upstream// This fails an e2e test if the ?. is not present.
// This is likely a bug in the e2e test.One engineer (Ollie) left this note in mcp/client.ts:589:
// TODO (ollie): The memoization here increases complexity by a lot,
// and I'm not sure it really improves performanceNone of this is unusual for a product moving fast. What’s unusual is that we got to see it.
2. There’s a Hidden Pet Hatching System
/buddy is a complete ASCII creature system buried in the codebase.
18 species: duck, capybara, dragon, ghost, salamander, “chonk”, and more. Full rarity tiers with a 1% legendary drop rate. Shiny variants. Hat accessories, including crowns, wizard hats, propellers, and tiny duck hats.
Each creature has attributes: DEBUGGING, PATIENCE, CHAOS, WISDOM, SNARK — and reacts to your coding behavior.
The RNG comment:
// Mulberry32 — tiny seeded PRNG, good enough for picking ducksThe species names are hex-encoded:
export const duck = String.fromCharCode(0x64, 0x75, 0x63, 0x6b)Why? duck and capybara collide with internal model codenames. Anthropic's own build scanner would flag them. The solution: hex-encode all 18 species names to evade internal monitoring.
A time salt "friend-2026-401" confirms the intent. The official v2.1.89 changelog:
/buddy is here for April 1st — hatch a small creature that watches you code
April Fools. Shipped anyway.
3. Claude Knows When You’re Frustrated
userPromptKeywords.ts contains a regex that scans your input for frustration signals.
"wtf", "this sucks", "damn it", "so frustrating" — trigger it, and Claude shifts to a de-escalating response style.
The system also logs hesitation behavior: how many times you pressed Esc, how many half-written messages you deleted. These signals map where the product creates friction. Claude often knows you’re stuck before you say anything.
4. Undercover Mode: The Switch With No Off Position
undercover.ts implements a mode that activates automatically when Anthropic employees use Claude Code to contribute to public repositories.
When active, it strips all AI attribution:
- No
Co-Authored-Bylines - No mentions of
Claude Code - No internal model codenames (Capybara, Fennec, Numbat…)
The comment that caught everyone’s attention:
There is NO force-OFF
Anthropic positions itself around transparency. This particular toggle doesn’t have a disable option.
5. A Honeypot for Model Distillation
claude.ts contains a flag: ANTI_DISTILLATION_CC.
When triggered, the client injects a fake_tools array into API requests. The server injects fake tool definitions into the system prompt.
If a competitor records Claude’s API traffic to distill their own model, the fake tools contaminate their training set. It’s a honeypot — plausible enough not to filter out, poisonous enough to degrade any model trained on it.
6. KAIROS: An Unreleased Background Daemon
The codebase references a module called KAIROS over 150 times. It hasn't shipped yet.
The following analysis comes from a third-party source review — treat as medium-confidence.
KAIROS appears to be designed as a background daemon: it monitors your repo via GitHub webhooks and local file watching, and runs while Claude Code is closed.
Its autoDream subsystem runs four phases:
- Orient — scan memory directories, identify stale index references
- Gather — extract patterns and corrections from conversation history
- Consolidate — merge new findings into existing memory files
- Prune — remove outdated content
Quietly maintaining your project context while you sleep.
The codebase also references ultraplan (a 30-minute Opus session for full-task planning) and coordinator mode (multi-agent orchestration).
7. Someone Fixed a Real Bug Using the Leaked Code
Users had been complaining for months about abnormally high token consumption in long Claude Code sessions.
A developer on Reddit used the leaked source — running it through Codex — to find the root cause. In the db8 function, when resuming a session with claude --resume, all attachments of type deferred_tools_delta were being filtered out. These attachments record which tools have already been registered with the model.
Without them, every resumed session re-registers all tools from scratch. This breaks the prompt cache prefix.
The longer the session, the more tokens wasted. Cache hits cost 10x less than cache misses.
The fix: two lines.
if (A.attachment.type === "deferred_tools_delta") return !0;
if (A.attachment.type === "mcp_instructions_delta") return !0;The results:
Before fix:
Turn 15: cache_read: 15,451 cache_creation: 42,970 hit rate: 26%
After fix:
Turn 3: cache_read: 57,684 cache_creation: 611 hit rate: 99%Anthropic confirmed the bug exists. The patch is community-published.
What This Actually Shows
Tech debt lives in every production codebase. _DEPRECATED functions and empty catch blocks aren't an Anthropic problem — they're an engineering reality.
The Undercover Mode NO force-OFF and the anti-distillation design are deliberate engineering tradeoffs, not accidents.
Two lines of code moved the cache hit rate from 26% to 99%. Open source made that fix possible. A source leak made it happen faster.
And /buddy exists. I want the capybara.
The cache bug fix patch is available in the community. Anthropic has confirmed the issue and is working on an official fix.
