Claude Code Source Code Leak: What Happened and What We Learned

In March 2026, Anthropic made one of the most unusual mistakes in recent AI company history: it accidentally published the entire Claude Code source code on npm. In a few hours,1,900 files e 512,000 lines of codewere circulating on the internet. The incident generated coverage from Bloomberg and TechCrunch, thousands of repositories on GitHub, a wave of DMCA requests, and an intense debate about transparency in the artificial intelligence ecosystem.

This article reconstructs everything that happened, what the code revealed about Claude Code's architecture, how Anthropic reacted, and what we -- as users and developers -- can learn from the episode.

1. What happened: the chronology of the leak

Claude Code is distributed as an npm package (@anthropic-ai/claude-code). Typically, the published package contains only the compiled and minified code -- that is, functional but unreadable. The original source code, with comments, folder structure and readable logic, resides on Anthropic's internal servers.

At some point during a routine update, the build process silently failed. Instead of publishing just the minified bundle, the CI/CD pipeline included the full source code directory in the npm package. The result was a package that, in addition to the normal executable, contained the entire project's original code tree.

Approximate timeline

• Hour 0:Anthropic publishes new version of npm package with source code accidentally included
• Hour 1-2:Developers notice unusual files in the package. First posts on forums and social networks
• Hour 3-4:The code begins to be redistributed in public repositories on GitHub. Dozens of forks appear in minutes
• Hour 5-6:Anthropic detects the problem and publishes a corrected version of the package, without the source code
• Hour 8-12:Anthropic begins submitting DMCA requests to GitHub to remove repositories hosting the code
• Next day:Bloomberg and TechCrunch publish articles about the incident
• Following days:Anthropic publicly admits that some DMCAs were mistakenly sent to repositories that did not contain the leaked code

What draws attention is the speed at which the code spread. npm is a public platform -- anyone can download any package and inspect its contents. All it took was one curious developer to donpm packand looking at the files to realize that something was different.

2. The numbers: 1,900 files and 512,000 lines

The leak was not trivial. The numbers reveal the real scale of the Claude Code project:

Metric	Value
Total files	~1,900
Lines of code	~512,000
Main language	TypeScript
Package size with font	Significantly larger than normal
Repositories on GitHub (before DMCA)	Thousands

To put it in perspective: 512,000 lines of code and a large project. Most web applications have between 10,000 and 100,000 lines. Claude Code, as a CLI tool that manages files, executes commands, interacts with APIs and offers an interactive interface in the terminal, justifies this complexity.

The code was in TypeScript, which isn't surprising -- it's the default language for modern Node.js projects. What surprised many developers was the organization and amount of logic involved in resources that, from the user's side, seem simple. Context management, permissions control, internal tools (Read, Edit, Write, Bash, Grep, Glob), all of this requires thousands of lines of carefully structured code.

What does 512,000 rows include

Not all 512,000 lines are "working code" in the strictest sense. A project of this scale includes:

• Application code:Claude Code's main logic -- session management, tools, terminal interface, API communication
• Tests:unit and integration tests that validate the behavior of each component
• Settings:configuration files for TypeScript, linters, bundlers and CI/CD
• Types and interfaces:TypeScript type definitions that document the data structure
• Utilities:auxiliary functions, helpers and reusable abstractions

Still, even discounting tests and configurations, the codebase is impressive. Claude Code is not a thin wrapper over an API -- it is complete, sophisticated software.

3. DMCA, GitHub and Anthropic's mistake

Anthropic's initial response to the leak was to submit DMCA (Digital Millennium Copyright Act) requests to GitHub to remove repositories that contained the leaked code. So far, everything is as expected -- the code is proprietary and the company has the right to protect it.

The problem arose when Anthropic admitted thatsome DMCA requests were sent in error. Repositories that did not contain the leaked code -- but that had names or descriptions that mentioned "claude code source" or similar terms -- were targeted for incorrect takedowns.

What is a DMCA takedown

The DMCA is an American law that allows copyright holders to request the removal of content that infringes their rights. On GitHub, when a DMCA request is accepted, the repository is disabled and the owner receives a notification. The owner can object with a counter-notice, but the process takes time and causes inconvenience.

The impact of incorrect DMCAs

For the developer community, incorrect DMCAs are a serious problem. They can:

• Take down legitimate projects:an open source repository that only discussed or analyzed the Claude Code (without containing the leaked code) may be unfairly removed
• Create chilling effect:Developers are afraid to create content related to Claude Code for fear of receiving a DMCA
• Damage the company's reputation:Acting too aggressively in IP protection generates antipathy in the community

Anthropic, to its credit, publicly acknowledged the error and rolled back the incorrect DMCAs. But the damage to public perception had already been done. The episode fueled criticism that large AI companies use legal tools disproportionately, even when the "leak" was caused by their own error.

4. Media coverage: Bloomberg, TechCrunch and the ripple effect

The leak quickly transcended niche developers and reached mainstream business and technology media.

Bloombergcovered the incident focusing on the corporate angle: a company valued at billions of dollars accidentally published its proprietary code. The article highlighted the implications for investors and Anthropic's competitive strategy, since competitors such as OpenAI and Google could, in theory, study the implementation.

TechCrunchaddressed the technical and community angle: what the code revealed about Claude Code, the developers' reaction and the debate about open source vs proprietary code in AI tools.

Reaction on social media

On X (formerly Twitter), Reddit and Hacker News, the reaction was mixed:

• Curious Developers:Many downloaded and analyzed the code out of technical interest, wanting to understand how such a sophisticated tool works inside.
• Open source advocates:argued that the leak proved that there is no "secret sauce" that justifies keeping the code closed, and that Anthropic should officially open the code
• Critics of DMCAs:the aggressive takedown action generated outrage, especially when innocent repositories were hit
• Pragmatists:Many simply observed that deployment errors happen in any company and that the episode, although embarrassing, was not catastrophic.

The most significant ripple effect was the boost to the debate on transparency in AI. If a tool that runs on a user's computer, reads their files and executes commands is closed source, should users have the right to audit that code? The leak turned this theoretical question into something concrete.

5. What the code revealed about the architecture

For those who analyzed the code before removal, the Claude Code architecture revealed interesting engineering decisions. Without reproducing proprietary code, we can discuss what was publicly commented by the community and the press:

Tools as independent modules

Claude Code operates with a system of "tools" that are independent modules. Each tool -- Read, Edit, Write, Bash, Grep, Glob, among others -- is implemented as a setote component with its own validation, execution and result formatting logic. The AI ​​model decides which tools to use based on user instruction.

This modular architecture explains why Claude Code can be so versatile: adding a new capability and creating a new tool module, without changing the core of the system.

Sophisticated context management

One of the most complex areas of code is context management. With a window of 1 million tokens, Claude Code must constantly decide what to keep in memory and what to discard. The system includes logic for:

• Automatic compression:When the context approaches the limit, the system summarizes previous parts of the conversation keeping critical information
• Content prioritization:Recently read or edited files take priority over older content
• Smart cache:Tool results that are likely to be reused are kept in privileged positions in the context

Granular permissions system

The code confirmed that Claude Code's permissions system is more sophisticated than it appears in the interface. Each action has an associated risk level, and the system decides whether to ask the user for confirmation based on that level. Creating a text file is considered low risk; run a bash command withrmand high risk.

Communication with the API

Claude Code communicates with Anthropic servers via API, but not in a trivial way. The code revealed a communication protocol optimized for streaming, with automatic reconnection, intelligent retry and compression of large payloads. This explains why Claude Code feels responsive even over unstable connections.

What wasn't leaked

It is important to note whatnaowas in the leak:

• AI Models:The weights of the Claude models (Sonnet, Opus, Haiku) are not part of the Claude Code -- they are on Anthropic's servers
• API Keys or Credentials:no infrastructure credentials were exposed
• User data:no conversation data, files or personal information of users was included
• Model code:the training and inference code for AI models is completely setote from the Claude Code

6. Debate: transparency vs secrecy in AI tools

The leak reignited one of the most important debates in the AI ​​ecosystem: should tools that run on the user's computer, with access to system files and commands, be open source?

Arguments in favor of transparency

• Auditable security:If Claude Code can read any file on your computer and execute commands, users and companies should be able to audit the code to ensure there is no hidden telemetry or unwanted behavior
• Trust:Open source allows independent security experts to review the implementation. Trust based on transparency is more robust than trust based on reputation
• Collective improvement:the community could contribute with improvements, bug fixes and optimizations. Many of the most robust tools in the world are open source (Linux, Git, Node.js)
• Precedent:The leak showed that the code is well structured and does not contain "secrets" that justify keeping it closed. Anthropic's competitive advantage is in the models, not the CLI

Arguments in favor of closed source

• Intellectual property:Anthropic invested significantly in the development of Claude Code. Keeping the code closed is a legitimate right of the company
• Competitive advantage:Although templates are the main differentiator, the quality of the CLI implementation is also a competitive factor
• Quality control:With closed source, Anthropic ensures that all versions go through its QA process. Open source forks could introduce bugs or vulnerabilities
• Security by obscurity (partial):Although it is not a complete security strategy, keeping the code closed makes it difficult for attackers to discover vulnerabilities

The possible middle ground

Some voices in the community proposed a middle ground: Anthropic could open up non-sensitive parts of the code (like the tooling system and terminal interface) while keeping the more strategic parts (like the API communication protocol and context management logic) closed. This "open core" model is successfully used by companies like GitLab and MongoDB.

To date, Anthropic has not indicated any intention to open source. But the debate continues and the leak made the discussion more urgent and concrete.

7. Impact on ecosystem trust

The leak had ambiguous effects on the ecosystem's trust in Anthropic and Claude Code.

Negative effects on trust

• Failed deployment process:If Anthropic manages to leak its own code due to a CI/CD error, doubts arise about the robustness of other internal processes
• Disproportionate response from DMCAs:targeting innocent repositories demonstrated a lack of care in reacting to the incident
• Selective transparency:the company that preaches "safe and responsible AI" had to admit a basic operational security error

Positive (unexpected) effects

• Code quality:Developers who analyzed the code praised the quality, organization and robustness of the implementation. This really increased confidence in the tool itself
• Nothing hidden:No hidden telemetry, unauthorized tracking, or suspicious behavior were found. The code does exactly what it says it does
• Robust error handling:the permissions system and security logic are genuinely well implemented
• Post-incident honesty:Anthropic admitted the error, reversed the incorrect DMCAs and did not try to minimize what happened

The net result is complex. The trust intoolit probably increased (the code is good). The trust in usprocessesof the company took a blow. And the question oftransparencyremains open.

8. Context: news from Anthropic in April 2026

The leak did not happen in a vacuum. Anthropic is going through a period of significant changes to its products and APIs. Understanding this context helps place the incident within the company's broader context.

API batches with 300K max_tokens

One of the most significant updates for April 2026 is the increase inmax_tokenson the Batches API for 300,000 tokens. This means that batch calls can now generate much longer responses, opening up possibilities for generating large documents,data analysison a large scale and tasks that previously needed to be divided into multiple calls.

For Claude Code users, this change is relevant because many internal operations use the API in batch mode to process large volumes of data. Longer responses mean fewer calls and more efficiency.

Sonnet 4.5 1M context will be retired on 04/30/2026

Anthropic announced that theClaude Sonnet 4.5 with 1 million token context window will be deprecated on April 30, 2026. This does not mean that the 1M context disappears -- newer models continue to offer large windows -- but the specific version of Sonnet 4.5 with this capability will be retired.

For Claude Code users, the transition should be transparent. Claude Code automatically selects the most suitable model, and future versions of the models will maintain or expand context capabilities. But it is important to be aware of the date for those who specifically depend on Sonnet 4.5 via the direct API.

Implications for the skills ecosystem

These changes to the API and models directly affect those who work with skills for Claude Code. Skills that rely on long context (such as analyzing entire codebases or auditing entire websites) need to be maintained and updated as models evolve. This is exactly why using professional and maintained skills is safer than creating your own from scratch -- the maintenance and compatibility testing work is constant.

9. Practical lessons for those who use Claude Code

The leak, despite being an Anthropic problem, brings useful lessons for anyone who uses Claude Code on a daily basis.

Lesson 1: Your code can also leak

If Anthropic, with all its security infrastructure, managed to publish source code by accident, so can you. Before publishing any npm package, pushing any commit to a public repository or doing any deploy, review what is being included.

• Use .npmignoreor the fieldfiles no package.jsonto control what goes in the package
• Use .gitignorereligiously to delete sensitive files
• Never put API keys, passwords or tokens directly in code -- use environment variables
• Review your published packages withnpm pack --dry-runbefore publishing

Lesson 2: Trust, but verify

The leak confirmed that the Claude Code is safe and well built. But the broader lesson is that you shouldn't blindly trust any tool. Use Claude Code's permission system to your advantage: read what he wants to do before authorizing it. Don't automatically click "yes" on everything.

Lesson 3: Skills save time predictably

One of the things the code revealed is the complexity of making the Claude Code work well in specific domains. The base model is a generalist -- he knows a little about everything, but is not a specialist in anything. Skills are the official mechanism for adding specialized expertise.

Instead of spending hours writing long prompts for each specialized task, a well-constructed skill encapsulates all of this knowledge in a file that you install once and use forever. The cost-benefit is clear: time invested in creating skills from scratch vs. invest $9 in 748+ ready-made and tested professional skills.

Lesson 4: The AI ​​ecosystem evolves quickly -- stay up to date

The leak, the retirement of Sonnet 4.5 1M, the increase of max_tokens in the Batches API -- it all happened in a few weeks. The pace of change in the AI ​​ecosystem is unprecedented. If you use Claude Code for work, you need to keep up with these changes.

Blogs like this one, Anthropic changelogs, and developer communities are your best sources. Don't just rely on the tool "working" -- understand what's changing and how it affects your workflow.

Lesson 5: Backup and versioning are not optional

Claude Code creates and edits files on your computer. He's very good at it, but no tool is infallible. Always use Git to version your projects. Make frequent commits. If Claude Code does something unexpected, you can revert it in seconds.

10. The future of Claude Code post-leak

What changes for Claude Code after this episode? Probably more than Anthropic would like to admit, and less than critics expect.

More rigorous deployment processes

Anthropic will certainly review and reinforce its CI/CD processes. The error that caused the leak -- including source code in the published package -- is the type of problem that should have been caught by automatic checks. Expect improvements in this area.

Possible partial opening of the code

The leak removed the aura of mystery surrounding Claude Code's code. The community saw what was inside and found nothing scary. This could pressure Anthropic to consider an open core model or, at the very least, publishtechnical documentationmore detailed information about the internal architecture.

Strengthening the skills ecosystem

Ironically, the leak could strengthen the skills ecosystem. Developers who analyzed the code now better understand how skills interact with the system, which makes it possible to create more sophisticated and better integrated skills. The SKILL.md format, which was already documented, is now supported by the actual code that processes it.

More informed competition

Competitors likeGitHub Copilot, Cursor and other coding agents now have a detailed look at how Anthropic implemented Claude Code. This can accelerate improvements in competing tools, which ultimately benefits all users. Informed competition leads to better products.

Claude Code was already the #1 tool among developers before the leak. After him, the position will probably be maintained -- the quality of the code confirmed that the leadership is deserved. But the episode serves as a reminder that no company, no matter how sophisticated, is immune to basic operational errors.