Claude Code Source Code Leak Suspected: What's Known So Far

The source code of Claude Code, Anthropic's popular agentic AI tool, was accidentally exposed. The cause was that version 2.1.88 of @anthropic-ai/claude-code, distributed on npm, included internal debugging JavaScript source map files.

The leak exposed a TypeScript codebase of roughly 510,000 lines, which could deal a serious blow to Anthropic's core intellectual property. Claude Code in particular is a flagship product recording $2.5 billion in annual recurring revenue (ARR).

The most notable aspect of the leaked code is a three-layer memory architecture designed to solve the AI agent's "context entropy" problem.

• Self-Healing Memory: Through a lightweight index called MEMORY.md, it manages pointers to the location of data rather than storing the actual data itself.
• Strict Write Discipline: The index is updated only after a file write succeeds, preventing the model from contaminating context due to failed attempts.

The true nature of KAIROS, an autonomous daemon mode, was also revealed. This feature performs "memory cleanup" work—consolidating memory and eliminating logical contradictions—through an autoDream process when the user is idle.

Anthropic has confirmed that this incident was a simple packaging error rather than a leak of customer data or credentials, and stated that it is preparing measures to prevent recurrence.