Claude Code's Source Code Just Leaked. Here's What It Reveals About How You Should Be Using It.
Two Leaks in Two Weeks
TL;DR
- Anthropic accidentally shipped Claude Code's full source code in an npm release — 512K lines of production TypeScript
- The codebase reveals Claude Code is a full 11-layer agent runtime, not a chatbot in your terminal
- Most people are using about 10% of what it can actually do
- Anthropic has issued 8,000+ DMCA takedowns but the source is effectively permanently public
On March 31, a security researcher noticed something unusual in Claude Code's npm package. A .map file pointed to readable TypeScript source hosted on Anthropic's servers. Within hours, the full codebase — roughly 512,000 lines across 2,000 files — was mirrored on GitHub and copied more than 50,000 times.
This was not a reverse-engineered approximation. This was the production source code for Anthropic's flagship coding tool.
Anthropic confirmed it: "A Claude Code release included some internal source code. No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach."
Coming just days after the Fortune leak revealing Claude Mythos, it has been a rough week for Anthropic's operational security. But the interesting part is not the leak itself. It is what the source code reveals about how Claude Code actually works — and how far most people are from using it properly.
It's Not a Chatbot
The biggest revelation is architectural. Most people think Claude Code is basically Claude but in the terminal. A chat interface with file access.
That is completely wrong.
The source code reveals 11 distinct architectural layers: Terminal UI, Command Service, Permission Engine, Tool System, Query Engine, Memory System, Task Manager, Agent Coordinator, MCP Client/Server, Hook System, and Runtime Core.
It is a full agent runtime. Built with Bun, TypeScript, and React. It has a tool system with 60+ tools, a command system with 85+ slash commands, a permission engine with a five-level cascade, and a multi-agent coordinator supporting three execution models.
As 36kr reported, the global developer community responded immediately. The repository was forked tens of thousands of times before Anthropic could respond.
If you have been using Claude Code like a chatbot — typing questions and hoping for good answers — you have been using maybe 10% of what it can actually do. We broke down all ten layers in our interactive Claude Code guide.
Three Things That Change Immediately
Reading the source code changed three things about how I use Claude Code daily. And I have been building systems on it for six months.
1. CLAUDE.md is loaded every single turn. Not just at session start. Every turn. It has a 40,000-character limit. Most people use about 200. More importantly, it should be lean and context-free — a routing table that references other sources, not a database that tries to contain everything. The architecture penalises bloated context files because they consume tokens on every interaction.
2. There are 85+ slash commands. Most people use none. The six that matter: /plan (planning mode before touching code), /compact (manual save point with context preservation), /review (structured code review), /context (audit what files Claude is tracking), /cost (session spend), and /init (generate a CLAUDE.md for any new project).
3. Permissions are configurable. Every "Allow this action?" prompt is a failure of configuration. The permission system has a five-level cascade with glob patterns for recurring workflows. Set it up once, save it in .claude/settings.json, stop clicking.
Each of these has a walkthrough in the full Claude Code guide.
What the Source Code Hints At
Beyond the current architecture, developers found flags for unreleased features:
→ Proactive mode — Claude Code working without being prompted, discovered by Alex Finn of Creator Buddy
→ KAIROS — what appears to be an autonomous agent mode
→ Crypto-based payments — a system for AI agents to make autonomous payments
→ AI evidence stripping — a mode to remove traces that AI produced the output
And a Tamagotchi-style "buddy" companion that reacts to your coding. This was likely an April Fools' joke. Probably.
As with any leak, plans change. Just because code exists does not mean a feature will ship.
What This Means for Your Business
The harness matters as much as the model.
When Mythos ships with dramatically higher capability, the businesses that benefit most will be the ones that have already structured their context, configured their permissions, and built agent workflows. A better model amplifies good systems. It also amplifies bad ones.
The source code confirms what I have been building for six months: Claude Code is designed to be a configurable execution environment, not a chat window. The gap between how it is designed and how most people use it is enormous.
That gap is your advantage.
What to Do About It
Three actions:
1. Read the guide. We built an interactive breakdown of all ten architectural insights — including the Client Operating System framework I have been running across 14 client projects.
2. Update your installation. If you installed Claude Code via npm, switch to the native installer. The npm distribution was the source of this leak.
3. Check for the axios attack. A supply-chain attack targeting the axios npm package coincided with the leak on March 31. If you installed or updated Claude Code via npm around that date, audit your dependencies.
The source code is, for all practical purposes, permanently public. Anthropic has issued over 8,000 DMCA takedown notices, but programmers have been rewriting the code into Python and Bash to evade them.
The question is not whether the source code is out there. The question is whether you are using the tool the way it was designed to be used.
FAQ
Q: Is my data at risk from the Claude Code source leak?
Anthropic confirmed no customer data or credentials were exposed. This was a packaging error in the npm release, not a security breach. Your API keys, conversations, and project data were never at risk.
Q: Should I stop using Claude Code?
No. The leaked source code reveals the architecture of the tool, not any vulnerability in it. If anything, understanding the architecture helps you use it better. Just make sure you are using the native installer, not the npm distribution.
Q: What is the most important thing I can do right now?
Write a proper CLAUDE.md file. It is loaded every single turn and has a 40,000-character limit. Most people use a fraction of that. Start with /init to generate one, then refine it based on your project's needs.
Q: How is this different from other Claude Code breakdowns?
Most breakdowns describe the architecture. Our guide translates architectural insights into practical habits — including the Client Operating System framework that shows what it looks like when you wire all the layers together. That is the part nobody else is covering.
The Bottom Line
Two leaks in two weeks. The gap between how Claude Code is designed and how people use it is the biggest leverage opportunity in AI tooling right now.
The source code just made that gap visible to everyone.
Book a call if you want help closing it.
About the Author
The AI Orchestrator
AI Orchestrator and entrepreneur with 10+ years building digital products. Helping $1M+ business owners scale with AI systems, automation, and implementation through The AI Orchestrators, Devwiz, and Njin.