Claude Code Source Leak: What Anthropic Published to npm

A package that should have held a binary held the source instead

On March 30, 2026, Anthropic published an update to Claude Code, the terminal coding agent it had shipped in February 2025, to the npm registry with roughly 500,000 lines of code across about 1,900 files of source rather than the compiled output the package normally contains. Because npm packages are downloadable by anyone, the source was public until it was pulled. [1]

The exposed code was the tool's agentic harness, the layer that instructs the underlying model how to call tools and enforces the guardrails on its behavior, rather than the model itself. A spokesperson said no customer data or credentials were involved and called it "a release packaging issue caused by human error, not a security breach," adding that Anthropic was "rolling out measures to prevent this from happening again." [1]

Atlas interpretation: That framing draws a line between a data breach and a build mistake, but the two failure modes look similar from the outside: whatever compiles a public release did not strip the source this time, and the result was the same as if someone had chosen to publish it. LayerX Security researcher Roy Paz described the missing control directly: "Usually, large companies have strict processes and multiple checks before code reaches production, like a vault requiring several keys to open. At Anthropic, it seems that the process wasn't in place and a single misconfiguration or misclick suddenly exposed the full source code." [1]

The second unrelated exposure inside five days

Five days earlier, on March 26, 2026, a misconfigured content cache had left roughly 3,000 unpublished Anthropic files reachable, among them a draft post describing an unreleased model, Mythos, in terms Anthropic itself called "a step change" in capability. Anthropic used the same characterization for both incidents: human error rather than a security breach. [2]

The March 30 npm exposure was also not the first time Claude Code's source had gotten out. An early version had accidentally exposed its own code in February 2025, showing how the tool worked internally and connected to Anthropic's systems; Anthropic pulled that release and took the exposed code down at the time. [1]

Atlas interpretation: Two disclosures within the same week, through different systems, a content cache and a package publish, point to a pattern broader than either incident on its own: internal artifacts reaching the public through ordinary publishing steps that were supposed to filter them out, not through anyone breaking in. Security researchers flagged a further consequence specific to the March 30 leak: unlike a leaked model, a leaked harness is something a competitor can read to see exactly how a widely used coding agent constrains and directs its tool calls, a design normally kept behind a compiled release. [1]

Claude Code Source Leak: What Anthropic Published to npm

A package that should have held a binary held the source instead

The second unrelated exposure inside five days

Sources