An ordinary Claude Code update on a public software registry included a debugging-related artifact that enabled recovery of extensive private source material. Chaofan Shou reported the leak publicly, and a Reddit r/ClaudeAI thread amplified the link. Axios quoted Anthropic acknowledging a release packaging mistake and saying no customer credentials or…
Inspect the ClaimsCase · DiggingBeagle record
Claude Code release exposed proprietary agent harness source through a debugging artifact
On March 31, 2026, an Anthropic packaging error made Claude Code client source available with a public update. Anthropic denied exposure of customer credentials or a service intrusion. Attempts to remove mirrors triggered overbroad GitHub takedowns that were partially retracted April 1.
Scope
Accidental source/code-distribution exposure affecting the Claude Code application and its client harness, plus subsequent copyright-enforcement response. Not a breach of Claude model weights, verified credential leak, verified customer-data leak or demonstrated arbitrary code execution in the client.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- not established
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
Anthropic publicly acknowledged the accidental source exposure through a spokesperson, and a signed GitHub notice directly establishes the legal takedown correction. The original package and exposed archive were not fetched independently. Real source exposure occurred, but no technical exploit, customer compromise, weaponization or financial loss was established; exploit_status describes that narrower issue rather than denying the packaging incident. The company promised measures but no tested permanent release-control fix was verified, so remediation remains unknown and impact_band is null.
Assessed Oct 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CLAUDE-MAP-RELEASE · CLM-CLAUDE-NOT-WEIGHTS · CLM-CLAUDE-TAKEDOWN-OVERREACH · CLM-CLAUDE-SOURCE-ARCHIVE-REFERENCE · CLM-CLAUDE-PREVENTION-COMMITMENT · Anthropic leaked 500,000 lines of its own source code · Anthropic partial retraction of March 31 GitHub DMCA notice · Anthropic took down thousands of GitHub repos trying to yank leaked source code
At a glance
The relevant trust boundary was software publishing: a private client-source archive became discoverable through metadata shipped in a public application package. That is different from the ARTEX campaign operator's publicly readable session histories, where the holder of the secret state was an external threat actor rather than the software publisher.…
Read the implicationsThe exact original public package bytes, source-map contents and archive were not retrieved or independently counted. No primary evidence in this dossier shows theft of model weights, customer credentials or personal information. Community interpretations of unreleased flags or product plans have not been independently verified. A direct exploit of Claude…
Limits and uncertaintyFull account
An ordinary Claude Code update on a public software registry included a debugging-related artifact that enabled recovery of extensive private source material. Chaofan Shou reported the leak publicly, and a Reddit r/ClaudeAI thread amplified the link. Axios quoted Anthropic acknowledging a release packaging mistake and saying no customer credentials or sensitive customer information had been disclosed. The material concerned the locally distributed Claude Code client and harness, not the hidden model weights or proof of backend compromise.
The source map provided unusually readable structure for a large bundled command-line application. Secondary reporting estimated nearly 2,000 files and approximately 500,000 lines of source material. An analyst should not infer from that estimate that every referenced internal feature was shipped or active, or that speculative subreddit interpretations of unreleased systems are accurate. Republishing proprietary source mirrors adds no independent verification and is unnecessary for the incident record.
Anthropic attempted to address public mirrors with a GitHub DMCA notice. TechCrunch reported that network-wide processing affected about 8,100 repositories including legitimate forks; Anthropic said the broad removal was unintended. The signed April 1 partial retraction withdrew the notice for everything except one named mirror and 96 specified forks, asking GitHub to reinstate the others. The takedown total is not a victim count.
This case belongs in an AI-harness security research cluster because it reveals a failure of release artifact hygiene that exposed the client orchestration layer. It is not the same event as later ARTEX operator log exposure, and it does not establish a usable attack against agent tool-permission boundaries. The primary evidence is Anthropic's attributed acknowledgment and its published partial legal retraction; the original public package was not downloaded or inspected here.
Claims & evidence
CLM-CLAUDE-ORIGIN-XContemporaneous r/ClaudeAI discussion linked a Chaofan Shou X disclosure as the first widely circulated report; the source post and public package were not independently fetched for this dossier.supported
Basis: reported finding
- supportsClaude Code source code has been leaked via a map file in their npm registrycommentary
Original thread headline and X link
- supportsAnthropic leaked 500,000 lines of its own source codesecondary reporting
Paragraph attributing discovery to Chaofan Shou
CLM-CLAUDE-MAP-RELEASEA March 31, 2026 public Claude Code release accidentally included source-revealing debugging material, according to reporting and Anthropic's acknowledgment of packaging error.supported
Basis: reported finding
- supportsAnthropic leaked 500,000 lines of its own source codesecondary reporting
State of play and Anthropic spokesperson statement on packaging error
- supportsClaude Code source code has been leaked via a map file in their npm registrycommentary
Post title and source link identifying the map file in npm
CLM-CLAUDE-NOT-WEIGHTSThe disclosed material was Claude Code application and harness source, described as roughly 500,000 lines across nearly 2,000 files, not a leak of the underlying Claude model weights. Anthropic said no sensitive customer credentials or customer data were involved.supported
Basis: reported finding
- supportsAnthropic leaked 500,000 lines of its own source codesecondary reporting
Opening, file/archive description and spokesperson quotation
CLM-CLAUDE-TAKEDOWN-OVERREACHThe GitHub takedown response swept in roughly 8,100 repositories according to TechCrunch, but an April 1 partial retraction withdrew notices for all except one named mirror and 96 listed forks. Neither figure measures model compromise or affected customers.supported
Basis: reported finding
- supportsAnthropic partial retraction of March 31 GitHub DMCA noticeprimary disclosure
April 1 notice first and second sentences: scope of partial retraction
- supportsAnthropic took down thousands of GitHub repos trying to yank leaked source codesecondary reporting
Paragraphs on approximately 8,100 repositories and company confirmation of unintended network-wide removal
CLM-CLAUDE-GITHUB-REINSTATEMENTAnthropic's April 1 partial notice retraction requested restoration of affected GitHub fork-network repositories other than a named mirror and 96 individual forks. TechCrunch subsequently quoted Anthropic saying GitHub had restored affected forks. This was a copyright enforcement response, not proof that the accidentally released source could be recalled.supported
Basis: reported finding
- supportsAnthropic partial retraction of March 31 GitHub DMCA noticeprimary disclosure
Retraction body, sentence beginning We retract the notice as to all repositories except
- supportsAnthropic took down thousands of GitHub repos trying to yank leaked source codesecondary reporting
April 1 article, paragraph quoting Anthropic spokesperson beginning The repo named in the notice
CLM-CLAUDE-PREVENTION-COMMITMENTAnthropic attributed the March disclosure to human release-packaging error, denied exposure of sensitive customer data or credentials and said it was rolling out preventive measures; the inspected statements do not document a verified completed long-term prevention rollout.supported
Basis: reported finding
- supportsAnthropic leaked 500,000 lines of its own source codesecondary reporting
What they're saying, Anthropic spokesperson statement beginning Earlier today and follow-up statement This was a release packaging issue
CLM-CLAUDE-SOURCE-ARCHIVE-REFERENCEAxios reports that the publicly shipped debugging artifact pointed to a ZIP archive on Anthropic-owned cloud storage containing nearly 2,000 source files and about 500,000 lines of Claude Code client code. The original package and archive were not independently downloaded in this review.supported
Basis: reported finding
- supportsAnthropic leaked 500,000 lines of its own source codesecondary reporting
State of play, bullet beginning The file, which was quickly discovered, and preceding release paragraph
Implications
The relevant trust boundary was software publishing: a private client-source archive became discoverable through metadata shipped in a public application package. That is different from the ARTEX campaign operator's publicly readable session histories, where the holder of the secret state was an external threat actor rather than the software publisher. Publishing internals can assist reverse engineering, but it does not by itself authorize tool actions, prove customer credentials were exposed, or demonstrate a bypass of the current permission engine. The useful release control is a check of exactly the bytes and source-map URLs entering a public tarball or binary, plus a denylist for private build maps and source archives before the package is signed or promoted. Removing a distribution artifact and narrowing DMCA actions address future downloads or hosted mirrors, but neither proves all previous copies were deleted. Model weights, client source, session transcripts and API credentials must remain different evidence categories.
Unknowns and contradictions
- The exact original public package bytes, source-map contents and archive were not retrieved or independently counted.
- No primary evidence in this dossier shows theft of model weights, customer credentials or personal information.
- Community interpretations of unreleased flags or product plans have not been independently verified.
- A direct exploit of Claude Code permission or tool behavior derived from these exposed files is not established.
Sources and citation
Material revision history
- Oct 9, 2026 · Published version · first publication · revision 114