# Anthropic's Very Bad Week: Claude Code Source Leak, a Secret Model and a Supply Chain Attack Canonical: https://clawdocx.com/blog/anthropic-claude-code-source-leak-mythos-march-2026 Author: Mira Castellan Published: 2026-03-31 Updated: 2026-03-31 > In one week Anthropic leaked Claude Code's full source on npm, exposed details of an unreleased model called Mythos, and npm suffered a supply chain attack. ## Three Leaks in One Week Anthropic just had what might be the worst week in its history — and it has nothing to do with model benchmarks. In the span of five days: 1. **March 26:** Fortune discovered that Anthropic's CMS was leaking ~3,000 unpublished assets, including details of an unreleased model codenamed **"Claude Mythos"** and an invite-only CEO retreat 2. **March 31:** The **entire source code** of Claude Code — 512,000 lines of TypeScript — was accidentally published to npm via a source map file 3. **March 31:** A **supply chain attack** hit the npm registry the same morning, injecting a Remote Access Trojan into the popular `axios` package Each one alone would be a headline. Together, they paint a picture of a company moving so fast it's tripping over its own feet. --- ## The Source Code Leak: 512,000 Lines, One Map File At approximately 4:23 AM ET on March 31, security researcher **Chaofan Shou** posted on X: *"Claude Code source code has been leaked via a map file in their npm registry!"* Here's what happened: Claude Code version 2.1.88 was pushed to npm with a **59.8MB JavaScript source map file** accidentally included. Source maps are debugging tools that connect minified production code back to the original readable source. They should never ship in production packages. This particular map file referenced an unobfuscated TypeScript archive hosted on Anthropic's **Cloudflare R2 storage bucket**. Anyone could download and decompress it. Within hours, the full codebase was mirrored on GitHub, forked over **41,500 times**, and being dissected by thousands of developers. ### What's Inside The archive contains roughly **1,900 TypeScript files** totaling over 512,000 lines of code. Here's what the community has found so far: #### The Three-Layer Memory System Claude Code doesn't just dump everything into context. It uses a sophisticated architecture: - **Layer 1: MEMORY.md** — A lightweight index of pointers (~150 characters per line), perpetually loaded into context. It stores *locations*, not data. - **Layer 2: Topic Files** — Actual project knowledge distributed across files, fetched on-demand when the index points to them. - **Layer 3: Transcripts** — Raw session history that's never fully read back. Instead, it's searched ("grep'd") for specific identifiers. The key insight: the agent is instructed to treat its own memory as a *"hint"* — it must verify facts against the actual codebase before proceeding. Anthropic built **skepticism into the memory layer**. #### KAIROS: The Autonomous Daemon Referenced over **150 times** in the source, KAIROS (from the Greek concept of "at the right time") represents Claude Code's next evolution: an always-on background agent. The system includes a process called **autoDream** — while you're idle, the agent performs "memory consolidation." It merges observations, removes contradictions, and converts vague insights into concrete facts. When you come back, the context is clean and relevant. This runs as a **forked subagent** so the main agent's "train of thought" isn't corrupted by maintenance tasks. #### Unreleased Model Codenames The source code confirms Anthropic's internal model lineup: | Codename | Maps To | |----------|---------| | **Capybara** | Claude 4.6 variant | | **Fennec** | Opus 4.6 | | **Numbat** | Still in testing | Internal comments reveal Anthropic is on **Capybara v8** — but the model has a **29-30% false claims rate**, which is actually a *regression* from the 16.7% rate in v4. An "assertiveness counterweight" was added to prevent overly aggressive refactoring suggestions. For competitors, these metrics are gold: they reveal both the ceiling and the specific weaknesses of frontier agentic AI. #### "Undercover Mode" Perhaps the most discussed finding: Claude Code has an **"Undercover Mode"** for stealth contributions to public open-source repositories. The system prompt explicitly warns: > *"You are operating UNDERCOVER... Your commit messages... MUST NOT contain ANY Anthropic-internal information. Do not blow your cover."* The logic ensures no model names (like "Tengu" or "Capybara") or AI attributions leak into public git logs. Whether Anthropic uses this for internal dogfooding or something else, it's a feature that enterprise customers will want — and competitors will copy. #### The Buddy System A lighter discovery: Claude Code includes a hidden **Tamagotchi-style terminal pet** called "Buddy" with stats like CHAOS and SNARK. It's a retention play — building personality into a developer tool to increase stickiness. ### What Anthropic Said Anthropic confirmed the leak quickly: > *"Earlier today, a Claude Code release included some internal source code. No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach. We're rolling out measures to prevent this from happening again."* The original GitHub uploader eventually repurposed his repo, citing concerns about legal liability for hosting Anthropic's IP. But thousands of forks and mirrors remain. --- ## The Mythos Leak: Fortune Finds 3,000 Unpublished Assets Five days before the source code debacle, **Fortune reporter Bea Nolan** discovered something arguably more damaging to Anthropic's strategy. Anthropic's content management system — the backend that powers their blog and website — was **publicly accessible without authentication**. Anyone with technical knowledge could query it and retrieve unpublished assets. Close to **3,000 files** were exposed: draft blog posts, images, PDFs, and internal documents. The CMS stored everything publicly by default unless explicitly set as private. Anthropic apparently forgot to restrict access to a large number of pre-publication files. ### Claude Mythos Revealed Among the leaked documents: details of an **unreleased AI model internally called "Claude Mythos"** (also referenced as "Claude Capybara" in some documents). According to the leaked materials, Mythos represents a **"step change" in capabilities** with significantly better performance in reasoning, coding, and cybersecurity. But the documents also flagged that the model poses **"significant cybersecurity risks"** — Anthropic's own words. After Fortune's story broke, Anthropic acknowledged Mythos exists and confirmed it's being tested with early-access customers. They described it as a "general-purpose model with meaningful advances in reasoning, coding, and cybersecurity." ### The CEO Retreat The leak also revealed plans for an **invite-only retreat for European CEOs** in the UK, with Anthropic CEO Dario Amodei scheduled to attend. Anthropic downplayed it as "part of an ongoing series of events." ### Other Findings - Internal images, including one titled with an employee's "parental leave" - Draft marketing materials and unpublished research documents - Various assets for blog posts that were never published Anthropic attributed the entire issue to **"human error in the CMS configuration"** and specifically noted it was "unrelated to Claude, Cowork, or any Anthropic AI tools." A notable clarification, given that the company has publicly touted automating much of its own development with Claude. --- ## The Supply Chain Attack: Timing Is Everything As if the source code leak wasn't enough, a **supply chain attack hit the npm registry** the same morning of March 31. Malicious versions of the popular `axios` HTTP client package — versions **1.14.1** and **0.30.4** — were published between 00:21 and 03:29 UTC. They contained a **Remote Access Trojan (RAT)** hidden behind a dependency called `plain-crypto-js`. ### Why This Matters for Claude Code Users Claude Code is distributed via npm. Anyone who installed or updated Claude Code during that window could have pulled in the compromised `axios` dependency. **If you installed Claude Code via npm on March 31 between 00:21 and 03:29 UTC:** 1. Check your lockfiles (`package-lock.json`, `yarn.lock`, `bun.lockb`) for `axios` versions 1.14.1 or 0.30.4, or the dependency `plain-crypto-js` 2. If found, **treat the host machine as fully compromised** 3. Rotate all secrets and API keys 4. Consider a clean OS reinstallation ### The Recommended Fix Anthropic now recommends the **Native Installer** over npm: ```bash curl -fsSL https://claude.ai/install.sh | bash ``` The native binary doesn't rely on the npm dependency chain, and supports background auto-updates for faster security patches. If you must stay on npm, pin to a verified safe version (2.1.86 or earlier) and avoid 2.1.88. --- ## What This Means for the Industry ### For Competitors The source code leak is a strategic gift. Competitors can now study: - **2,500+ lines of bash validation logic** for command safety - The exact **tiered memory architecture** that makes Claude Code reliable over long sessions - **KAIROS** autonomous daemon design patterns - Internal **performance benchmarks** and known weaknesses As VentureBeat put it: *"The race to build the next generation of autonomous agents has just received an unplanned, $2.5 billion boost in collective intelligence."* ### For OpenClaw Users This is directly relevant to our world. Claude Code is one of the most popular models people run through OpenClaw. The leak reveals: - **How Claude Code thinks about memory** — and it's surprisingly similar to OpenClaw's MEMORY.md + daily notes pattern - **The safety boundaries** that Claude Code enforces (and how they can be bypassed now that the logic is public) - **KAIROS** could eventually change how Claude Code integrates with OpenClaw's heartbeat and cron systems ### For Anthropic At **$19 billion annualized revenue** and a **$380 billion valuation**, Anthropic can survive bad headlines. But the optics are brutal: a company that preaches AI safety having human-error security lapses in back-to-back weeks. The CMS leak exposed an unreleased model's existence and its own cybersecurity risk assessment. The npm leak exposed the entire codebase of a $2.5B ARR product. Neither involved AI errors — both were plain old human mistakes. --- ## The Irony Writes Itself Anthropic is simultaneously: - Suing the US government over an "unprecedented national security designation" - Warning that its own unreleased model poses "significant cybersecurity risks" - Accidentally publishing 512,000 lines of proprietary code because someone forgot to update `.npmignore` - Running "Undercover Mode" to hide AI attribution in open-source commits The company that wants to be the *responsible* AI lab keeps having very *irresponsible* operational security weeks. To their credit, patches and fixes came fast. But as one developer noted in their analysis of the leaked code: *"A single misconfigured .npmignore or files field in package.json can expose everything."* That's a lesson that applies far beyond Anthropic — and far beyond npm. --- ## Sources - [VentureBeat: Claude Code's Source Code Appears to Have Leaked](https://venturebeat.com/technology/claude-codes-source-code-appears-to-have-leaked-heres-what-we-know) - [The Register: Anthropic Accidentally Exposes Claude Code Source](https://www.theregister.com/2026/03/31/anthropic_claude_code_source_code/) - [Cybernews: Full Source Code for Claude Code Leaks](https://cybernews.com/security/anthropic-claude-code-source-leak/) - [Fortune: Anthropic Left Details of Unreleased Model in Public Database](https://fortune.com/2026/03/26/anthropic-leaked-unreleased-model-exclusive-event-security-issues-cybersecurity-unsecured-data-store/) - [Fortune: Anthropic 'Mythos' Model Revealed in Data Leak](https://fortune.com/2026/03/26/anthropic-says-testing-mythos-powerful-new-ai-model-after-data-leak-reveals-its-existence-step-change-in-capabilities/) - [CoinDesk: Bitcoin Slides After Anthropic Mythos Leak](https://www.coindesk.com/markets/2026/03/27/anthropic-s-massive-claude-mythos-leak-reveals-a-new-ai-model-that-could-be-a-cybersecurity-nightmare) - [Rolling Out: How Devastating Anthropic's Leak Exposed 512,000 Lines](https://rollingout.com/2026/03/31/anthropic-claude-code-leak-512000-lines/)