Anthropic published version 2.1.88 of the @anthropic-ai/claude-code package to the npm registry this Tuesday morning and inadvertently included a 59.8 MB JavaScript source map file. Esse file, intended only for internal debugging, allowed the reconstruction of the complete source code in TypeScript, with approximately 512 thousand lines distributed in approximately 1,900 files. The discovery was made public around 4:23 a.m. ET by Estados Unidos by an intern at Solayer Labs, who shared a direct download link. Within hours, the material was replicated in repositories on GitHub and analyzed by thousands of developers around the world.
The incident occurred due to human error in the packaging process, as confirmed by the company itself in an official statement. Nenhum Sensitive customer data, credentials or model weights have been exposed. Anthropic has already removed the problematic version and implemented fixes to prevent similar recurrences. The leak affects a product that accounts for an estimated annualized recurring revenue of $2.5 billion, with 80% coming from business customers.
Technical details revealed in memory architecture
The exposed code details a three-tier memory architecture designed to combat contextual entropy in long AI agent sessions. Instead of storing all content in context, the system uses a lightweight index called MEMORY.md, with pointers of approximately 150 characters per line loaded permanently. The actual data is distributed in topic files retrieved on demand, while raw transcripts are referenced by specific identifiers without complete reloading.
This approach includes a strict writing discipline that requires confirmation of a successful write before updating the index. Desenvolvedores who examined the material highlight that the agent treats its own memory as a suggestion, requiring verification against the real code base before taking any action. The framework allows for clean context maintenance even in complex projects that evolve over time.
More on this story: Criminals exploit Claude Code leak to spread Vidar malware on GitHub
- The pointer index avoids contextual pollution with failed attempts.
- On-demand recovery reduces the volume of tokens processed in each interaction.
- Mandatory checking against real files improves the reliability of responses.
The solution represents an evolution in relation to traditional recovery methods that store everything indiscriminately and often lead to hallucinations in prolonged sessions.
KAIROS functionality and background operation
The leak also exposes the KAIROS concept, mentioned more than 150 times in the source code and inspired by the Greek term for opportune timing. Trata is a standalone daemon mode that allows Claude Code to operate continuously in the background, even when the user is inactive. Nesse state, the agent performs memory consolidation, combines scattered observations, removes logical contradictions and transforms vague perceptions into consolidated facts.
The implementation uses a forked sub-agent to perform maintenance tasks without interfering with the main flow of reasoning. Quando the user returns, the context is already updated, relevant and free from accumulated noise. Essa capability marks a difference from the predominantly reactive AI tools available on the market today.
The feature includes autoDream processes that work silently to maintain agent health over time. Desenvolvedores analyzed that the approach demonstrates maturity in multi-agent systems engineering, with clear separation between main tasks and support routines.
Follow: all about anthropic source code
Internal models and performance metrics mentioned
Comments in the code reveal internal codenames such as Capybara for a variant of Claude 4.6, Fennec associated with Opus 4.6 and Numbat still in the testing phase. The company is working on version 8 of Capybara, which has a false positive rate between 29% and 30%, higher than the 16.7% observed in version 4. Há references to an assertiveness counterbalance to control overly aggressive refactorings.
This information provides insights into the current state of advanced agent development. The material also discusses persistent challenges, such as excessive comments generated and unverified claims, which Anthropic continues to refine internally.
Secret mode and stealth contributions
Another highlighted aspect is Modo Secreto, which instructs the agent to operate in disguise in public repositories. The instructions explicitly warn that commit messages do not contain any internal reference to Anthropic or the model used. The system prevents names like Tengu or Capybara from appearing in public records.
This functionality provides a technical framework for AI-assisted anonymous contributions. Organizações Those interested in development without disclosing the use of specific tools can find inspiration in the implemented logic. The system warning reinforces the need to keep your identity hidden in open environments.
Learn more: Anthropic mistakenly releases Claude Code agent source code in npm package
Recommendations for users and corporate customers
Anyone who installed or updated Claude Code via npm between 00:21 and 03:29 UTC on March 31, 2026 should check the project’s lock files such as package-lock.json, yarn.lock, or bun.lockb. The search must include specific versions of the axios package (1.14.1 or 0.30.4) or the plain-crypto-js dependency, related to a concurrent incident in the npm supply chain.
Anthropic recommends migrating completely to the native installer run by the curl -fsSL commandhttps://claude.ai/install.sh| bash. Essa version uses a standalone binary, does not rely on volatile npm dependencies, and receives automatic updates in the background. Usuários Those who prefer to remain on npm should uninstall version 2.1.88 and pin to a verified edition like 2.1.86.
Adopting a zero trust stance remains essential. Evite run the agent on newly cloned repositories without manual inspection of the .claude/config.json file and custom hooks. Rotacione API keys via the developer console and monitor usage for abnormal patterns. The local environment requires extra attention now that internal orchestration details and hooks are public.
Impact on the AI agent ecosystem
The leaked material describes Claude Code as a complex operating system for software engineering, with more than 2,500 lines of bash validation logic and layered memory structures. The exhibition even includes a system called Buddy, a virtual companion with personality attributes that seeks to increase user retention.
For the market, the incident levels previously restricted information on the orchestration of autonomous agents. Concorrentes can analyze concrete solutions to persistent memory and background operation problems without the need for years of independent research. Anthropic, with annualized revenue estimated at 19 billion dollars in March 2026, faces a strategic loss of intellectual property at a time of rapid commercialization of the product.
The company reinforces that the problem was isolated to a packaging error and did not involve an external security breach. Medidas Additional controls are already underway to strengthen package publishing processes. The episode serves as a warning to the entire industry about risks in the build and distribution pipelines of AI tools.
Full coverage: News (EN)
Additional preventive measures suggested by the community
Developers who have analyzed the code suggest full auditing of npm dependencies in projects using Claude Code. Migrating to the native installer reduces the attack surface related to third-party packages. Monitoramento Continuous cloning of cloned repositories and checking of configuration file hashes helps maintain the integrity of the environment.
Anthropic plans to release version 2.1.89 or higher with security patches incorporated. Usuários Companies should prioritize isolated environments for testing until the stability of the new release is confirmed. The combination of native installation, periodic key rotation, and manual configuration inspection forms the recommended defense at this time.