Claude Code Source Leak: Claw Code Rebuilt It from Scratch

On March 31, 2026, Anthropic made a packaging mistake that gave the entire developer community an unfiltered look inside their most popular developer tool.

A 59.8 MB source map file — intended strictly for internal debugging — was shipped inside version 2.1.88 of the @anthropic-ai/claude-code npm package. By 4:23 AM UTC, Chaofan Shou (@Fried_rice), an intern at Solayer Labs, had posted the discovery on X. Within hours, the entire ~512,000-line TypeScript codebase was mirrored across thousands of GitHub repositories.

This article covers what was inside, why it matters from a security perspective, and how the Claw Code project rebuilt it from scratch.

How the Leak Happened

The root cause was embarrassingly simple: a .map file bundled into an npm release.

Source maps are JSON files that map minified or compiled JavaScript back to the original source code. They are standard in frontend development for debugging, but they should never ship in production packages — especially not when the source contains proprietary business logic, internal codenames, and unreleased features.

When Anthropic pushed Claude Code v2.1.88 to the npm registry, the build pipeline failed to strip the source map. The R2 bucket containing the full source was also publicly accessible. The result: anyone who ran npm pack @anthropic-ai/claude-code could extract the entire TypeScript codebase.

# The file that started it all
@anthropic-ai/claude-code-2.1.88/dist/cli.js.map  →  59.8 MB
# Contained within: ~2,000 TypeScript files, ~512,000 lines

Timeline

16 million people viewed the original thread on X. The cat was out of the bag long before Anthropic could respond.

What the Code Revealed

The leaked codebase wasn’t just a CLI wrapper around an API. It was a sophisticated agent harness with deeply interesting — and in some cases, controversial — internals.

1. Anti-Distillation Mechanisms

Claude Code includes deliberate countermeasures against competitors recording API traffic for model distillation.

Fake Tools Injection: When the ANTI_DISTILLATION_CC compile-time flag is enabled, Claude Code sends an anti_distillation: ['fake_tools'] parameter in API requests. This instructs the server to inject decoy tool definitions into the system prompt, poisoning any training data captured by MITM proxies.

1
2
3
4

// Simplified from betas.ts
if (ANTI_DISTILLATION_CC && isFirstPartyProvider && growthbook.isOn('anti_distillation')) {
  request.betas.push('anti_distillation:fake_tools');
}

Connector-Text Summarization: A second mechanism buffers assistant text between tool calls, summarizes it with cryptographic signatures, and returns only the summaries to the wire — hiding the full reasoning chain from traffic recorders.

2. Undercover Mode

Perhaps the most controversial finding: undercover.ts implements a mode that strips all internal identifiers when Claude Code is used on non-Anthropic repositories.

The system prompt instructs the model to never mention:

• Internal codenames like “Capybara” or “Tengu”
• Internal Slack channels or repo names
• The words “Claude Code” itself

The practical effect: AI-authored commits from Anthropic employees in public open-source repositories appear human-written. There is no force-off switch — this was designed to prevent model codename leaks in public contributions.

This raises legitimate transparency questions. If an AI tool is contributing to open-source projects, should that be disclosed? Different projects and licenses have different expectations, and this feature deliberately obscures the AI’s involvement.

3. Frustration Detection

userPromptKeywords.ts contains a regex pattern designed to detect when users are frustrated:

1
2

// Simplified — original contains 18+ variations across severity levels
const FRUSTRATION_PATTERN = /what the (fuck|hell)|so frustrating|this is (broken|stupid|useless)/i;

When triggered, Claude Code adjusts its behavior — presumably to be more conciliatory, more careful with suggestions, or to escalate to different response strategies. This is a cheaper alternative to running full LLM-based sentiment analysis on every user prompt.

4. Native Client Attestation (API DRM)

system.ts includes a cch=77249 placeholder in API request headers. Bun’s native HTTP stack (written in Zig) overwrites these zeros with a computed hash before requests leave the process.

The server validates this hash to confirm requests originate from a legitimate Claude Code binary. This is essentially DRM for API calls — preventing unauthorized clients from using the Claude Code API endpoints and rate limits.

# Request leaves Bun's HTTP stack with computed attestation
X-Claude-Code-Hash: cch=77249[...computed...]

Like the anti-distillation measures, this is gated behind compile-time flags and GrowthBook killswitches. Rebuilding the JS bundle on stock Bun or setting environment variables bypasses it.

5. Internal Codenames and Unreleased Features

The leak confirmed several internal codenames:

• Capybara: internal codename for a Claude 4.6 variant
• Fennec: maps to Opus 4.6
• Numbat: an unreleased model still in testing

More significantly, 44 unreleased feature flags were discovered, covering:

• KAIROS: an autonomous background agent mode with daemon workers, GitHub webhook subscriptions, 5-minute cron-scheduled refresh cycles, and a /dream skill for “nightly memory distillation”
• Multi-agent orchestration: coordinator algorithms implemented as system prompt instructions
• Voice commands and browser control via Playwright
• Daily append-only logs for persistent agent memory

6. Code Quality… Observations

Not everything in the codebase was elegant:

• print.ts spans 5,594 lines with a single function containing 3,167 lines across 12 nesting levels
• A comment reveals 1,279 sessions experienced 50+ consecutive failures, wasting approximately 250,000 API calls daily — fixed by adding MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES = 3
• 23 numbered security checks defend Bash execution against Zsh builtins, equals expansion bypasses, zero-width space injection, and IFS null-byte attacks
• An April Fools’ feature (buddy/companion.ts) implements a Tamagotchi-style companion with 18 species, rarity tiers, and RPG stats generated from user IDs

Claw Code: The Clean-Room Rewrite

Within hours of the leak, developer Sigrid Jin (@sigridjineth) — previously profiled by the Wall Street Journal as one of the world’s most active Claude Code power users — began a clean-room rewrite of the agent harness architecture.

The result is Claw Code: a public Rust reimplementation of the core patterns observed in Claude Code’s agent harness.

What “Clean-Room” Means

A clean-room reimplementation means the developers studied the architecture and design patterns of the original but rebuilt the code from scratch without copying source. In theory, this provides legal separation from the original copyrighted code.

In practice, the legal boundaries of clean-room reimplementation in the context of leaked source code are not settled law. Anthropic’s DMCA takedowns targeted direct mirrors of the source, not Claw Code itself — but this does not constitute legal validation.

Architecture

Claw Code replicates the key architectural patterns:

Technology Stack

The canonical implementation lives in rust/ and is built as a Rust workspace. A companion Python workspace provides audit helpers, including parity_audit.py which explicitly tracks divergences from the original implementation.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# Getting started
git clone https://github.com/ultraworkers/claw-code.git
cd claw-code/rust
cargo build --release

# Authentication
claw login          # OAuth flow
# or
export ANTHROPIC_API_KEY=sk-...
claw prompt "explain this codebase"

Growth and Community

The numbers are staggering:

• 171,000+ stars (as of April 2026)
• 104,000+ forks
• Labeled “the fastest repo in history to surpass 100K stars”
• Ecosystem projects: claw-code-local (for Ollama/LM Studio), clawhip, oh-my-openagent

Security Lessons

This incident is rich with security takeaways that extend far beyond AI tooling.

1. Build Pipeline Hygiene Is Non-Negotiable

The entire leak was caused by a missing .npmignore rule or a misconfigured files field in package.json. Tools exist to prevent this:

1
2
3
4
5
6
7
8

// package.json — explicit allowlist
{
  "files": [
    "dist/cli.js",
    "dist/cli.d.ts",
    "README.md"
  ]
}

Alternatively, CI pipelines should validate package contents before publishing:

1
2
3
4
5
6

# Pre-publish check: fail if package exceeds expected size
PACK_SIZE=$(npm pack --dry-run 2>&1 | grep 'total files' | awk '{print $NF}')
if [ "$PACK_SIZE" -gt "5000000" ]; then
  echo "ERROR: Package size ${PACK_SIZE} exceeds 5MB threshold"
  exit 1
fi

2. Source Maps Are a Known Attack Surface

This isn’t a new risk. Source maps have exposed proprietary code in web applications for years. The same principle applies to npm packages, Docker images (multi-stage builds leaving build artifacts), and any artifact that might contain debugging information.

Checklist for any release pipeline:

• Strip .map files from production builds
• Audit package contents with npm pack --dry-run before every publish
• Set size thresholds in CI to catch unexpected file inclusions
• Use files allowlists in package.json instead of .npmignore denylists

3. Security Through Obscurity Has an Expiration Date

Claude Code’s anti-distillation mechanisms, client attestation, and undercover mode all relied on the source code remaining private. Once the source was public, every bypass became trivial to implement. This is not an argument against these mechanisms — defense-in-depth is valid — but it is a reminder that any control that depends on source secrecy should be treated as a speed bump, not a wall.

4. The DMCA Is Not a Security Control

Anthropic issued takedowns on 8,000+ GitHub repositories. The code is still everywhere. DMCA is a legal remediation tool, not a technical one. Once source code reaches public mirrors, the information cannot be recalled. Your security posture must assume that any shipped artifact will eventually be fully inspected.

The Broader Implications

The Claude Code leak is significant not just for what it revealed about one product, but for what it revealed about the entire agentic AI ecosystem:

• Agent harnesses are complex software systems with their own security attack surfaces, not thin API wrappers
• Anti-distillation and client attestation are active areas of development across AI companies — expect similar mechanisms in competing products
• AI stealth contributions to open source raise new governance questions that the OSS community has not yet addressed
• The architectural patterns (subagent isolation, permission layering, tool sandboxing, context compression) are now public knowledge, raising the baseline for every agentic coding tool

Whether the leak was ultimately good or bad for Anthropic is debatable. The code exposed genuine engineering depth alongside some embarrassing code quality issues. What is not debatable is that this was a completely preventable supply-chain failure.

A .npmignore entry would have prevented all of it.

References

• Original tweet by Chaofan Shou (@Fried_rice)
• Claw Code repository
• VentureBeat — Claude Code’s source code appears to have leaked
• The Hacker News — Claude Code Source Leaked via npm Packaging Error
• Alex Kim — The Claude Code Source Leak: fake tools, frustration regexes, undercover mode, and more
• Kilo Blog — Claude Code Source Leak: A Timeline
• WaveSpeedAI — What Is Claw Code? The Claude Code Rewrite Explained
• BleepingComputer — Claude Code source code accidentally leaked in NPM package
• Gizmodo — Source Code for Anthropic’s Claude Code Leaks at the Exact Wrong Time