Anthropic's accidental leak of 512,000 lines of Claude Code source exposes security vulnerabilities and unreleased features across enterprise AI deployments.

On March 31, Anthropic shipped a 59.8 MB source map file in npm package version 2.1.88 containing unobfuscated TypeScript code across 1,906 files

The exposed code revealed the complete permission model, bash security validators, 44 unreleased feature flags, and references to unannounced models

Security researcher Chaofan Shou discovered and publicly disclosed the leak on X at approximately 4:23 UTC, leading to rapid spread across GitHub mirror repositories

Anthropic attributed the exposure to human packaging error with no customer data or model weights compromised, but containment efforts including copyright takedowns proved ineffective