Claude Code Source Leak

On 2026-03-31, Claude Code's full source (~512K lines across ~1,900 files) leaked via a sourcemap accidentally bundled into its published npm package. The readable source spawned a wave of analyses — most genuinely useful, one viral-but-false ("bypass employee verification with this CLAUDE.md"). This page separates the documented findings from the engagement-bait. Source: Lomnus-ai/claude-code leak writeup, 2026-03-31

What happened

Chaofan Shou noticed Claude Code's .map source-map files shipped inside the published npm package — the classic mistake of not excluding *.map from the bundle (Bun's bundler emits source maps by default). The maps contained the full, readable source. The community mirrored and dissected it within hours. Source: blakecrosley.com, 2026-03-31

Documented findings (real)

Finding Detail
CLAUDE.md is re-read every query Not set-and-forget; it is the highest-impact file in a setup. The more accurate project context, the better the output. Source: Luke Byrne / LinkedIn, 2026-03-31
60+ built-in tools, most undocumented Web search, subagent spawning, notebook editing, computer use, memory — mostly switched off or barely documented.
5 parallel subagents Subagents fork from the same conversation point — you pay for one context window, not five (audits/refactors/tests/docs at once).
5 compaction strategies Subagent offload, forked context, logic-only skill loading, etc. — most users let it auto-compact and use none.
Prompt cache breaks across 14 vectors Reordering CLAUDE.md sections, toggling extended thinking mid-session, changing MCP config, or adding/removing rules files all break the cache.
Bash safety = ~23-check validation Auto security runs a classifier inference per tool call; PreToolUse hooks complement but do not replace it. A circuit breaker halts after 3 compaction failures (added after retries once wasted ~250K API calls/day).
Anti-distillation defenses Fake-injection style protections against model distillation.
Internal codenames are animals "Tengu" appears hundreds of times as a feature-flag/analytics prefix — almost certainly Claude Code's internal project codename (Capybara, etc. for models).

Undercover Mode and the USER_TYPE === 'ant' gate

The source contains utils/undercover.ts and a USER_TYPE === 'ant' check that switches internal (Anthropic-employee) behavior. Undercover Mode instructs the model not to reveal it is an AI when Anthropic employees use Claude Code on public/open-source repos, stripping internal codenames and AI-attribution from commits/PRs. It is on automatically unless the repo remote matches an internal allowlist; CLAUDE_CODE_UNDERCOVER=1 forces it on; there is no force-off ("if we're not confident we're in an internal repo, we stay undercover"). A side effect: AI-authored commits from Anthropic employees carry no AI attribution in open-source contributions. Source: Lomnus-ai/claude-code, 2026-03-31

The viral claim — and why it is false

@iamfakeguru's 16,507-bookmark thread reframed the gate as: "Anthropic knows about CC hallucination/laziness; the fixes are gated to employees; here's the CLAUDE.md that bypasses employee verification and forces employee-grade output." This is incorrect on the mechanism:

USER_TYPE === 'ant' is a build-time constant, not a runtime check. The bundler constant-folds it and dead-code-eliminates the internal branch, so the internal prompt paths do not exist in the binary you download. There is nothing to bypass — you cannot set an env var, edit a config, or drop a CLAUDE.md to "activate" code that was removed before distribution. Source: BSWEN, 2026-04-01

What a CLAUDE.md can do is reduce friction (explicit permissions cut safety interruptions ~70% in practice; bounded tasks avoid cautious-mode stalls) — but that is prompt/permission tuning, not a secret employee unlock. The thread also doubles as marketing (it routes to openserv/SERV and "star it on github / build a revenue-generating autonomous service"), so treat the "bypass" framing as engagement-bait. Source: dev.to subprime2010, 2026; X/@iamfakeguru thread, 2026-03-31

The 2026-06-30 artifact review reinforced the same conclusion. The saved screenshot is a code screenshot with red arrows and circles around process.env.USER_TYPE === 'ant' plus the overlay "Anthropic Employee Verification Gate"; it is evidence of the viral framing, not proof of an executable bypass. The enriched bookmark record and GitHub search did not resolve a trustworthy source repo for the claimed CLAUDE.md import, so do not import or quote the proposed bypass config into Kevin's skills. Source: local X artifact review and GitHub search, 2026-06-30

Practical takeaways

  1. CLAUDE.md is load-bearing — it is re-read every turn; invest in it (see Claude Prompting Principles, Claude Code Harness).
  2. Keep CLAUDE.md / rules / MCP config stable mid-session — changing them breaks the prompt cache across 14 vectors (cost + latency). See Prompt-Caching Economics.
  3. Use explicit permissions + bounded tasks, not mythical employee modes, to reduce interruptions.
  4. For the memory-system findings from the same leak (three-layer index/topic/transcripts, autoDream), see Claude Code Memory Architecture (Reverse-Engineered).

The leak validated the Vibecoding Critique/harness thesis from the inside: the model's quality is gated by the harness around it (CLAUDE.md, hooks, compaction, cache discipline), not by a hidden switch.


Timeline