Claude Code Source Leak
On 2026-03-31, Claude Code's full source (~512K lines across ~1,900 files) leaked via a sourcemap accidentally bundled into its published npm package. The readable source spawned a wave of analyses — most genuinely useful, one viral-but-false ("bypass employee verification with this CLAUDE.md"). This page separates the documented findings from the engagement-bait. Source: Lomnus-ai/claude-code leak writeup, 2026-03-31
What happened
Chaofan Shou noticed Claude Code's .map source-map files shipped inside the published npm package — the classic mistake of not excluding *.map from the bundle (Bun's bundler emits source maps by default). The maps contained the full, readable source. The community mirrored and dissected it within hours. Source: blakecrosley.com, 2026-03-31
Documented findings (real)
| Finding | Detail |
|---|---|
| CLAUDE.md is re-read every query | Not set-and-forget; it is the highest-impact file in a setup. The more accurate project context, the better the output. Source: Luke Byrne / LinkedIn, 2026-03-31 |
| 60+ built-in tools, most undocumented | Web search, subagent spawning, notebook editing, computer use, memory — mostly switched off or barely documented. |
| 5 parallel subagents | Subagents fork from the same conversation point — you pay for one context window, not five (audits/refactors/tests/docs at once). |
| 5 compaction strategies | Subagent offload, forked context, logic-only skill loading, etc. — most users let it auto-compact and use none. |
| Prompt cache breaks across 14 vectors | Reordering CLAUDE.md sections, toggling extended thinking mid-session, changing MCP config, or adding/removing rules files all break the cache. |
| Bash safety = ~23-check validation | Auto security runs a classifier inference per tool call; PreToolUse hooks complement but do not replace it. A circuit breaker halts after 3 compaction failures (added after retries once wasted ~250K API calls/day). |
| Anti-distillation defenses | Fake-injection style protections against model distillation. |
| Internal codenames are animals | "Tengu" appears hundreds of times as a feature-flag/analytics prefix — almost certainly Claude Code's internal project codename (Capybara, etc. for models). |
Undercover Mode and the USER_TYPE === 'ant' gate
The source contains utils/undercover.ts and a USER_TYPE === 'ant' check that switches internal (Anthropic-employee) behavior. Undercover Mode instructs the model not to reveal it is an AI when Anthropic employees use Claude Code on public/open-source repos, stripping internal codenames and AI-attribution from commits/PRs. It is on automatically unless the repo remote matches an internal allowlist; CLAUDE_CODE_UNDERCOVER=1 forces it on; there is no force-off ("if we're not confident we're in an internal repo, we stay undercover"). A side effect: AI-authored commits from Anthropic employees carry no AI attribution in open-source contributions. Source: Lomnus-ai/claude-code, 2026-03-31
The viral claim — and why it is false
@iamfakeguru's 16,507-bookmark thread reframed the gate as: "Anthropic knows about CC hallucination/laziness; the fixes are gated to employees; here's the CLAUDE.md that bypasses employee verification and forces employee-grade output." This is incorrect on the mechanism:
USER_TYPE === 'ant' is a build-time constant, not a runtime check. The bundler constant-folds it and dead-code-eliminates the internal branch, so the internal prompt paths do not exist in the binary you download. There is nothing to bypass — you cannot set an env var, edit a config, or drop a CLAUDE.md to "activate" code that was removed before distribution. Source: BSWEN, 2026-04-01
What a CLAUDE.md can do is reduce friction (explicit permissions cut safety interruptions ~70% in practice; bounded tasks avoid cautious-mode stalls) — but that is prompt/permission tuning, not a secret employee unlock. The thread also doubles as marketing (it routes to openserv/SERV and "star it on github / build a revenue-generating autonomous service"), so treat the "bypass" framing as engagement-bait. Source: dev.to subprime2010, 2026; X/@iamfakeguru thread, 2026-03-31
The 2026-06-30 artifact review reinforced the same conclusion. The saved screenshot is a code screenshot with red arrows and circles around process.env.USER_TYPE === 'ant' plus the overlay "Anthropic Employee Verification Gate"; it is evidence of the viral framing, not proof of an executable bypass. The enriched bookmark record and GitHub search did not resolve a trustworthy source repo for the claimed CLAUDE.md import, so do not import or quote the proposed bypass config into Kevin's skills. Source: local X artifact review and GitHub search, 2026-06-30
Practical takeaways
- CLAUDE.md is load-bearing — it is re-read every turn; invest in it (see Claude Prompting Principles, Claude Code Harness).
- Keep CLAUDE.md / rules / MCP config stable mid-session — changing them breaks the prompt cache across 14 vectors (cost + latency). See Prompt-Caching Economics.
- Use explicit permissions + bounded tasks, not mythical employee modes, to reduce interruptions.
- For the memory-system findings from the same leak (three-layer index/topic/transcripts, autoDream), see Claude Code Memory Architecture (Reverse-Engineered).
The leak validated the Vibecoding Critique/harness thesis from the inside: the model's quality is gated by the harness around it (CLAUDE.md, hooks, compaction, cache discipline), not by a hidden switch.
Timeline
- 2026-06-30 | Re-reviewed the local screenshot artifact and enriched thread. Confirmed it should be retained as a misinformation/provenance artifact, not as an executable skill source; no resolved repository or credible runtime bypass was found. Source: X bookmark artifact audit, 2026-06-30
- 2026-03-31 | Claude Code's full source (~512K lines, ~1,900 files) leaked via npm sourcemaps; discovered by Chaofan Shou. Community mirrors + analyses followed. Source: Lomnus-ai/claude-code, 2026-03-31
- 2026-03-31 | @iamfakeguru's "reverse-engineered the leaked source… bypass employee verification" thread — 9,220 likes, 16,507 bookmarks. Memory specifics absorbed into Claude Code Memory Architecture (Reverse-Engineered); the "employee-gating bypass" framing debunked here. Source: X/@iamfakeguru, 2026-03-31
- 2026-03-31 | @himanshustwts published the source-based memory-architecture recipe — 6,280 likes, 8,305 bookmarks (see Claude Code Memory Architecture (Reverse-Engineered)). Source: X/@himanshustwts, 2026-03-31
- 2026-04-01 | Independent write-ups confirmed
USER_TYPE === 'ant'is a dead-code-eliminated build-time constant — no external bypass exists. Source: BSWEN, 2026-04-01 - 2026-06-12 | Page created from coding-agents bookmark absorption; compiled findings + debunk from multiple independent analyses. Source: compiled, 2026-06-12