Anthropic confirmed a packaging error in the npm release of its Claude Code assistant led to a full source code leak. The incident, stemming from an included source map file in version 2.1.88, exposed nearly 2,000 TypeScript files. The company stated no customer data or credentials were involved, calling it a release issue, not a security breach.

For engineers, the leak provides a rare public blueprint of a production AI agent system. The code reveals architectural decisions for overcoming context window limits, including a self-healing memory system. It shows a multi-agent orchestration layer for spawning sub-agents, a tools system for capabilities like bash execution, and a bidirectional communication layer linking IDE extensions to a CLI.

Notable implementations include 'KAIROS,' a persistent background agent for proactive task execution, and controls designed to poison API outputs against model distillation attacks. A system prompt for 'Undercover Mode' details procedures for contributing to open-source repos without revealing Anthropic's involvement.

The exposure introduces immediate engineering risks. Attackers can analyze the four-stage context management pipeline to craft persistent payloads. More concretely, a compromised HTTP client was bundled in the npm package for a three-hour window, requiring user downgrades and secret rotation. Typosquatting packages with names like 'audio-capture-napi' have appeared, aiming for dependency confusion attacks against those attempting to compile the leaked code.

This follows another incident where Anthropic left model details exposed in a CMS, highlighting systemic challenges in securing complex ML delivery pipelines.

Source: The Hackers News