What Happened
On March 31, developer Chaofan Shou noticed that Anthropic had shipped a .map file alongside the Claude Code npm package — a file containing the full, readable source code of the CLI tool. The package was quickly pulled, but not before the code was widely mirrored and picked apart on Hacker News.
This is Anthropic's second accidental exposure in a week. Just days prior, an unsecured data store exposed details of an unreleased model codenamed "Mythos" and internal event information. Some on social media started wondering if someone inside is doing this on purpose. Probably not — but the timing is a bad look either way.
Context: This leak comes just ten days after Anthropic sent legal threats to OpenCode, forcing the removal of built-in Claude authentication because third-party tools were accessing Opus at subscription rates instead of pay-per-token pricing. The source code reveals why that fight mattered so much.
Anti-Distillation: Fake Tools to Poison AI Copycats
In claude.ts (lines 301–313), there's a flag called ANTI_DISTILLATION_CC. When enabled, Claude Code sends anti_distillation: ['fake_tools'] in its API requests, telling the server to silently inject decoy tool definitions into the system prompt.
The idea: if someone is recording Claude Code's API traffic to train a competing model, the fake tools pollute that training data. It's gated behind a GrowthBook feature flag and only active for first-party CLI sessions.
Whether you see this as smart defensive engineering or anti-competitive behavior depends on where you stand on the distillation debate. The technical protection isn't airtight — a MITM proxy stripping the anti_distillation field would bypass it — but the legal threat is the real enforcement.
Undercover Mode: AI That Hides It's AI
The file undercover.ts (roughly 90 lines) implements a mode that strips all traces of Anthropic internals when Claude Code is used in non-internal repos. It instructs the model to never mention internal codenames like "Capybara" or "Tengu," internal Slack channels, repo names, or the phrase "Claude Code" itself.
The kicker is line 15:
"There is NO force-OFF. This guards against model codename leaks."
You can force it ON with CLAUDE_CODE_UNDERCOVER=1, but there's no way to force it off. In external builds, the entire function gets dead-code-eliminated to trivial returns — a one-way door.
The obvious concern, raised repeatedly on Hacker News: AI-authored commits and PRs from Anthropic employees in open source projects will have no indication that an AI wrote them. It's one thing to hide internal codenames. It's another to have the AI actively present as human.
Frustration Detection via Regex
In userPromptKeywords.ts, there's a regex pattern that detects user frustration:
/\b(wtf|wth|ffs|omfg|shit(ty|tiest)?|dumbass|horrible|awful|piss(ed|ing)? off|piece of (shit|crap|junk)|what the (fuck|hell)|fucking? (broken|useless|terrible|awful|horrible)|fuck you|screw (this|you)|so frustrating|this sucks|damn it)\b/
The general reaction on HN: peak irony. An LLM company using regex for sentiment analysis. But as several commenters noted, it's probably faster and cheaper than running LLM inference just to detect a swearing user.
Native Client Attestation: DRM for API Calls
In system.ts, API requests include a cch=00000 placeholder. Before the request leaves the process, Bun's native HTTP stack (written in Zig) overwrites those five zeros with a computed hash. The server validates the hash to confirm the request came from a real Claude Code binary.
They use a same-length placeholder so the replacement doesn't change the Content-Length header. The computation happens below the JavaScript runtime — invisible to anything running in the JS layer. It's DRM for API calls at the HTTP transport level.
This is the technical enforcement behind the OpenCode legal fight. It's not airtight — the placeholder only gets injected when a compile-time flag is set, and setting CLAUDE_CODE_ATTRIBUTION_HEADER to a falsy value disables it entirely — but it explains why Anthropic went legal instead of just changing the API.
250,000 Wasted API Calls Per Day
A source comment in autoCompact.ts (lines 68–70) tells the whole story:
"BQ 2026-03-10: 1,279 sessions had 50+ consecutive failures (up to 3,272) in a single session, wasting ~250K API calls/day globally."
The fix? MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES = 3. After 3 consecutive failures, compaction is disabled for the rest of the session.
KAIROS: The Unreleased Autonomous Agent
Throughout the codebase, there are references to a feature-gated mode called KAIROS. Based on code paths in main.tsx, it appears to be an unreleased autonomous agent mode that includes a /dream skill for "nightly memory distillation" and other features not yet publicly available.
Why this matters for the agent space: Claude Code is one of the most widely used developer-facing AI agents. What its source reveals about Anthropic's roadmap — anti-distillation strategies, unreleased autonomous modes, the technical lengths taken to prevent API misuse — offers a rare look inside how AI companies think about protecting and differentiating their agent products.