April 3, 2026 AI company Anthropic confirmed on March 31 that portions of internal source code for its coding assistant Claude Code were inadvertently leaked due to human error in the release pipeline, involving approximately 512,000 lines of code across nearly 1,900 source files. According to the official statement, the leak originated from a packaging configuration error during an npm release. When publishing version 2.1.88 on March 30, Anthropic mistakenly included a 59.8MB cli.js.map source map file—a debugging artifact intended exclusively for internal development—in the public production package. This file enables full reconstruction of unobfuscated original TypeScript code. An Anthropic spokesperson stressed: No sensitive customer data, API credentials, or private information was exposed. This was a human error in release packaging, not a security breach. The company has rolled out immediate fixes and enhanced pre-release validation to prevent recurrence. The leaked code includes core architectural components of Claude Code: agent loop logic, multi-tool coordination modules, and implementations for several unreleased features. Cybersecurity analysts note that the source code alone is not a runnable product (it still depends on Anthropic’s cloud backend), but the exposed engineering details may offer competitive insights or be used to identify potential edge vulnerabilities. Notably, this is Anthropic’s second data exposure incident in a single week. On March 26, nearly 3,000 internal documents were made public due to a misconfiguration in its content management system (CMS). These consecutive lapses have raised market concerns about the company’s engineering and security governance amid rapid scaling. Anthropic is preparing for a potential IPO, with a current market valuation of approximately $38 billion. Analysts highlight that balancing rapid innovation with robust release and data security will be a critical challenge ahead of its public debut.