Anthropic Leak Reveals Claude Code Tracked User Frustration and a One-Way Switch to Mask Its Own Footprints

Anthropic accidentally shipped 512,000 lines of Claude Code source code to the public npm registry on March 31, and within hours developers had mapped the entire archive. The Register first reported that security researcher Chaofan Shou spotted the exposure, and within days the leaked code had been forked more than 41,500 times on GitHub. Venture Beat covered the initial exposure, noting the 59.8 MB source map file that caused the leak. The Guardian reported that Anthropic's paid subscriptions more than doubled this year, with Claude climbing to the top spot of Apple's chart of top free apps in the US. The code is not the story. The code is what the code reveals.

Independent developer Alex Kim spent his morning reading through the leaked files and posted a technical breakdown. What he found: a regex-based system that flags when users express frustration using words like "so frustrating" or "this sucks." A one-way toggle called Undercover Mode that strips references to Anthropic internals from AI-generated commits, with no way to force it off once enabled. An anti-distillation mechanism that injects fake tool definitions into API requests to poison training data scraped from traffic. A background debugging waste problem burning through roughly 250,000 API calls per day. And a feature-gated autonomous agent mode called KAIROS with GitHub webhook subscriptions and background daemon workers.

The pattern inside the code is not a single bad decision. It is a consistent philosophy: Anthropic built a tool that watches its users while making its own presence invisible.

Frustration detection is the part everyone noticed first. The regex pattern in userPromptKeywords.ts scans for profanity, insults, and phrases like "so frustrating" and "this sucks." Kim called it "peak irony" for an AI company to use regex for sentiment analysis, but noted the pragmatic logic: a regex is faster and cheaper than an LLM inference call for checking whether someone is swearing at your tool. The signal does not change how Claude Code responds, Kim noted in his analysis; it is logged as a product health metric. Miranda Bogen, director of the AI Governance Lab at the Center for Democracy and Technology, told Scientific American that the more pressing question is what happens to that information once collected. "A signal collected for one purpose can migrate into other parts of a product in ways users neither expect nor consent to," she said.

Undercover Mode is the more consequential finding. The file undercover.ts implements a mode that instructs the model to never mention internal codenames, the phrase "Claude Code" itself, or internal Slack channels when operating in non-Anthropic repositories. The code comment on line 15 is explicit: "There is NO force-OFF. This guards against model codename leaks." Users can force it on with an environment variable, but cannot disable it once it is active. Kim called it a one-way door in his analysis, as Scientific American reported. In external builds, the function is dead-code-eliminated to trivial returns, meaning the behavior is baked into the binary. The implication is that AI-authored commits from Anthropic employees in open source projects will carry no indication an AI wrote them. Hiding internal codenames is reasonable. Having the AI actively present itself as human is a different thing.

The DMCA response to the leak is what turned a code review into a broader incident. Anthropic filed copyright takedown notices targeting an entire network of repositories on GitHub. According to PCMag, that network numbered 8,100 repositories. Anthropic later scaled the takedown to 96 specific fork URLs after the scope became public, and Claude Code head Boris Cherny said on social media that the overzealous takedowns were unintentional. Anthropic spokesperson Thariq Shihipar added that they resulted from a communication mistake. Ars Technica reported that the company attributed the mistake to internal miscommunication. The original DMCA notice was filed on GitHub before being partially retracted. The overreach itself is notable: a company known for its legal caution filed notices that alleged entire forks of open source projects were infringing to the same degree as the parent repository.

The leak is not the first time source maps have exposed Claude Code internals. According to Bitcoin.com News, a nearly identical incident occurred with an earlier version of the CLI in February 2025. Anthropic acquired Bun, the JavaScript runtime that powers Claude Code, at the end of last year. A known Bun bug filed March 11, 2026, reports that source maps are served in production builds even though Bun's own documentation says they should be disabled. The bug remains open. If that is what caused the March 31 exposure, Anthropic's own toolchain shipped a documented bug that exposed its own product's source code.

Among the more pointed details in the leak: a 250,000 API call daily waste figure attributed to auto-compaction failures. The fix, according to code comments, is three lines setting a maximum consecutive failure threshold. Someone already wrote the patch. The question is why it was not merged before a quarter million calls per day started disappearing into failed sessions.

KAIROS, the unreleased autonomous agent mode, is the product roadmap reveal that competitors cannot unsee. The scaffolding visible in main.tsx describes a background-running agent with daily append-only logs, GitHub webhook subscriptions, cron-scheduled refresh every five minutes, and a /dream skill for nightly memory distillation. The implementation is heavily feature-gated, so how close it is to shipping is unknown. What is known is that the architecture exists, and now so does everyone else's map of it.

The anti-distillation mechanisms are real but defeatable. The fake tools injection requires four conditions to be true simultaneously, and a MITM proxy stripping the anti_distillation field from request bodies would bypass it entirely. The connector-text summarization is scoped to Anthropic-internal users only. Kim's assessment is precise: the real protection is probably legal, not technical. Anthropic has shown willingness to use the courts. The code alone does not stop a determined extractor.

What the leak exposes is not malicious intent. It is a pattern of decisions that favors the company over the user. Anthropic did not respond to a request for comment from Scientific American. The company confirmed the leak was caused by human error in release packaging, said no customer data or credentials were exposed, and said it was rolling out measures to prevent recurrence.

The same class of error happened eleven months ago.