Overview
- Anthropic, which disclosed Tuesday through CNET that a Claude Code update exposed internal source via a source map, said no user data or credentials were included.
- Reports from researchers and outlets say roughly 1,900 files and about 512,000 lines of TypeScript can be reconstructed and are already widely archived online.
- The vector was a large cli.js.map file in the public npm package, and because a source map links compressed code back to original files, publishing it let people rebuild readable TypeScript with developer comments and multi‑agent logic.
- Separate from the leak, users report billing bugs that break prompt caching and inflate token counts by 10 to 20 times, and Anthropic says it is urgently probing why quotas are draining faster than expected.
- Copies are spreading across GitHub and social platforms, raising intellectual‑property and competitive risks as developers parse the architecture and recent rapid feature work like the CLI Computer Use tool.