Yesterday in AI: 31 March 2026 — 512K Lines of Claude Code Spilled Online
Anthropic accidentally leaked its entire Claude Code source harness via a bad npm package, unveiling an unreleased 'Capybara' model — its second major disclosure in five days. Plus: usage limits snap and Veeam joins MCP.
By OMC Editorial on 2026-04-01
Five days after leaking details of its unreleased "Mythos" model, Anthropic published 512,000 lines of its Claude Code source harness to the open internet — its second major accidental disclosure in under a week.
The npm Packaging Error
On March 31, version 2.1.88 of the @anthropic-ai/claude-code npm package shipped with an unobfuscated TypeScript source map pointing to a zip archive on Anthropic's Cloudflare R2 storage bucket. Blockchain security researcher Chaofan Shou of Fuzzland spotted the open link and posted it on X. Within hours, a GitHub mirror of the roughly 1,990 source files had accumulated more than 41,500 forks, putting the complete agentic harness in hundreds of thousands of hands. Anthropic confirmed the leak, calling it "a release packaging issue caused by human error, not a security breach," and said no customer data or credentials were exposed. The incident raised sharp questions about release discipline at a company whose own product is used to ship production code at scale. The Registerhttps://www.theregister.com/2026/03/31/anthropicclaudecodesourcecode/ · Fortunehttps://fortune.com/2026/03/31/anthropic-source-code-claude-code-data-leak-second-security-lapse-days-after-accidentally-revealing-mythos/
What the Code Revealed: "Capybara"
Buried inside the leaked harness were internal references to an unreleased model codenamed Capybara, apparently coming in both a "fast" and a "slow" variant — which researchers speculate could be Anthropic's most capable model yet. The 512,000 lines also contained "frustration regexes" — pattern-matching rules that detect when a user is upset — and an undocumented "undercover mode" that modifies Claude Code's behavioral profile in ways not described in public documentation. Whether Capybara is the same as the earlier-leaked "Mythos" model remains unconfirmed by Anthropic, though two major accidental disclosures in under a week have made it hard to contain speculation. The leaked harness is notable because some