Claude Code's source code has been leaked via a map file in their NPM registry

The Take

Jordan Calloway · Government Secrets & FOIA

# THE TAKE Anthropic's "accidental" source code leak via NPM registry map file is either gross negligence or calculated opacity theater. Here's what doesn't add up: enterprise-grade DevOps teams don't casually expose proprietary model architecture through package manifests. Someone either knew, or the security posture is so Swiss cheese that Claude's safety claims deserve immediate scrutiny. The timing matters. Leaked regex patterns for content filtering and tool handling reveal Anthropic's actual guardrails—not the sanitized descriptions in their public documentation. Those undocumented fallback mechanisms? That's what regulators should be examining, not the PR narrative about "constitutional AI." I've reviewed the thread. The fake tool signatures and frustration catches in the code suggest their stated capabilities exceed reality in ways users never see. That's a credibility problem when Anthropic's been positioning themselves as the *trustworthy* AI alternative to OpenAI. This wasn't a security researcher finding a vulnerability. This was leaked infrastructure. Someone inside or with access wanted this out. The question isn't whether Anthropic's embarrassed—it's whether they'll finally disclose what they've actually been hiding in the model weights and the operational logic nobody gets to audit.