Claude Code's source just leaked. Here is what Anthropic can and cannot do.

Claude Code generates roughly $2.5 billion in annualized recurring revenue. It is the backbone of Anthropic's developer ecosystem. And as of this morning, its complete TypeScript source, all 512,000 lines of it, is mirrored across GitHub, dissected on Hacker News, and analyzed by every AI coding tool competitor on the planet. For a company running at a $19 billion revenue clip, this is not an academic exercise. This is a live IP crisis.

The leak exposes a gap that every AI company building proprietary tooling should understand. Copyright will protect the code. Trade secret law almost certainly will not. And the case law that governs this outcome is decades old, written for an era before npm, before cloud storage buckets, before a single post on X could disseminate half a million lines of proprietary code to millions of people in hours.

This analysis is for IP lawyers, AI policy practitioners, and in-house counsel at AI companies. We are going deep on doctrine.

What Actually Happened

Version 2.1.88 of the @anthropic-ai/claude-code npm package shipped with a 59.8 MB source map file (.map) that should never have been included. Source map files are debugging artifacts. They bridge minified production code and the original human-readable source. Claude Code is built on Bun's bundler, which generates source maps by default unless explicitly disabled. Someone failed to exclude the file via .npmignore or bundler configuration.

The .map file referenced a publicly accessible Cloudflare R2 storage bucket containing the full, unobfuscated TypeScript source as a ZIP archive. No authentication. No access controls. No terms of use.

Security researcher Chaofan Shou, an intern at Solayer Labs, found it and posted the discovery to X at 4:23 AM ET. Within hours, the codebase was mirrored across multiple GitHub repositories. 1,900 files. Detailed technical breakdowns were published by VentureBeat, The Register, Cybernews, and picked apart on Hacker News.

Anthropic pulled the package and issued a statement: "This was a release packaging issue caused by human error, not a security breach. We're rolling out measures to prevent this from happening again."

What was exposed is significant: the full system prompt, the tool orchestration architecture, the permission model, multi-agent coordination logic (Coordinator Mode), unreleased features including an always-on daemon codenamed KAIROS, internal model codenames (Capybara for Claude 4.6, Fennec for Opus 4.6, an unreleased variant called Numbat), internal quality metrics showing a 29-30% false claims rate in the latest Capybara iteration, and a feature called "Undercover Mode" designed to erase AI traces from commit records when Anthropic employees contribute to public open-source repositories.

What was not exposed: model weights, training data, API keys, customer data.

The irony is thick enough to cut. Anthropic built an entire internal system specifically designed to prevent information leakage. Then it defeated that system with a build configuration oversight. And this was not the first time. A substantially similar source map exposure occurred in early 2025 and was patched then. The same class of failure, repeated.

Copyright: The Strong Claim

The copyright analysis is straightforward and favorable to Anthropic.

Copyright attaches automatically to original works of authorship at the moment of creation. 17 U.S.C. § 102. No registration is required for protection to exist (though registration is required to sue for statutory damages and attorney's fees in federal court). Anthropic is the author and owner of the Claude Code source code. Accidental publication does not abandon copyright. There is no "finders keepers" doctrine. Publication without a license is not a license.

The GitHub mirror repositories are straightforward infringement: unauthorized reproduction and distribution under 17 U.S.C. § 106. DMCA takedowns are the immediate remedy, and at least one of the original uploaders has already taken down his mirror, citing concerns about legal liability for hosting Anthropic's intellectual property.

But copyright has a structural limitation that defines the ceiling of Anthropic's legal protection. Section 102(b) of the Copyright Act provides that copyright does not extend to "any idea, procedure, process, system, method of operation, concept, principle, or discovery." Copyright protects expression. It does not protect the architectural patterns, design concepts, or functional logic embedded in that expression.

The Ninth Circuit made this principle concrete in the software context in Sega Enterprises Ltd. v. Accolade, Inc., 977 F.2d 1510 (9th Cir. 1993), holding that "where disassembly is the only way to gain access to the ideas and functional elements embodied in a copyrighted computer program and where there is a legitimate reason for seeking such access, disassembly is a fair use of the copyrighted work, as a matter of law." In the Claude Code leak, disassembly was not even necessary. Anthropic handed the unobfuscated source to the public directly.

The practical upshot: Anthropic can force takedowns of verbatim mirrors. It can sue anyone who copies code line-for-line or creates derivative works incorporating its protectable expression. It cannot stop anyone from reading, understanding, and independently reimplementing the architectural concepts, the tool-calling patterns, the permission model, the multi-agent orchestration logic. Those are ideas and methods of operation. Under § 102(b), they are free to study and free to rebuild.

Trade Secrets: The Vulnerable Claim

Trade secret law is where Anthropic's position collapses.

The Framework

Trade secret protection under both the Defend Trade Secrets Act (DTSA), 18 U.S.C. § 1839(3), and the Uniform Trade Secrets Act (UTSA) requires three elements: (1) the information derives independent economic value from not being generally known to persons who can obtain value from its disclosure, (2) the information is not readily ascertainable by proper means, and (3) the owner has taken reasonable efforts to maintain its secrecy.

The critical distinction from copyright is this: trade secret protection can be destroyed by the holder's own conduct. Copyright cannot. That asymmetry is the entire story.

The Supreme Court stated the governing principle in Ruckelshaus v. Monsanto Co., 467 U.S. 986 (1984): "Because of the intangible nature of a trade secret, the extent of the property right therein is defined by the extent to which the owner of the secret protects his interest from disclosure to others." And: "[i]f an individual discloses his trade secret to others who are under no obligation to protect the confidentiality of the information, or otherwise publicly discloses the secret, his property right is extinguished."

Extinguished. Not diminished. Extinguished.

The Prosecution: Why Anthropic's Trade Secrets Might Survive

If you are defending Anthropic's trade secret position, you build from the principle that the law requires reasonable measures, not perfect ones. The W.D. Pennsylvania court held in Vertical Bridge REIT, LLC v. Everest Infrastructure Partners, Inc., No. 2:23-cv-01017 (W.D. Pa. Feb. 20, 2025) that trade secret protection requires "reasonable protective measures," and "not perfect ones": "not all disclosures will destroy a trade secret." Whether a plaintiff took reasonable measures is "generally, 'a question of fact'" requiring full discovery, not dispositive ruling at the motion stage.

Anthropic did take protective steps. Claude Code was distributed as obfuscated, minified JavaScript. The company maintained the product as proprietary, closed-source software. It employed internal security protocols, including the "Undercover Mode" system. The .map file inclusion was a build pipeline error in a CI/CD process, not a deliberate act of publication. One misconfiguration, in the context of an otherwise comprehensive security program, arguably does not negate reasonable measures.

You would also invoke the "obscure or transient" publication doctrine. The California appellate court held in DVD Copy Control Ass'n Inc. v. Bunner, 10 Cal. Rptr. 3d 185 (Cal. Ct. App. 2004) that "[p]ublication on the Internet does not necessarily destroy the secret if the publication is sufficiently obscure or transient or otherwise limited so that it does not become generally known to the relevant people, i.e., potential competitors or other persons to whom the information would have some economic value." The same principle appeared in Art of Living Foundation v. Does 1-10, No. 5:10-cv-05022 (N.D. Cal. Jun. 15, 2011). The .map file was buried inside an npm package, not linked on a public webpage, not indexed by search engines. Specific sub-components buried in those 512,000 lines, novel algorithms, internal model routing heuristics, proprietary optimization techniques, may not have been individually parsed and disseminated before removal. For those elements, trade secret status arguably survives.

And you would point to Anthropic's rapid response as evidence of continuing intent to maintain secrecy. The Netcom court found that trade secret documents temporarily available in unsealed court records did not lose protection where the plaintiff "evidenc[ed] continuing intent to maintain its secrecy by acting to seal the record." Religious Technology Center v. Netcom On-Line Communication Services, Inc., 923 F. Supp. 1231 (N.D. Cal. 1995). Anthropic's immediate takedown and public assertion of proprietary rights fits within this principle.

Finally, even after public disclosure, a competitor that acquires the code with actual knowledge of its trade secret origin and uses it commercially may face liability. The combination of all these elements into an integrated system may independently qualify as a combination trade secret, even if individual components became publicly known.

That is the best case for Anthropic. It is credible in part, and it fails in whole.

The Defense: Why the Trade Secrets Are Dead

The attack on Anthropic's trade secret position is devastating, and the case law is closer to the facts than anything the prosecution can muster.

Start with the publication itself. Anthropic published the code to npm, the world's largest JavaScript package registry. npm is a public platform. Anyone in the world could download the package. No NDA attached to the download. No terms of service restricting access to the .map file contents. No encryption on the R2 bucket. No password. No access control. Under Ruckelshaus, disclosure to persons under no obligation to maintain confidentiality extinguishes the property right. Ruckelshaus v. Monsanto Co., 467 U.S. 986 (1984). That is the rule from the Supreme Court.

The district court in Arkeyo, LLC v. Cummins Allison Corp., 342 F. Supp. 3d 622 (E.D. Pa. 2017) held that "[t]he posting of materials on the internet without any confidentiality protections makes the information publicly available and renders the materials incapable of trade secret status." The same court catalogued what "reasonable measures" look like in the software context: random URL names, HTTPS encryption, password protection, code obfuscation, and terms of use restricting reverse engineering. Anthropic failed on every metric with respect to the source map file.

Arkeyo is particularly instructive because, like the Claude Code leak, it involved software distributed as a downloadable archive. The plaintiff there argued that distributing executable code (rather than source code) preserved secrecy. The court rejected the argument: the executable code "could be translated into source code through the relatively simple process of decompilation," and the plaintiff's contention that its software was not publicly available because it only appeared in executable form was "unjustifiable." Anthropic's position is weaker: it distributed the actual source, not just decompilable executables.

The same pattern appears in CSS, Inc. v. Herrington, 306 F. Supp. 3d 857 (S.D.W. Va. 2018), where the court found that source code was not a trade secret because the company "did not encrypt or password protect the source code, nor did it label the source code as confidential" and "did not mandate any confidentiality requirements when it provided its clients with the source code." The court concluded: "placing the source code on the county servers without any requirement that it be kept confidential cannot be considered reasonable efforts at maintaining secrecy." Swap "county servers" for "npm registry" and the facts are functionally identical.

The repeat failure is the nail in the coffin. A substantially identical source map exposure occurred in early 2025. Anthropic had actual notice that its build pipeline could leak source maps to the public npm registry. It patched the issue. Then the same class of failure happened again. Courts evaluating "reasonable measures" look at the totality of the protection program, and a repeat identical failure after actual notice is among the worst facts a trade secret holder can present. The Economic Espionage Act's legislative history emphasizes that "the owner of the information must have taken objectively reasonable and active measures to protect the information from becoming known to unauthorized persons."

The "obscure publication" defense fails on the facts. The Netcom court held that "posting works to the Internet makes them 'generally known' to the relevant people," the potential "competitors," where millions could access the postings. Religious Technology Center v. Netcom On-Line Communication Services, Inc., 923 F. Supp. 1231 (N.D. Cal. 1995). This was not a transient blog post viewed by twelve people. The original X post accumulated millions of views. Major technology outlets covered the story within hours. The code was mirrored across multiple public repositories. The relevant competitors (Google, OpenAI, Cursor, every AI coding tool developer in the market) are precisely the people most likely to have seen it.

The same court noted that while it was "troubled by the notion that any Internet user... can destroy valuable intellectual property rights by posting them over the Internet," the open nature of the internet cuts both ways. Religious Technology Center v. Netcom On-Line Communication Services, Inc., 923 F. Supp. 1231 (N.D. Cal. 1995). Here, the complication is that it was Anthropic itself, not a third-party bad actor, that placed the code in the public domain.

And downstream users face no trade secret liability. The E.D. Virginia court held in Religious Technology Center v. Lerma, 908 F. Supp. 1362 (E.D. Va. 1995) that "the party who merely downloads Internet information cannot be liable for misappropriation because there is no misconduct involved in interacting with the Internet." The court further held that "[o]nce a trade secret is posted on the Internet, it is effectively part of the public domain, impossible to retrieve." Anyone who downloaded the Claude Code package through npm's standard interface committed no misconduct.

The Supreme Court confirmed this principle four decades ago in Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470 (1974): trade secret law "does not offer protection against discovery by fair and honest means, such as accidental disclosure or by so-called reverse engineering." Accessing a file that was published to a public registry by the trade secret holder itself is, by definition, discovery through the holder's own accidental disclosure.

The Competitor Question

Every IP lawyer reading this is asking the same question: what can Google, OpenAI, Cursor, and every other AI coding tool developer legally do with this information?

Two scenarios. Two very different legal outcomes.

Direct code copying is clear copyright infringement and potentially trade secret misappropriation (to the extent any trade secret status survives). If Google's Codex team or OpenAI's engineering org were caught incorporating Anthropic's leaked code verbatim, the litigation would be massive and Anthropic would have strong claims. But proving direct copying requires forensic analysis of the competitor's codebase, which requires discovery, which requires litigation. Given that many of the architectural patterns in Claude Code (tool-calling, multi-agent orchestration, permission gates) are becoming industry-standard, proving copying over independent development will be extremely difficult.

Architectural inspiration without code copying is a fundamentally different situation. A competitor reads the leaked code, understands the design patterns, writes their own implementation from scratch. Under § 102(b), ideas and methods of operation are not copyrightable. Under Kewanee, independent development is a defense to trade secret misappropriation. Under Sega v. Accolade, extracting functional elements from copyrighted software is fair use. This scenario is legally permissible and practically inevitable.

The established playbook is the clean room defense, which has been standard practice since Sega v. Accolade (1992) and Sony v. Connectix (2000). One team reads and documents the concepts. A separate team that never saw the original code implements based on the documented concepts. If competitors are smart (and they are), they are already doing this.

The competitive intelligence dimension may matter more than the code itself. The leaked source revealed internal model performance benchmarks, a 29-30% false claims rate in the latest Capybara variant, which is an actual regression from earlier versions. It revealed the full product roadmap, the feature pipeline, and architectural decisions that took Anthropic years of R&D to develop. You can rewrite code. You cannot un-reveal that your frontier model has a 30% false claims rate. Competitors can now calibrate their own products against Anthropic's internal benchmarks with precision that would have previously required industrial espionage.

There is also the self-hosting question. The leaked code is the CLI client, not the model weights. Someone could theoretically take the orchestration logic, tool-calling system, system prompts, and memory architecture and wire them up to a different LLM backend. Doing this with Anthropic's actual code is copyright infringement. Rewriting the concepts from scratch in a different language, based on the now-public architectural knowledge, is the gray zone that copyright law struggles with under § 102(b). Cleanroom replicas are already being developed. The real moat was never the CLI code anyway. The model quality, API infrastructure, enterprise trust layer, and brand are the moat. The CLI is a sophisticated wrapper. A valuable one, certainly. But a wrapper.

How a Court Would Likely Rule

If Anthropic brought a motion for a preliminary injunction seeking to enjoin distribution and preserve trade secret status, here is the likely outcome:

Copyright injunction: Granted. Anthropic can force takedowns of verbatim mirrors and pursue infringement claims against anyone who copies or redistributes the source code in its original form. The copyright analysis is clean.

Broad trade secret injunction: Denied. The combination of unprotected publication to a public registry, a publicly accessible R2 bucket without authentication, a prior identical failure in early 2025 that put the company on actual notice, and the massive scale and speed of public dissemination forecloses a finding of reasonable measures or continuing secrecy for the broadly disseminated elements of the codebase.

Narrow trade secret claims: Possible, but Anthropic bears the burden. Specific, narrowly defined sub-components that were not individually parsed and disseminated may retain protection. But a blanket assertion over the entire codebase is insufficient given the scope of dissemination. A court would likely permit Anthropic to identify, under seal, specific code segments for which it claims continuing trade secret protection.

Downstream user liability: Denied. Individuals who downloaded the code from public sources committed no misconduct under Lerma. Downloading a published npm package is not an improper act.

What In-House Counsel Should Do Tomorrow

This incident is a case study in preventable IP destruction. If you are advising an AI company, here are the immediate takeaways.

Audit your build pipelines. Run npm pack --dry-run before every release. Source maps are source code. This is a build configuration problem, not a security architecture problem. That makes it both more embarrassing and more preventable.

Layer your IP protection. Trade secrets are fragile. Copyright is not. Don't rely on trade secret alone when copyright, patent (where applicable), and contractual protections (license terms, terms of service, access restrictions) should all be operating in parallel. A single build pipeline failure can vaporize your trade secret position overnight. Copyright survives.

Implement the Arkeyo checklist. For any proprietary software distributed over the internet, courts will measure your "reasonable measures" against a concrete set of industry-standard protections: encryption, access controls, password protection, code obfuscation, confidentiality labels, and terms of use restricting reverse engineering. If you are not checking every one of those boxes, you are building on a foundation that the first adverse ruling will collapse.

Assume your code will leak. Design your competitive moat around elements that survive disclosure: model quality, data assets, customer relationships, enterprise trust, speed of execution. If your moat depends on keeping your CLI source code secret, your moat is made of sand.

Document your security program. Courts evaluate "reasonable measures" based on the totality of the protection program. If you have a robust program and suffer a single accidental disclosure, your argument is stronger than if your program has gaps. Documentation is evidence. Absence of documentation is evidence too.

Respond immediately to disclosures. Speed of response matters for the "continuing intent to maintain secrecy" argument. Anthropic's rapid takedown strengthens its partial-survival argument for narrow sub-components of the codebase. Delay would have been fatal even to those narrow claims.

The Bigger Picture

There is no federal AI source code protection framework. There is no statute that addresses what happens when a $2.5 billion AI product accidentally publishes itself to a public package registry. This will be litigated under copyright law from 1976, trade secret doctrine rooted in a 1974 Supreme Court decision, and fair use principles from a 1993 Ninth Circuit case about Sega Genesis cartridges.

The courts are not inventing new rules for AI companies. They are applying the same framework they have always applied to software trade secrets. And that framework says: if you cannot keep it secret, you do not get to call it a secret.

AI companies building billion-dollar products on trade secret protection are betting on a legal regime that was designed for a different era. The UTSA was drafted in 1979 and amended in 1985. The key internet-disclosure cases are from the mid-1990s, when "posting to the Internet" meant a Usenet newsgroup, not npm. The doctrinal framework is sound. But the threat surface has changed by orders of magnitude. A single misconfigured .npmignore can do in seconds what industrial espionage used to take months to accomplish.

The fundamental asymmetry is this: copyright survives any disclosure. Trade secrets do not. For AI companies, that means the real legal moat is copyright (protecting expression) and the real competitive moat is the model itself (which was not leaked). The CLI architecture, however valuable, was always one misconfigured build pipeline away from becoming public knowledge.

And now it is.

The algorithm has a lawyer now. The lawyer's first advice is to check your .npmignore.

Gleb Alikhver is a J.D. candidate at the University of Georgia School of Law and co-founder of CTRL Lab (Center for Technology, Regulation, and Law), covering AI litigation, enforcement actions, and tech policy. CTRL Lab publishes weekly analysis at the intersection of AI technology and the law.