Original Title: What to Prepare for Based on the Claude Code Leak
Original Author: Elliot Arledge
Translation: Peggy, BlockBeats
Editor's Note: In the early hours of March 31, Chaofan Shou from Solayer Labs discovered that Anthropic's Claude Code accidentally included the complete source code when published on npm. Within hours, the relevant code was synchronized to GitHub, rapidly attracting attention.
A slip in build configuration allowed the outside world to rarely observe the true progress of its product from the code level. This article is based on this "unexpectedly public" source code, where the author, after going through the source code, attempts to answer two questions: Where is Claude Code headed? And what does this mean for users?
From the code, it appears that Claude Code is introducing a series of yet-to-be-public capabilities, including a continuously operational autonomous mode (KAIROS), a PROACTIVE mode that can autonomously execute tasks during user gaps, and a COORDINATOR mechanism for scheduling multiple sub-agents. These changes all point to a clear direction: AI is transforming from a tool that responds to commands into a system that can continuously operate and actively execute. Meanwhile, design elements such as permission automation, stealth collaboration, and team memory also reflect a real issue: when AI truly enters workflows, how to control risks and boundaries while enhancing efficiency.
So, what does this mean for users?
In fact, these capabilities are not merely stacked together, but are gradually constructing an "agent system": capable of running in the background, having cross-task memory, parallel agent collaboration, and able to directly call tools to complete tasks. Future competition may no longer be just about model capabilities, but about who can make this system more stable and controllable.
The "unexpected disclosure" itself is not important; what matters is the direction it reveals in advance.
Here is the original text:
Earlier today, @Fried_rice on X discovered that Anthropic accidentally included a source map file when publishing the Claude Code CLI to npm.
Specifically, version 2.1.88 of the package @anthropic-ai/claude-code contains a 59.8MB file cli.js.map, which embeds the complete original TypeScript source code in the sourcesContent field. This was not a hacking attack, but a slip in build configuration—debugging artifacts were packaged along with the production environment. However, this inadvertently exposed the future direction of Claude Code.
I spent several hours going through this source code. Here are some key points I noticed, along with what they might mean for users.
Key Features
Automated agents are on the way
The most frequently appearing feature flag in the codebase is called KAIROS (appearing 154 times). From the code, it seems to be an "autonomous daemon mode" that can turn Claude Code into a continuously running agent. It includes background sessions, a memory integration mechanism called "dream," GitHub webhook subscriptions, push notifications, and channel-based communication methods.
There's also a PROACTIVE mode (appearing 37 times), which allows Claude to work independently between user messages. The system sends "tick" prompts to maintain the agent's operation, and Claude decides what to do each time it "wakes up." The prompts even explicitly state: "You are running autonomously," instructing the model to "look for useful work" and "act based on best judgment rather than requesting confirmation."
COORDINATOR_MODE (appearing 32 times) takes it further—it turns Claude into a scheduler (orchestrator) that can generate and manage multiple parallel worker agents. This coordinator is responsible for completing research by assigning tasks to different workers. The system prompts also include detailed instructions on how to write prompts for workers, when to continue using existing workers, when to generate new agents, and how to handle worker failures.
Permission prompts may disappear
There is a flag named TRANSCRIPT_CLASSIFIER (appearing 107 times). From the context, it seems like an "automatic mode" that automatically approves tool permissions through an AI classifier. If this feature goes live, the frequently interruptive permission confirmation prompts may become optional or even completely disappear in trusted operations.
Model codenames and versioning system
The source code also reveals some internal codenames for the Claude model:
Capybara seems to be a variant of Claude 4.6. Comments mention "Capybara v8" and note some bug fixes, such as a false statement rate of 29-30% (compared to 16.7% for v4), a tendency to over-comment code, and a mechanism called "assertiveness counterweight."
Fennec was once a codename but was later migrated to Opus 4.6.
Numbat has not yet been released. There’s a comment saying, "Remove this section when releasing numbat."
The code also mentions opus-4-7 and sonnet-4-8, explicitly stating that these version numbers should not appear in public submissions—this implies these versions already exist internally.
"Stealth Mode": Anonymous Participation in Open Source
There is also a feature called "Undercover Mode," specifically for Anthropic employees to use Claude Code to submit code to public repositories. This mode removes all AI-related identifiers, including:
· No AI attribution in commits
· Hides model codenames
· Removes all mentions of "Claude Code" or AI
· Doesn't even disclose the model's own name
The prompt clearly states: "You are running in UNDERCOVER mode in a public/open-source repository. Your commit messages, PR titles, and content must not contain any internal Anthropic information. Do not expose your identity."
Moreover, there is no mandatory off switch—if the system cannot confirm that it is in an internal repository, this mode will be activated by default.
Voice Mode
VOICE_MODE appeared 46 times, indicating that the system has integrated voice interaction capabilities, including speech-to-text and text-to-speech.
A "Digital Pet" System
This is somewhat interesting. The code includes a hidden BUDDY system, essentially a "digital pet" in the terminal (similar to Tamagotchi). It includes:
· 18 species (duck, goose, cat, dragon, octopus, owl, penguin, turtle, ghost, hexagon dinosaur, etc.)
· A rarity system (legendary level probability 1%)
· Appearance decorations (crowns, top hats, halos, wizard hats, etc.)
· Attribute values (DEBUGGING, PATIENCE, CHAOS, WISDOM, SNARK)
· Even "shiny" versions
Among them, the species name capybara is obfuscated using String.fromCharCode() to avoid triggering internal leak detection systems—which also indirectly indicates that the codename is sensitive.
Other Noteworthy Features
FORK_SUBAGENT: Allows itself to fork into multiple parallel agents
VERIFICATION_AGENT: For independent, adversarial verification of results
ULTRAPLAN: Advanced planning capabilities
WEB_BROWSER_TOOL: Browser automation
TOKEN_BUDGET: Allows explicit token budgeting (e.g., "+500k" or "spend 2M tokens")
TEAMMEM: Supports shared memory between teams
What This Means
Several core judgments:
Claude Code is significantly moving towards "high autonomy." Features like KAIROS, PROACTIVE, and COORDINATOR point towards a future where Claude can operate as a background daemon, continuously monitoring repositories and actively executing tasks.
Permission friction is being reduced. The automatic approval mechanism indicates that they are minimizing frequent manual confirmation steps.
The model versioning system is far more complex than the public API. Multiple variants, rapid modes, and codename systems exist internally, corresponding to different capabilities and issues.
Security mechanisms are highly prioritized. The Bash command validation alone includes over 2,500 lines of code, along with sandboxing, stealth mode, and input cleansing.
The product is introducing "personality." The Buddy system means that Claude Code is not just a tool, but is attempting to become a "partner."
How to View It Yourself
As of the writing of this piece, this source code is still available on npm. Download @anthropic-ai/claude-code@2.1.88, find cli.js.map, parse the JSON, and extract the sourcesContent field. I will not redistribute the code, but it is reasonable to analyze and discuss publicly accessible content.
The initial discovery is credited to @Fried_rice on X.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
