A missing .npmignore entry. That is what separated Anthropic's most closely guarded product secrets from every developer with an npm install command. On March 31, 2026, Claude Code v2.1.88 went to the npm registry carrying a 59.8 MB source map that reconstructed 512,000 lines of unobfuscated TypeScript across roughly 1,900 files. Within hours the code was mirrored, forked, and dissected worldwide, and a clean-room rewrite became one of the fastest-growing repositories GitHub has ever seen. I write this as someone whose daily work runs through Claude Code, with my own .claude configs, hooks, and multi-agent setups on the line, so my read of the leak is not gossip. It is a practitioner asking: what does the code Anthropic did not intend to show us mean for how I should work this year? Quite a lot, it turns out.
How half a million lines walked out the front door
The mechanics deserve attention because they indict process, not philosophy. Claude Code builds with Bun, the JavaScript runtime whose parent company Anthropic acquired in late 2025, and Bun generates source maps by default: detailed files mapping compiled output back to original source, variable names, internal comments, and unreleased feature flags intact. The fix was one line in .npmignore (*.map) or a files whitelist in package.json. Fifteen seconds of work. Neither happened, and for a roughly three-hour window that night, anyone updating Claude Code pulled the entire codebase. Anthropic yanked the package and confirmed the leak's authenticity; by then the source was everywhere, and reports circulated of a trojanized copy riding the chaos, which is its own lesson about downloading "mirrors" during a breach.
The uncomfortable context: this was Anthropic's second lapse in a single week, days after a misconfigured CMS leaked a draft post about an unreleased model called Mythos. The company that made safety its identity was undone by an ignore file and a CMS setting. The instructive part is not the irony. It is that infrastructure security is checklists, not philosophy, and even the best teams miss checklists. If Anthropic can, so can you, which is why my own security scanning now runs as an agent instead of a good intention.
What the teardowns found
I spent five days reading every credible teardown and cross-referencing against Anthropic's confirmed statements. Three findings matter beyond curiosity.
The roadmap in the version strings. Teardowns reported internal code names for the model tiers and, more concretely, version validation logic referencing then-unannounced Opus 4.7 and Sonnet 4.8 builds. Prediction markets priced Opus 4.7 shipping by mid-year at roughly 59 percent at the time. That aged well: the next Opus generation arrived within weeks of the leak, and the cadence has continued since, which is why I keep my model references behind aliases rather than hard-coding dated model strings. If you build on the API, that is the single most practical takeaway. Hard-coding claude-opus-4-6-20260205 into production integration code is a bug with a delivery date. (For where the lineup actually landed, my Opus 5 benchmarks breakdown picks up the story.)
Mythos and the tier above Opus. The leaked draft post and follow-up reporting described Mythos as a step change: larger and more capable than Opus, under a new top tier, with reported benchmark jumps far bigger than the sub-point gaps separating the public frontier models, and access restricted to a small set of cyber-defense clients. The stated reason, per that reporting, was that its vulnerability-discovery abilities outpaced human patching speed. I cannot independently verify internal benchmarks, and neither can anyone else outside Anthropic. What is verifiable is the decision: a for-profit lab withheld its most capable product on safety grounds. Whatever you think of Anthropic's judgment, capabilities like that proliferate eventually, from them or from a lab with fewer scruples. The window for quietly fixing your sloppy security debt is closing. Run npm audit. Update dependencies. Put automated scanning in CI. These stopped being optional.
KAIROS and Autodream, the features that actually change my week. More interesting to me than any benchmark were two unreleased systems the teardowns described in implementation-level detail.
KAIROS: the agent that keeps working when you leave
KAIROS, per the leaked architecture, is a daemon mode where Claude Code runs as a persistent background agent on a tick-based heartbeat. Each tick it evaluates whether action is warranted, with a deliberately tight proactive-action budget of about fifteen seconds: enough to run a test or check a CI pipeline, not enough to rewrite your codebase while you get coffee. When you switch away or go idle, it shifts to autonomous mode; when you return, it goes collaborative, surfacing what it did and waiting for direction. The code referenced daemon-only tools like push notifications and PR subscriptions.
The concrete picture: you push a branch and close the laptop for lunch. The daemon notices CI failed, reads the logs, determines the flaky test predates your change, opens a fix PR, and pings you: CI passing, want me to merge? That is not my fantasy; it is what the described architecture supports. If you have followed my writing on agent swarm architecture in Claude Code, KAIROS is that pattern's natural next step: the swarm coordinated agents on tasks you assigned, and the daemon keeps them working when you are not watching.
My practitioner advice does not wait for the feature. Inventory which parts of your workflow tolerate a background agent today (CI monitoring, review triage, dependency analysis) and start running them as scheduled agent tasks now. When the official daemon ships, you will have the judgment for what to delegate, which is the hard part anyway.
Autodream: teaching the agent to sleep
Anyone who runs long agent sessions knows context entropy: by hour two the agent forgets early decisions, contradicts itself, and compaction loses the nuance that mattered. Autodream, as described in the leak, attacks that root cause. During idle time it spawns a forked sub-agent that consolidates memory the way sleep consolidates human memory: merging repeated observations into single confident facts, resolving contradictions ("REST for public APIs, GraphQL for internal services" instead of two conflicting notes), and promoting hedged guesses to confirmed facts or discarding them.
The architecturally elegant detail: the dream agent gets read-only bash access, with write access limited exclusively to memory files. It can study your code but never touch it. Of everything in the leak, this is the piece I most want shipped, because context entropy is the tax I pay every single day. And again, you do not have to wait: deliberate CLAUDE.md files, memory banks, and session summaries are the manual version of the same principle, and I mapped that whole discipline in six levels of Claude Code memory systems. Build the foundation now; the automated version will sit on top of it.
The reading that matters: the system is the product
Step back from the individual features and the leak makes one argument loudly. The public conversation obsesses over which model scores highest on which benchmark, where the frontier models sit within a point of each other. Meanwhile, the code Anthropic was not ready to show is almost entirely about the system around the model: the autonomous loop, the memory maintenance, the notification plumbing, the mode switching. The model is a component. The system is the product, and based on those 512,000 lines, Anthropic is further along on the system than I had assumed.
That reframe also settles the "which model wins" question the practical way: composition. The daemon architecture itself implies dispatching different tiers for different background tasks, a cheap model for lint checks, a mid model for test analysis, a frontier model for architectural review. The skill worth building in 2026 is not picking a winner. It is orchestrating specialists.
What I actually changed after five days in this story
- Model abstraction everywhere. Aliases and config-driven model selection in every integration, no dated model strings in code.
- Security posture moved up the queue. Automated dependency scanning in CI across my projects, not because Mythos is coming for me, but because the class of capability it represents will not stay in a vault forever.
- Background-agent experiments started early. Scheduled agent runs for CI watching and review triage, so the delegation judgment exists before the official daemon does.
- Memory discipline formalized. Structured CLAUDE.md and session-summary conventions, treating agent memory as an artifact I curate rather than an accident I suffer.
Reader questions
What exactly leaked?
The complete Claude Code source: 512,000 lines of TypeScript reconstructed from a source map accidentally shipped in the npm package on March 31, 2026. It exposed the system prompt, tool definitions, the agentic loop, memory handling, and references to unreleased features and model versions. No model weights were involved.
What is Claude Mythos?
Per the leaked draft post and subsequent reporting, an unreleased model tier above Opus with a step-change capability jump, restricted to select cyber-defense clients because of its vulnerability-discovery abilities. Anthropic has published no public benchmarks or release date, so treat all specifics as reported leak content, not confirmed specification.
Were KAIROS and Autodream real features or speculation?
They appeared in the leaked code as implemented architecture (heartbeat logic, tool permissions, the read-only dream sub-agent), not as concept documents. Whether and in what form they ship as products remains Anthropic's call; what the leak proves is that the engineering exists.
The .npmignore mistake cost Anthropic its surprise, and it handed the rest of us a map: toward agents that anticipate, act, and consolidate what they learned while we were not looking. The honest question is whether your workflow is being built toward that or will be scrambling to catch up. The background-agent and memory patterns this leak previews are buildable today — I run working versions of both in production, and they are published in my agent skills marketplace.
