Half a million leaked lines preview Claude Code's next leap.
The March 2026 leak reveals always-on agents and hidden platform modes.
A Claude Code leak via an npm source map exposed source code and hints of unannounced capabilities such as KAIROS.
Weekly context
Anthropic attributed the incident to a human packaging error. The community debates always-on agents with an interruption budget.
What changed
- Attack surface: build artifacts published without review.
- Proactive AI: modes that observe the environment and act without an explicit prompt.
- Transparency: tension between innovation and accidental exposure.
Impact for development teams
Teams should treat AI tool releases as critical software: SBOM, secret scanning, double-check on packages.
Practical recommendations
- Block automatic publish without source map scanning.
- Separate public and internal builds with distinct pipelines.
- Define an internal responsible disclosure policy.
- Assess risk of proactive agents on workstations.
What to watch next
- Anthropic response and release pipeline hardening.
- Regulation of autonomous software on endpoints.
- User expectations for local privacy.
Conclusion: Key lesson: launch speed without packaging discipline carries reputational and security cost.