Live data from Hacker News

Claude Code's source code has been leaked via a map file in their NPM registry

twitter.com

491–500 of 1001 posts

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#491
I think this is ultimately caused by a Bun bug which I reported, which means source maps are exposed in production: https://github.com/oven-sh/bun/issues/28001

Claude code uses (and Anthropic owns) Bun, so my guess is they're doing a production build, expecting it not to output source maps, but it is.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#492

Earlier quoted context omitted.

You're perfectly free to scrape the web yourself and train your own model. You're not free to let Anthropic do that work for you, because they don't want you to, because it cost them a lot of time and money and secret sauce presumably filtering it for quality and other stuff. Stole? Courts have ruled it's transformative, and it very obviously is. AI doomerism is exhausting, and I don't even use AI that much, it's jus…

"...free to scrape the web yourself and train your own model." Yes, rich and poor are equally forbidden from sleeping under bridges.

Meaning what? The poor gets to sleep in the guest room of the rich guy's house because muh inequality?

Anthropic paid a lot of money for a moat and want to guard it. It is not wrong, in any sense of the word, for them to do so.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#493
post #84

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): https://github.com/chatgptprojects/claude-code/blob/642c7f94... I guess these words are to be avoided...

An LLM company using regexes for sentiment analysis? That's like a truck company using horses to transport parts. Weird choice.

> That's like a truck company using horses to transport parts. Weird choice.

Easy way to claim more “horse power.”

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#494
post #283
post #177

Earlier quoted context omitted.

This is my pet peeve with LLMs, they almost always fails to write like a normal human would. Mentioning logs, or other meta-things which is not at all interesting.

I had a problem to fix and one not only mentioned these "logs", but went on about things like "config", "tests", and a bunch of other unimportant nonsense words. It even went on to point me towards the "manual". Totally robotic monstrosity.

lol?

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#495
Is it not already a node app? So the only novel thing here is we know the original var names and structure? Sure, sometimes obfuscated code can be difficult to intuit, but any enterprising party could eventually do it -- especially with the help of an LLM.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#496
post #302

Earlier quoted context omitted.

They stole everything and now they want to close the gates behind them. "I got the loot, Steve!" I feel like the distillation stuff will end up in court if they try to sue an American company about it. We'll see what a judge says.

You're perfectly free to scrape the web yourself and train your own model. You're not free to let Anthropic do that work for you, because they don't want you to, because it cost them a lot of time and money and secret sauce presumably filtering it for quality and other stuff. Stole? Courts have ruled it's transformative, and it very obviously is. AI doomerism is exhausting, and I don't even use AI that much, it's jus…

> You're perfectly free to scrape the web yourself and train your own model.

Actually, not anymore as a result of OpenAI and Anthropic's scraping. For example, Reddit came down hard on access to their APIs as a response to ChatGPT's release and the news that LLMs were built atop of scraping the open web. Most of the web today is not as open as before as a result of scraping for LLM data. So, no, no one is perfectly free to scrape the web anymore because open access is dying.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#497

Undercover mode also pretends to be human, which I'm less ok with: https://github.com/chatgptprojects/claude-code/blob/642c7f94...

1) This seems to be for strictly Antrophic interal tooling 2) It does not "pretend to be human" it is instructed to "Write commit messages as a human developer would — describe only what the code change does." Since when "describe only what the code change does" is pretending to be human? You guys are just mining for things to moan about at this point.

1) It's not clear to me that this is only for internal tooling, as opposed to publishing commits on public GitHub repos. 2) Yes, it does explicitly say to pretend to be a human. From the link on my post:

> NEVER include in commit messages or PR descriptions:

> [...]

> - The phrase "Claude Code" or any mention that you are an AI

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#498
post #261

Earlier quoted context omitted.

No real reason to do that, they say Claude Code is written by Claude, which means it has no copyright. Just use the code directly

What about trade secrets, breach of contract, etc, etc?

Apparently it's possible to download a whole load of books illegally, but still train AI models on them without those getting pulled after you get found out.

The same reasoning may apply here :P

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#499

Really surprising how many people are downplaying this leak! "Google and OpenAi have already open sourced their Agents, so this leak isn't that relevant " What Google and OpenAi have open sourced is their Agents SDK, a toolkit, not the secret sauce of how their flagship agents are wired under the hood! expect the takedown hammer on the tweet, the R2 link, and any public repos soon

Yeah, this is the LLaMa leak moment for agentic app dev, IMO. Huge deal. Big win for Opencode and the like.

Re: Claude Code's source code has been leaked via a map file in their NPM registry

#500
post #290
post #69

ANTI_DISTILLATION_CC This is Anthropic's anti-distillation defence baked into Claude Code. When enabled, it injects anti_distillation: ['fake_tools'] into every API request, which causes the server to silently slip decoy tool definitions into the model's system prompt. The goal: if someone is scraping Claude Code's API traffic to train a competing model, the poisoned training data makes that distillation attempt less…

Paranoia. And also ironic considering their base LLM is a distillation of the web and books etc etc.

It's not really paranoia if it's happening a lot. They wrote a blog post calling several major Chinese AI companies out for distillation.[0] Perhaps it is ironic, but it's within their rights to protect their business, like how they prohibit using Claude Code to make your own Claude Code.[1]

[0]: https://www.anthropic.com/news/detecting-and-preventing-dist... [1]: https://news.ycombinator.com/item?id=46578701

Post reply on HN