Anthropic Source Code Leak: Opus 4.7, Sonnet 4.8, and Undercover Mode Fully Exposed

Anthropic recently suffered a serious source code leak. A developer ran a simple command on the Claude Code NPM package, and the entire codebase was laid bare—unreleased model codenames, version numbers that don't yet exist, and a shocking "undercover mode" all came to light.

How the Leak Happened

Anthropic distributes Claude Code via an NPM package, which is standard practice. The problem was that during compilation, they accidentally included a Source Map file—essentially a debug file containing the original human-readable source code.

Technical Background on Source Maps: Source Maps are standard debugging tools in modern frontend/Node.js development workflows. Since JavaScript code typically undergoes minification, obfuscation, and bundling before release, the original code becomes nearly unreadable. Source Map files (usually with a .map extension) act as a "translation dictionary" between compiled code and the original source, allowing developers to see the original, human-readable code in their debuggers rather than garbled compressed output. The issue is that Source Map files are essentially complete copies of the original source code, just wrapped in JSON format. When one is accidentally bundled into a production NPM package, anyone can simply download the package and parse the .map file to reconstruct the complete original code logic—including comments, variable names, function names, and every internal detail the developers never intended to make public. This kind of mistake isn't uncommon in engineering practice, but for a top-tier AI company, the implications are particularly far-reaching.

Someone noticed the file, ran an ls command on it, and the entire codebase was fully exposed: plugins, internal tools, hooks, architecture—everything became completely readable. What's even more surprising is that this source map file had been sitting quietly in the NPM registry for roughly three months since Claude Code's release, and nobody had noticed.

When developers in the AI community started digging deeper, they uncovered a wealth of content that Anthropic clearly didn't want made public.

Undercover Mode: Claude Instructed to Hide Its AI Identity

The most jaw-dropping discovery in this leak was a function in the code called GetUndercoverInstruction. This function is activated when Claude Code operates in public open-source repositories, and its instructions are as follows:

• Write commit messages like a human developer
• Don't mention that you're an AI
• Don't mention Claude Code
• Don't include any internal model names
• Don't leave any co-authored-by lines that would reveal AI involvement

The code comments explicitly state "never reveal your identity." The list of things it's forbidden to mention is revealing in itself: internal model names like Capybara and Tango, unreleased version numbers like Opus 4.7 and Sonnet 4.8, as well as internal repository names, Slack channels, and internal tool references.

Ethical and Legal Context of AI Identity Disclosure: The issue revealed by the GetUndercoverInstruction function touches on a core ongoing debate in AI ethics: should AI systems be obligated to disclose their identity? Currently, multiple jurisdictions have begun legislating on this issue. The EU's AI Act explicitly requires AI-generated content to be labeled; several U.S. states are also advancing similar AI transparency bills. In the open-source software community, Git commit history is regarded as the project's "integrity record," documenting who made what changes and when. If an AI agent writes commit messages posing as a human, it not only obscures the true source of code contributions but could also cause serious misdirection during code audits, legal attribution (such as copyright disputes), and security tracing. Notably, platforms like GitHub have already begun discussing dedicated identifiers for AI-generated commits, and Anthropic's "undercover mode" clearly runs counter to this industry trend.

Anthropic has been using Claude to help build Claude, which isn't surprising—many companies do this. But having explicit "concealment instructions" built into the product is a different matter entirely. Especially when they're signing enterprise contracts and positioning Claude Code as a professional development tool.

To be fair, there are legitimate reasons for not wanting an AI agent to leave traces in public commit histories. But "undercover mode" and "never reveal your identity" are quite different from simply keeping things clean.