The Code That Broke Its Own Argument

The answer, drawn from federal case law, Copyright Office guidance, and trade secret doctrine, reveals a structural contradiction at the heart of the AI coding economy. Companies are racing to lock down codebases that power tools designed to make code disposable.

On March 31, 2026, version 2.1.88 of Anthropic's @anthropic-ai/claude-code npm package shipped with a 59.8 MB JavaScript source map file that contained the full, unobfuscated TypeScript codebase: approximately 1,900 proprietary files and 512,000 lines of code. Security researcher Chaofan Shou — a UC Berkeley PhD student, FuzzLand co-founder, and veteran bug bounty hunter with roughly $1.9 million in reported bounties — spotted the file and posted a direct download link on X at approximately 4:23 AM ET. His post accumulated between 10 and 16 million views and over 1,500 comments.

The exposure was not a security breach in the traditional sense. The source map's sourcesContent field pointed to a zip archive hosted on Anthropic's own Cloudflare R2 storage bucket, publicly downloadable without authentication. This was, critically, the third time Anthropic had shipped source maps in npm packages — similar exposures occurred in February 2025 and earlier that year. The recurrence suggests a systemic build-pipeline failure rather than an isolated human error, a distinction that carries significant weight under trade secret law.

Three features drew intense public scrutiny. "Undercover Mode" instructs Claude to strip all AI attribution from git commits when operating in external repositories — the system prompt explicitly directs: "NEVER include in commit messages or PR descriptions: The phrase 'Claude Code' or any mention that you are an AI." An anti-distillation mechanism injects decoy tool definitions into API requests to poison the training data of anyone recording Claude Code API traffic. And a client attestation system embedded in Bun's native Zig HTTP layer computes a cryptographic hash to verify requests originate from a genuine Claude Code binary.

Anthropic responded within hours, pulling the package, issuing DMCA takedowns on GitHub, and releasing a statement characterizing the event as "a release packaging issue caused by human error, not a security breach." No customer data or model weights were exposed.

The clean-room reimplementation emerged almost immediately. Sigrid Jin (@instructkr), a Korean developer previously profiled by the Wall Street Journal for consuming 25 billion Claude Code tokens in a year, rewrote the core logic in Python from scratch before dawn. The project, claw-code, became the fastest repository in GitHub history to surpass 50,000 stars. A separate Rust reimplementation by Kuberwastaken used AI agents to generate behavioral specifications from the source, then had separate AI agents implement from those specifications alone — never referencing the original TypeScript.

Anthropic's Claude Code generates an estimated $2.5 billion in annualized revenue against the company's roughly $19 billion total ARR, with approximately 80% of Claude Code revenue coming from enterprise customers. The company was reportedly preparing to go public.

United States copyright law has protected software since the 1980 amendments to the Copyright Act, which codified the CONTU Commission's recommendation that computer programs constitute "literary works" under 17 U.S.C. § 102(a). Source code qualifies for protection the moment it is fixed in a tangible medium, requiring only a "modicum of creativity" under Feist Publications v. Rural Telephone Service, 499 U.S. 340 (1991). But the scope of that protection has been progressively narrowed, and the elements most commercially valuable in a codebase like Claude Code's are precisely the elements least likely to survive judicial scrutiny.

The dominant analytical framework is the Abstraction-Filtration-Comparison (AFC) test from Computer Associates International v. Altai, 982 F.2d 693 (2d Cir. 1992). Courts break allegedly infringed programs into structural layers, then filter out everything unprotectable: elements dictated by efficiency (the merger doctrine), elements dictated by external factors like hardware standards or industry practices (scènes à faire), and elements already in the public domain. Only the remaining "kernel" of creative expression is compared for substantial similarity.

For Claude Code specifically, the AFC test would filter aggressively. The tool architecture — discrete permission-gated tools for file operations, bash execution, web fetch, and LSP integration — reflects standard patterns in CLI agent design. Feature flags, OAuth flows, and telemetry configurations are functional necessities dictated by industry practice. What survives filtration as protectable expression would likely be limited to specific implementation choices, creative variable naming, original comments, and novel architectural arrangements where alternatives existed.

The Supreme Court's 2021 decision in Google LLC v. Oracle America, 593 U.S. 1, reinforced these limits. In a 6-2 ruling, the Court held that Google's reimplementation of 11,500 lines of Java API declaring code constituted fair use, emphasizing that the APIs were "inextricably bound" with uncopyrightable functional elements and that allowing Oracle's copyright to control reimplementation would "lock" developers into a single platform.

The most legally consequential tension in the AI coding industry is what practitioners have begun calling the "no-code paradox": if a company markets its AI tool as writing code autonomously, it simultaneously undermines copyright protection for any code that tool helped create — potentially including the company's own proprietary codebase. The paradox means companies get "all the liability and none of the protection."

The foundation is the human authorship requirement, now settled law. On March 2, 2026 — less than a month before the Claude Code leak — the Supreme Court denied certiorari in Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), leaving intact the D.C. Circuit's unanimous holding that "the Copyright Act of 1976 requires all eligible work to be authored in the first instance by a human being." The Copyright Office's January 2025 Part 2 Report reinforced that "prompts alone do not provide sufficient human control to make users of an AI system the authors of the output."

Major tech executives have been remarkably candid. Microsoft CEO Satya Nadella estimated 30% of Microsoft's production code is now AI-generated. Meta CEO Mark Zuckerberg projected nearly half of Meta's codebase would be AI-generated by 2025. Google's chief scientist Jeff Dean anticipated "virtual engineers" capable of end-to-end software development with minimal oversight. Each of these statements is a future litigation exhibit.

The legal status of AI-generated code occupies a narrow but devastating gap: it likely cannot be copyrighted by the company that ships it, but it might infringe someone else's copyright. The liability is asymmetric and growing.

The Copyright Office's framework creates a spectrum. At one end, code where a human developer "determines the expressive elements" — writing core logic, specifying algorithmic approaches, editing and restructuring AI output — remains copyrightable. At the other end, code generated from a simple natural-language prompt and accepted verbatim is almost certainly uncopyrightable after Thaler. The contested middle ground — iterative prompting, selection among outputs, and substantial modification — remains unsettled.

The practical impact is that AI tool providers' contractual assignment of output ownership may be legally meaningless. Anthropic's commercial terms state that customers "own all Outputs" and assign "right, title and interest (if any) in and to Outputs." The parenthetical "(if any)" is doing enormous legal work. Companies are increasingly layering trade secret protection as a fallback — trade secrets do not require human authorship, only that information derives economic value from not being generally known and is subject to reasonable efforts to maintain secrecy. But this fallback depends entirely on keeping code confidential, which brings us back to the leak.

The Claude Code source leak presents a near-textbook case for analyzing trade secret destruction through inadvertent disclosure. Under both the federal Defend Trade Secrets Act (18 U.S.C. § 1836) and the Uniform Trade Secrets Act adopted by 48 states, trade secret protection requires that the owner take "reasonable measures" to maintain secrecy and that the information "derives independent economic value from not being generally known." Both prongs are severely compromised.

The "generally known" analysis is even more damaging. npm's own official guidance states unambiguously: "if you publish sensitive information to the public npm registry, that information is irreversibly public." The registry replicates to several thousand mirrors within two to three seconds of publication. The code reached 50,000+ GitHub stars and 41,500+ forks within hours. Detailed technical analyses were published across Hacker News, DEV Community, VentureBeat, Bloomberg, Fortune, CNBC, Axios, and dozens of other outlets.

The rapid emergence of clean-room reimplementations rests on decades of favorable precedent. In Sega Enterprises Ltd. v. Accolade, Inc., 977 F.2d 1510 (9th Cir. 1992), the Ninth Circuit validated the two-team model: a dedicated analysis team disassembles code and creates a specification of functional behavior; a separate programming team writes original code from that specification alone.

Sony Computer Entertainment v. Connectix Corp., 203 F.3d 596 (9th Cir. 2000), expanded this further. Connectix's engineers directly and repeatedly disassembled Sony's PlayStation BIOS during development, failing to maintain strict clean-room separation. The Ninth Circuit held this was still fair use because the final product contained none of Sony's copyrighted material. Clean-room isolation, while best practice, is not legally required — what matters is the end result.

The Kuberwastaken Rust reimplementation used a novel approach: one AI agent analyzed the leaked source and produced behavioral specifications, and a completely separate AI agent implemented from those specifications without ever referencing the original TypeScript. This AI-mediated clean-room approach has no direct precedent but may actually provide stronger isolation guarantees than human clean rooms, since the implementation agent can be provably prevented from accessing the original source.

One unsettled question: under Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470 (1974), "accidental disclosure" is a "fair and honest means" of acquiring trade secrets. If trade secret status is already lost through widespread publication, anyone who obtained the code from the public npm registry obtained it through a lawful channel.

The npm package ecosystem presents a unique legal environment that amplifies the consequences of accidental disclosure. npm's architecture replicates published packages to several thousand mirrors within seconds. Even after a package is "unpublished," the version remains cached in lockfiles, CI/CD systems, and independent mirrors worldwide — Tencent's Verdaccio instance, for example, retains all versions for years regardless of publisher actions.

For trade secret purposes, this architecture means that publication to npm constitutes effectively irrevocable public disclosure. For copyright purposes, however, npm publication does not constitute a license grant or waiver. npm's Terms of Service explicitly state that "your Content belongs to you." Accidental inclusion of a source map does not create an open-source license, does not transfer copyright, and does not authorize redistribution. Anthropic's DMCA takedowns against repositories hosting verbatim copies of the leaked source are legally well-founded even though the trade secret claim is compromised.

The source map file format deserves particular attention. The sourcesContent field within a source map can contain complete, unobfuscated source code, making an included source map functionally equivalent to publishing the source itself. The known Bun bug reporting source maps served in production mode despite contrary documentation raises questions about whether Anthropic's reliance on its own acquired toolchain constituted "reasonable measures" under trade secret law.

No jurisdiction has enacted legislation specifically addressing copyright ownership of AI-generated source code, but the regulatory environment is tightening from multiple directions simultaneously.

The deepest tension exposed by the Claude Code leak is strategic, not legal. Anthropic is spending enormous resources protecting proprietary code that powers a tool whose explicit purpose is to make code creation trivial. If Claude Code succeeds in its mission — autonomous coding with minimal human involvement — then codebases become commodities: abundant, cheap, interchangeable. The AI coding tools market, valued at $4.86 billion in 2023, is projected to reach $26.03 billion by 2030. Job postings requiring AI coding tool experience increased 340% between January 2025 and January 2026.

Morningstar's analysis acknowledges that open-source software was supposed to kill proprietary software, yet Salesforce and ServiceNow ascended regardless — suggesting switching costs and distribution advantages matter more than code itself. But Morningstar has shortened moat duration time horizons from 20 to 10 years, signaling that even skeptics see the moat eroding. Open-source AI models now achieve approximately 90% of closed-model performance at release and close the remaining gap within three months. Inference costs are dropping roughly 10x annually.

The Claude Code leak is not merely an embarrassing security incident. It is a stress test of the entire legal framework governing software intellectual property, and the framework has failed in nearly every dimension. Copyright law cannot protect code whose authorship is ambiguous. Trade secret law cannot protect code published to a globally replicated registry. Clean-room reimplementation doctrine permits competitors to reproduce functionality from leaked source within hours. And the human authorship requirement — now definitively established by Thaler v. Perlmutter through the Supreme Court's denial of certiorari — means that the more successfully AI companies automate code creation, the less legal protection that code receives.