Anthropic's Triple Source Leak Creates a Legal Crisis on Eight Fronts

Within hours, the code had been mirrored across 84,000+ GitHub stars, rewritten in Python, and distributed to decentralized platforms beyond DMCA reach. The legal fallout touches nearly every major unresolved question in technology law — from whether AI-generated code is copyrightable at all, to whether Anthropic's internal benchmarks showing a 29–30% false claims regression create securities fraud exposure for a company valued at $380 billion.

The chain of responsibility points firmly to systemic organizational failure rather than individual negligence. Boris Cherny, head of Claude Code at Anthropic and author of O'Reilly's Programming TypeScript, posted publicly on X within hours: "Mistakes happen. As a team, the important thing is to recognize it's never an individual's fault — it's the process, the culture, or the infra." He attributed the leak to "a manual deploy step that should have been better automated" and explicitly stated it was "plain developer error, not a tooling bug."

The initial speculation that Bun runtime bug oven-sh/bun#28001 caused the leak was quickly debunked. The bug's original filer retracted the connection on Hacker News: "My apologies, this isn't the cause." Nonetheless, Anthropic's December 2025 acquisition of Oven (the Bun company) means it owns the entire toolchain — including Bun's default of generating source maps unless explicitly disabled.

The irony cuts deep: a company positioning itself as the "safety-first" AI lab, which built an "Undercover Mode" subsystem with the literal instruction "Do not blow your cover" to prevent internal information leaks, failed to implement basic .npmignore controls — three times.

An additional dimension: Cherny had publicly stated in December 2025 that "100% of my contributions to Claude Code were written by Claude Code," and approximately 90% of the codebase was reportedly AI-generated. The possibility that the build configuration oversight was itself a product of AI-assisted "vibe coding" adds a recursive layer to the responsibility question.

Under U.S. law, the individual engineer who misconfigured the build enjoys robust protections. Criminal exposure is effectively nil. The Economic Espionage Act (18 U.S.C. §§ 1831–1839) requires specific intent to convert trade secrets, knowledge they were proprietary, intent to injure the owner, and intent to benefit someone else. The Congressional Research Service has stated explicitly that the EEA's intent elements "would seem to ensure that a person will not be convicted of theft for the mere inadvertent or otherwise innocent acquisition of a trade secret."

Civil liability to the employer is similarly remote. Under respondeat superior, employers bear liability for employees' negligent acts within the scope of employment. California Labor Code § 2802 goes further, mandating that employers indemnify employees for losses incurred in the discharge of duties. Security trainer Tanya Janca called the mistake "an incredibly common mistake developers make quite often," supporting a defense based on industry practice.

npm's own advisory confirmed how common such accidents are: "We get this specific support issue once or twice a week." Once published, packages replicate to thousands of mirrors within seconds and become "irreversibly public."

The legal standard under both the Defend Trade Secrets Act (18 U.S.C. § 1839(3)) and the Uniform Trade Secrets Act requires that a trade secret owner take "reasonable measures" to maintain secrecy. Three identical failures in 13 months present a devastating challenge to this requirement.

The foundational principle from Defiance Button Machine Co. v. C&C Metal Products Corp., 759 F.2d 1053 (2d Cir. 1985), holds that "the owner is entitled to such protection only as long as he maintains the list in secrecy; upon disclosure, even if inadvertent or accidental, the information ceases to be a trade secret." The Gal-Or v. United States precedent (Ct. Fed. Claims, 2013) is directly applicable: the court dismissed trade secret claims where "instances in which Mr. Gal-Or took proactive steps to protect the confidentiality of his trade secrets are simply overwhelmed by the number of times he did not."

Sigrid Jin's claw-code repository — which hit 50,000 GitHub stars in approximately two hours, likely the fastest-growing repo in GitHub history — presents a legally novel challenge. Jin used OpenAI's Codex-based oh-my-codex tool to rewrite Claude Code's architecture from TypeScript to Python. The repository claims it is "a clean-room Python rewrite that captures the architectural patterns of Claude Code's agent harness without copying any proprietary source."

This claim fails the established clean-room standard on its own terms. Jin's README contains the critical admission: "I originally studied the exposed codebase to understand its harness, tool wiring, and agent workflow." Classic clean-room design, established by Compaq's 1982 reverse engineering of the IBM BIOS, requires strict separation: Team A examines the original and produces functional specifications; Team B, which has never seen the original, implements from the specification alone. Jin served as both teams simultaneously.

Under 17 U.S.C. § 101, a "derivative work" is defined as "a work based upon one or more preexisting works, such as a translation" — translation is literally the first example Congress listed. Converting code from TypeScript to Python is functionally a translation. The interposition of an AI tool does not break the chain of derivation.

However, the Computer Associates v. Altai abstraction-filtration-comparison test complicates a straightforward infringement finding. After filtering out elements dictated by efficiency, external factors, and public domain material, the protectable "kernel" may be narrower than it appears. Many architectural patterns in AI agent development — tool-calling, permission systems, multi-agent coordination — are becoming industry standard (scènes à faire).

The Supreme Court's denial of certiorari in Thaler v. Perlmutter on March 2, 2026 cemented the D.C. Circuit's 2025 ruling that human authorship is a "bedrock requirement of copyright" under 17 U.S.C. § 102(a). The Copyright Office's January 2025 report reinforced: "Prompts alone do not provide sufficient human control to make users of an AI system the authors of its output."

Applied to source code, these authorities create a direct problem for Anthropic. Boris Cherny stated that "100% of my contributions to Claude Code were written by Claude Code," and approximately 90% of the codebase was reportedly AI-generated. If these statements are accurate, significant portions of Claude Code may be uncopyrightable under current law.

The industry context amplifies this tension. Satya Nadella estimated 20–30% of Microsoft's code is AI-generated. Google CEO Sundar Pichai stated over 30% of Google's new code is AI-generated. Zuckerberg projected that "maybe half the development is going to be done by AI" within a year. As MBHB law firm warned: "When code is produced solely by an AI, companies cannot obtain copyright protection for that code." With trade secret protection now severely compromised, the remaining legal shield for AI-generated portions of Claude Code may be vanishingly thin.

Anthropic's DMCA notice, filed March 31, 2026, targeted the nirholas/claude-code repository and its entire fork network. Because the network exceeded 100 repositories and Anthropic claimed most forks infringed, GitHub disabled the entire network — over 8,100 repositories. Legitimate forks of Anthropic's own official public repository were incorrectly swept up.

Against decentralized infrastructure, DMCA proved toothless. The code was mirrored to IPFS, Gitlawb (a decentralized git platform whose operator posted "Will never be taken down"), and torrents. Once content enters the IPFS hash-addressed network, removal requires every node operator's voluntary cooperation — which is practically unachievable.

Between 00:21 and 03:29 UTC on March 31, 2026 — overlapping with the Claude Code leak window — North Korean threat actor UNC1069 published malicious versions of the axios npm package containing the WAVESHAPER.V2 Remote Access Trojan. Google's Threat Intelligence Group formally attributed the attack. The attacker compromised a long-lived classic npm access token belonging to axios's primary maintainer, bypassing the project's OIDC/SLSA-based CI/CD workflow.

Anthropic's liability exposure centers on whether its distribution practices met reasonable care standards. Distributing a developer tool via npm — with its known supply chain risks — rather than exclusively through its standalone native installer raises questions, particularly since Anthropic had already built the alternative.

The exposed codebase contained 44 feature flags gating over 20 unshipped capabilities, internal model codenames (Capybara for Claude 4.6, Fennec for Opus 4.6, Numbat for an unreleased model), the KAIROS autonomous daemon mode referenced over 150 times, and internal benchmarks revealing that Capybara v8 has a 29–30% false claims rate — nearly double the 16.7% rate in Capybara v4.

For a company that closed a $30 billion Series G at a $380 billion valuation in February 2026, with estimated annualized revenue of $19 billion and Claude Code alone generating $2.5 billion ARR, the benchmark regression raises securities law questions. SEC Rule 10b-5 anti-fraud provisions apply to all securities transactions — including private placements.

Important caveats: the leaked benchmarks come from code comments on a pre-release model version (v8). Private company investors typically access extensive diligence materials and may have been fully informed. No SEC investigation has been reported. But the strategic intelligence damage is real: competitors now know Anthropic's unreleased model codenames, autonomous agent architecture, anti-distillation mechanisms, and product roadmap.

The Claude Code leak is not primarily a story about one engineer's mistake. It is a case study in how a trivial, well-known build configuration error — repeated three times over 13 months by a company valued at $380 billion — can trigger cascading legal consequences across nearly every unsettled area of technology law.