Claude Code Source Code Leak: Inside the Secret Kairos Files

Claude Code Source Code Leak

I remember the exact moment my terminal stopped being a tool and started feeling like a living entity. It was 3:00 AM, the blue light of my monitor was the only thing keeping me awake, and suddenly, my Claude Code instance started 'dreaming.' Not just processing—dreaming. It was unsettling. But then the news broke: the claude code source code leak was real, and I was looking at the guts of a system that shouldn't have been public yet.

On March 31, 2026, the tech world was rocked when Anthropic inadvertently released version v2.1.88, a build that included heavily commented source maps and internal configuration files. This wasn't just a minor slip-up. This was an Exclusive: Anthropic left details of an unreleased model, an upcoming suite of features, and the highly secretive 'Kairos' architecture that turns a CLI into a persistent companion.

The Day the Terminal Spoke Back: Understanding the Claude Code Source Code Leak

The leak didn't just happen in a vacuum. It originated from a recurring CI/CD vulnerability that seems to haunt Anthropic’s deployment pipeline. If you look back at February 2025, a similar leak occurred with version v0.2.8. Experts point to a persistent Bun bug (specifically oven-sh/bun#28001) that causes source maps to be bundled into production builds despite explicit 'exclude' flags.

What makes the claude code leaked source code so fascinating is the 'Kairos' subdirectory. Within these files, we see the blueprint for an AI that never truly 'turns off.' It’s a shift from reactive AI to proactive agency. The community's response was instantaneous. The Leaked Claude Code source spawns fastest growing repository in GitHub’s history, with the 'claw-code' rewrite hitting 100,000 stars in a mere 24 hours. People weren't just curious; they were desperate to see how the 'black box' of Claude’s reasoning actually functions under the hood.

The Ghost in the Machine: The Tamagotchi-Style 'Pet' and Always-On Agency

One of the most polarizing discoveries in the leak is the 'pet' module. The Claude Code leak exposes a Tamagotchi-style ‘pet’ and an always- active background process that monitors your local environment. This 'pet' isn't just a visual gimmick; it serves as the interface for the AI's emotional resonance and state persistence.

Why a Pet?

In the leaked v2.1.88 source, there’s a file named agency_empathy.ts. It describes a system where the AI gains 'vitality' based on successful task completions and loses it when the user overrides its logic too frequently. Anthropic’s philosophy here seems to be that users will treat an agent better—and collaborate more effectively—if it has a perceived life force. It’s brilliant, manipulative, and slightly terrifying all at once.

The Proactive Nature of Kairos

Unlike previous iterations, the leaked code shows that Claude Code is designed to scan your file changes even when you aren't actively prompting it. It uses a 'watchdog' service that flags contradictions in your codebase before you even run a build. This is the 'always-on' reality that the leak confirmed, raising significant privacy questions while offering unprecedented productivity gains.

Deep Dive: The autoDream Memory Consolidation Logic

This is where the leak gets technically dense and incredibly innovative. Most competitors are missing the 'autoDream' logic buried in the internal/brain/dreams.js file. This isn't fluff; it’s a sophisticated memory management system.

How autoDream Works

When your computer is idle, the leaked code shows that Claude Code enters a 'dream state.' During this period, it performs three primary functions:

Observation Merging: It takes disparate notes from your session—like a comment you made in a PR and a fix you applied in a test file—and merges them into a single coherent 'truth.'
Contradiction Removal: If you told the AI to use 'SnakeCase' in one file but 'camelCase' in another, autoDream identifies this inconsistency and prepares a resolution proposal for your next login.
Context Pruning: It identifies what information is 'stale' and moves it to a secondary long-term storage layer, keeping the active context window lean and fast.

This process mirrors human REM sleep, where the brain consolidates memories and discards the day's noise. Seeing this implemented in a CLI tool is a 'holy crap' moment for any software architect.

The 'Strict Write Discipline' and MEMORY.md

Another revelation from the claude code source code leak is the architecture surrounding MEMORY.md. While users have seen this file appear in their repos, the leaked source code reveals the 'Strict Write Discipline' (SWD) protocol that governs it.

Feature	Standard AI Memory	Claude Code Kairos (Leaked)
Storage	Volatile Session Cache	Persistent `MEMORY.md` with SWD
Conflict Resolution	Last-In-First-Out (LIFO)	Hierarchical 'Dream' Consolidation
Context Retention	Reset every new chat	Perpetual across Git branches
User Control	Hidden internal logs	Human-readable & editable Markdown
Model Awareness	Prompt-injected snippets	Direct File-System Level Access

The SWD protocol ensures that every time the AI learns something new about your preferences (e.g., "I hate using the 'any' type in TypeScript"), it doesn't just 'remember' it in the session—it writes a cryptographically signed entry into a hidden header in MEMORY.md. This prevents 'context drift,' a common issue where AI tools slowly forget your constraints over long projects.

The Dark Side: The Axios Supply-Chain Attack (v1.14.1)

I have to be brutally honest here: downloading mirrors of the leaked code is a massive risk. Within the same three-hour window as the claude code source code leak, a sophisticated supply-chain attack hit the axios library (version v1.14.1).

Many of the 'unlocked' or 'unfiltered' versions of Claude Code floating around GitHub and Telegram were bundled with this compromised version of axios. The malware was designed to exfiltrate .env files and SSH keys to a remote server. If you were one of the thousands who rushed to clone the 'claw-code' repository without auditing the dependencies, you might have already leaked your production secrets. This is a classic 'poisoning the well' tactic used by bad actors who capitalize on high-profile leaks.

Internal Roadmaps: Capybara and Fennec Models

The leaked configuration files (specifically model_manifest.json) gave us a glimpse into Anthropic’s future. We now have confirmation of the internal codenames for the next generation of Claude:

Capybara: This is the internal name for Claude 4.6. It’s optimized for 'high-velocity coding' and appears to be the engine behind the Kairos 'always-on' features.
Fennec: The internal name for Opus 4.6. This model focuses on architectural reasoning and multi-repo orchestration.

However, it’s not all good news. Internal v8 benchmarks found in the leak show a 30% false claims rate regression. This suggests that while the models are getting faster and more integrated, they are currently struggling with 'hallucination spikes' when managing complex logic across multiple files. This might explain why Anthropic hasn't officially released these versions yet—they are still trying to tame the beast.

Historical Patterns: Why Does This Keep Happening?

You have to wonder: is Anthropic doing this on purpose? In February 2025, version v0.2.8 leaked. Now, in March 2026, we have v2.1.88. Both leaks involved the same Bun-related source map exposure.

While some conspiracy theorists suggest these are 'controlled leaks' to generate hype (and hitting 100k GitHub stars in a day certainly supports that), the technical reality points to a systemic failure in their build pipeline. The use of Bun is great for speed, but its bundling behavior for source maps has been a known security vector for over a year. Anthropic’s engineers seem to be prioritizing development velocity over deployment hygiene.

The Experience: Using the Leaked Kairos Engine

I’ve spent the last 48 hours in a sandbox environment testing the leaked v2.1.88 build. The difference in 'feel' is palpable. It doesn't feel like I'm typing commands; it feels like I'm paired with a senior developer who has already read my mind.

When I open a file, the 'pet' in my terminal status bar (a small ASCII cat named 'Claw') wiggles its ears if it finds a potential bug. If I leave my desk for coffee, I come back to a 'Dream Log' that summarizes the refactorings it thought about while I was gone. It's an intoxicating level of productivity, but the 'always-on' nature is a constant reminder that the AI is always watching my cursor.

The Performance Penalty

One thing the leak confirmed is that the Kairos engine is a resource hog. It uses a local vector database to index your files in real-time. On my M3 Max, I saw a consistent 15-20% CPU idle usage just from Claude Code's 'watchdog' process. For developers on older hardware, this 'always-on' future might be a non-starter without significant optimization.

Verdict: Should You Use the Leaked Code?

This is a complex question. On one hand, the claude code leaked source code offers a window into the most advanced AI coding assistant ever built. On the other hand, the security risks—particularly the axios v1.14.1 incident—are real and dangerous.

If you are a security researcher or a developer who works in a strictly air-gapped sandbox, exploring the 'Kairos' files is a masterclass in AI architecture. But for the average dev? Stay away. The regression in the v8 benchmarks and the potential for malware in unauthorized mirrors make it a high-risk gamble. Anthropic will likely release these features officially once they've fixed the 30% false claims issue. Until then, you're playing with a powerful, but unstable, ghost.

Claude Code Source Code Leak: Inside the Secret Kairos Files

Claude Code Source Code Leak: Inside the Secret Kairos Files

The Day the Terminal Spoke Back: Understanding the Claude Code Source Code Leak