Anthropic rushes to close Claude Code source code leak

Anthropic is rushing to close the leak of Claude Code's source code

Anthropic PBC is urgently addressing the consequences of the unintentional publication of internal source code underlying Claude Code — the AI assistant from Anthropic that has become one of the company's key revenue sources, according to Bloomberg Tech.

What is Claude Code and why does it matter

Claude Code is an AI assistant from Anthropic designed for developers: it works as an agent capable of writing, editing and debugging code directly in a terminal or integrated development environment, based on models from the Claude family. Over the past years, such tools — agentic programming assistants — have transformed from niche experiments into one of the main sources of commercial growth for major AI labs, as developers and companies are willing to pay for subscriptions that significantly accelerate code writing and maintenance. This is why Bloomberg Tech emphasizes that Claude Code is not just one of Anthropic's products, but a key source of the company's revenue.

Over the past years, the market for agentic programming assistants has grown significantly: in addition to Anthropic's own products, other major players are working in this space, offering similar tools for automating code writing and review. In such a competitive environment, the technical implementation — how exactly the agentic loop is organized, what system instructions govern the model's behavior, how tool and file system interaction is structured — becomes a significant competitive advantage that companies try to keep private.

• Company: Anthropic PBC
• Product: Claude Code — AI assistant for development
• Incident: unintentional publication of internal source code
• Product significance: one of the company's key revenue sources
• Source: Bloomberg Tech

Why is a source code leak so serious?

For a company earning revenue from a closed product, leaking its internal source code potentially means several risks at once. First, competitors may gain insight into the technical implementation — the agent architecture, system prompts, tool orchestration logic — which typically remain a trade secret. Second, publishing internal code can expose undiscovered vulnerabilities that attackers could exploit before the company manages to patch them. Third, for corporate clients who pay for Claude Code specifically counting on the privacy and protection of Anthropic's product, the fact of the leak itself is a reputational blow regardless of what exactly was disclosed.

Historically, similar incidents in the software industry have occurred before — from operating system source code leaks to individual service code leaks — and experience with such cases shows that the real damage depends not only on the volume of exposed data, but also on the speed of the company's response: how quickly it manages to limit further distribution of materials, close potential vulnerabilities and restore the trust of clients and partners.

What's next for Anthropic?

Bloomberg's phrasing that the company is "rushing" to address the leak suggests that at the time of publication, the incident had not been fully contained: Anthropic is likely simultaneously removing or restricting access to exposed materials, assessing exactly what code became public, and analyzing potential impacts on product security. For a company whose business model is largely built on the trust of corporate clients in the privacy and security of its agentic tools, the speed and transparency of response to such an incident will matter just as much as the fact of addressing the leak itself.

It is also indicative that the incident affects precisely the Anthropic product that has recently been presented as the main driver of the company's commercial growth, rather than a secondary experiment: the higher the revenue generated by a specific product, the higher the reputational or technical costs of any incident associated with it. For now, Bloomberg Tech does not reveal details about exactly how the leak occurred and what volume of code was affected, but the very phrasing "rushing to address" indicates that the company considers what is happening to be a situation requiring immediate, not planned response.