Claude Code's source code was reported to have been left publicly accessible — some 500,000 lines across 1,900 files — after Anthropic pushed the original source to NPM alongside the built package meant for distribution. Anthropic said "no sensitive customer data or credentials were involved or exposed," calling it "a release packaging issue caused by human error, not a security breach," and said it was putting measures in place to prevent a repeat. A security researcher described it as human error from a shortcut that bypassed the normal release safeguards. It came five days after a misconfiguration on the company's blog infrastructure had exposed the existence of the unreleased Mythos model.