510,000 lines of Claude Code source code were leaked to the entire internet. And the first person to find it was a Chinese PhD dropout. Now, the father of Claude Code has finally responded. His answer? It was a pure accident. Blame Bun.
So the first person to leak Claude Code source code was a college dropout?
At 4:23 AM on March 31, security researcher Chaofan Shou posted one sentence on X.
“The Claude Code source code was leaked through a map file in the npm registry.”
Within 24 hours, the post got 2,800 reposts. The developer world exploded.
Sigrid Jin’s recovery repo on GitHub was forked 77,000 times. Overnight, OpenClaw’s main position was shaken.
510,000 lines of TypeScript code. 1,900 source files. Anthropic’s money-making product Claude Code was suddenly naked in front of the world.
Who was the man who found the leak? What kind of person can casually dig up the source code of a billion-dollar product? A Chinese college dropout security researcher.
It has nothing to do with Bun. This is a new leak.
The Man Behind the Kill List
He is not from Anthropic. He is just a young man who breaks things.
Chaofan Shou is a research engineer at Solayer. Before that, he was co-founder and CTO of FuzzLand, a blockchain security company.
On his personal website, there is a small project called “Things I Broke.” It records dozens of security bugs he has found. There is even a kill list that spans the entire security world. The list only shows names in black. The white names are the ones who passed his tests.
He has earned 190,000 US dollars from bug bounty programs.
Looking at the kill list, the most shocking entries are the AI-related ones.
In 2021, he found an SSRF and TLS injection bug in CVS Pharmacy that could open internal systems.
In 2023, he broke Twitter’s XSS, CSRF, and CSP protection. He could take over any account on the platform.
In 2024, the kill list nsfw ai art generator started to include AI companies.
He found an SSRF bug in Devin.ai that leaked user information and system admin access. Then he broke Etherscan, the most commonly used blockchain browser. He found XSS bugs in Cloudflare that could hijack user accounts.
FTX, Polygon, DogeChain, Google Nest, and other smart home devices are all on his list.
ai pussy
From PhD to Dropout to Startup
His school story is also unusual.
After graduating from UC Santa Barbara with a computer science degree, he joined Salesforce as a security engineer. His job was to scan code and find bugs. Then he joined Veridise, a blockchain security company, as a founding engineer.
But his PhD advisor at UC Berkeley’s Sky Computing Lab was the famous Koushik Sen.
ai nudifier
But he is a college dropout. On his own website, he wrote it clearly. “But I dropped out :p.”
After dropping out, he co-founded FuzzLand with Jeff Liu. The company focuses on Web3 security and smart contract auditing.
Their core product is an automated security platform that uses AI and fuzzing to track bugs. It has processed over 3,000 projects and raised more than 50 million US dollars.
In February 2024, it got 3 million US dollars in seed funding from investors including 1kx and HashKey Capital.
In January 2025, FuzzLand was acquired by Solayer, a Solana ecosystem company. Chaofan Shou became a research engineer at Solayer.
He never stopped doing research.
ItyFuzz, his smart contract fuzzing tool, was published at ISSTA 2023, CCS 2024, and CoNEXT 2024.
One interesting detail is that on his personal website, he also wrote about his experience with machine learning micro-trading. The result? “PnL -92%.”
He joked that he was the best at losing money in the entire security world.
The Same Mistake, Twice
Back to the leak itself.
The root cause was surprisingly low-level. When Anthropic released Claude Code v2.1.88 on npm, they forgot to remove a 59.8MB source map file called cli.js.map from the release package.
A source map is a developer tool that can turn minified code back into readable original source code.
Normally, these files should be deleted before release. Anthropic did not delete it.
What is worse, the map file also pointed to a zip archive on an Anthropic Cloudflare R2 storage bucket.
Anyone could download it. And the unzipped file was the full TypeScript source code.
What is important is that this was the second time.
In February 2025, Claude Code’s internal beta version also leaked source map files once. Anthropic’s response at the time was to remove the map files from npm and replace them with empty files.
But it may have been caused by a known Bun bug.
This bug was reported on GitHub on March 11 as issue 28001. It reflected that Bun’s compile mode accidentally included source map files. The issue is still open.
The Father of CC Responds
Just now, Boris Cherny, the father of Claude Code, finally responded. It has nothing to do with Bun. It was a pure mistake on our side.
About this leak, Anthropic’s official response was quick.
Anthropic told The Register that the leaked code was an internal development version and did not contain any customer data or credentials.
They called it a security vulnerability caused by a failed release process.
But in the leaked source code, people found something more interesting. There was a list of 187 internal state words.
These words included “Calculating” for basic computing, “Daydreaming” for idle states, “Evaporating” for disappearing states, and “Boogieing” for dancing states.
Some people joked that they hoped “gooning” was not on the list.
Boris silently refused to answer. But he did admit one thing. “I think we need to be more careful in the future. We should not let Claude leak its own code.”
The source code also revealed a more scary internal system. The system can automatically track user IDs and remove hidden swear words.
What is interesting is that Anthropic’s internal code names are very creative.
In the Claude Code log system, there is a direct interface that treats prompts as system variables.
Some people said that Claude Code is like a child that talks too much.
When a user sends a message, the model does not just answer. It also sends hidden “state words” back to the system.
When these words are detected, the AI system silently records them in the background. Anthropic’s internal team can then view these records.
Because of this, Boris revealed that there is a special database inside the company. It is called “fucks.” It directly counts how many times users curse.
What is worse, the leaked code also contains a mode called “Undercover Mode.” This system is specifically designed to prevent Anthropic employees from leaking internal information when working on public repos.
But the irony is that the system designed to prevent leaks ended up leaking itself.
A system built to stop leaks became the source of the leak.
This whole thing started with a source map file. 510,000 lines of code. A kill list. And a company’s daily habits, exposed to the world.
