Anthropic Accidentally Exposes 512,000 Lines of Sensitive Source Code

A Tumultuous Month for Anthropic

Anthropic, an artificial intelligence company, has built a public identity by positioning itself as the cautious AI firm. It is known for publishing detailed research on the risks associated with AI and for being very vocal about the responsibilities that come with creating powerful technologies. However, it currently finds itself in conflict with the Department of Defense, adding to the pressure. Unfortunately, a human error has recently compromised this image of rigor.

This week, Anthropic accidentally made public a file containing nearly 2,000 source code files and over 512,000 lines of code during the release of version 2.1.88 of its Claude Code software. This product is not trivial; it is a command-line tool that allows developers to use Anthropic's AI to write and edit code. Its power even led OpenAI to halt its video generation product Sora, just six months after its launch, to focus more on developers and businesses, according to the Wall Street Journal.

A Measured Response to the Incident

The leak was quickly detected by Chaofan Shou, a security researcher, who reported it on X. Anthropic responded by downplaying the incident, stating that it was a version packaging issue caused by human error, and not a security breach. This nonchalant reaction likely contrasts with the internal turmoil that the error may have caused.

What was exposed is not the AI model itself, but the software architecture surrounding it. The revealed instructions indicate to the model how to behave, which tools to use, and where its limits lie. Developers immediately began analyzing this information, with one describing the product as offering "a production-quality developer experience, not just a wrapper around an API."

Repeated Errors

This is the second leak to occur at Anthropic in a week. Just days earlier, Fortune reported that Anthropic had accidentally made nearly 3,000 internal files publicly accessible, including a draft blog post describing a new powerful model that the company had not yet announced. These repeated errors raise questions about the management of sensitive data at Anthropic and could have repercussions for its reputation and competitiveness. One can imagine that at Anthropic, an engineer is wondering if they still have a job, hoping that it is not the same team that made the previous mistake.