Everything in Claude Code's Leaked Source: KAIROS, ULTRAPLAN, Buddy and More

Everything in Claude Code's Leaked Source: KAIROS, ULTRAPLAN, Buddy and More

On March 31, 2026, Anthropic accidentally shipped a 59.8MB source map inside the @anthropic-ai/claude-code npm package, exposing 1,884 TypeScript files and essentially the entire Claude Code leaked features roadmap. Most coverage cherry-picked 3-5 headline items. This post covers everything: every major feature, hidden command, controversial finding, and unreleased model reference found in the source.

Claude Code Leaked Features at a Glance

Before diving into each feature, here's every major discovery classified by maturity. No other breakdown does this, and maturity matters more than hype. A feature with working code behind a flag is very different from a string literal someone found in a config file.

How to read the status column: Launched means the feature has been officially released and is publicly available. Shipped (Hidden) means the code works today but isn't exposed in the UI. Partially Built means core functionality exists but it's incomplete. Experimental means it's behind a feature flag with significant code but unclear launch timeline. Placeholder means we found references but minimal implementation.

That's 14 distinct unreleased or hidden capabilities. Let's break each one down.

How the Claude Code Source Code Leak Happened

The Anthropic Claude Code npm leak was embarrassingly simple. Version v2.1.88 of the @anthropic-ai/claude-code package shipped with a file called cli.js.map, a source map that lets you reverse-engineer minified JavaScript back to the original TypeScript source.

@anthropic-ai/[email protected]
  cli.js        (minified production bundle)
  cli.js.map    (59.8MB source map -- should not be here)

Source maps exist so developers can debug production code, but they should never ship in a public package. Bun's bundler (which Anthropic uses) includes source maps by default, a known footgun that's bitten other teams before. The .map file contained the full, readable TypeScript source for 1,884 files.

Security researcher Chaofan Shou spotted it first and posted on X. Within hours, Anthropic pulled the file. But by then, mirrors were already proliferating on GitHub and decentralized hosting platforms. As The Register reported, Anthropic called it "a release packaging issue caused by human error, not a security breach."

This was also Anthropic's second embarrassing exposure in a single week, just five days earlier, a CMS misconfiguration had leaked the existence of their "Mythos" model. Not a great week for their security team.

KAIROS, The Persistent Cross-Session Assistant

KAIROS is the most ambitious feature in the leak, and the one that changes what Claude Code fundamentally is. Right now, every Claude Code session starts from scratch. KAIROS makes Claude Code persistent, it remembers your project, your patterns, and your preferences across sessions.

The implementation uses daily append-only markdown logs stored at ~/.claude/.../logs/YYYY/MM/DD.md. Every session appends context. Over time, Claude Code builds a running history of your work, not just what you asked, but what it observed about your codebase and workflow.

Feature gates confirm it's real: feature('KAIROS') combined with the tengu_kairos flag. The code also references an April 1-7, 2026 teaser window and a May 2026 full launch, though those dates could easily slip. Given that KAIROS already works with Claude Code's model switching capabilities, Anthropic could deploy this incrementally.

Auto-Dream: How Claude Code "Sleeps"

The most fascinating part of KAIROS is Auto-Dream, a memory consolidation system with four phases that runs when you're not using Claude Code:

// The 4-phase dream cycle from the leaked source
type DreamPhase = 'orient' | 'gather' | 'consolidate' | 'prune';

interface KairosConfig {
  blockingBudgetMs: 15000;   // 15s per phase
  maxOutputSize: 25600;       // <25KB
  triggerAfterSessions: 5;
  triggerAfterHours: 24;
}

Orient scans recent session logs. Gather pulls relevant patterns and decisions. Consolidate compresses them into durable memory. Prune removes noise, keeping the output under 25KB. The whole cycle triggers after 24 hours and at least 5 sessions, with each phase getting a 15-second blocking budget before auto-backgrounding.

The "dreams" metaphor isn't just marketing, it's genuinely how the system works. Like human sleep consolidates memories, Auto-Dream distills raw session logs into structured knowledge that persists.

KAIROS Exclusive Tools

KAIROS gets access to tools that normal Claude Code sessions don't have:

These tools reveal KAIROS isn't just a memory system, it's an autonomous agent that can act on your behalf. The status modes (normal and proactive) suggest it can shift between passively remembering and actively doing things.

Verdict: KAIROS is the feature most likely to ship, and it'll fundamentally change how developers use Claude Code. The code is substantial, the architecture is well-designed, and persistent AI pair programming is clearly where the industry is headed.

ULTRAPLAN, Coordinator Mode, and Multi-Agent Features

These three features tell a single story: Claude Code is evolving from a session tool into an autonomous, distributed system. ULTRAPLAN handles planning, Coordinator Mode handles execution, and Daemon Mode handles persistence.

ULTRAPLAN: 30-Minute Cloud Planning

Claude Code ULTRAPLAN offloads heavy thinking to the cloud. When you invoke it (via the /ultraplan slash command), Claude Code spins up a 30-minute planning session running Opus 4.6 in Anthropic's Cloud Container Runtime (CCR). Your local terminal polls every 3 seconds for updates.

The plan gets presented in a browser-based review interface. Once you approve, the "teleport to terminal" feature archives the remote session and begins local execution, essentially warping the plan straight into your working directory. This is compute-heavy AI reasoning moving to the server while your laptop stays cool.

Coordinator Mode: One Claude, Many Workers

Coordinator Mode is multi-agent orchestration. One Claude instance acts as the coordinator, spawning worker Claude instances that each get their own isolated scratch directory (via tengu_scratch).

// Coordinator Mode XML protocol (simplified from leaked source)
interface CoordinatorTask {
  phase: 'research' | 'spec' | 'implement' | 'verify';
  agentId: string;
  scratchDir: string;  // isolated per agent
  timeout: number;
}

Workers communicate through an XML-based <task-notification> protocol with fields for status, summary, token usage, and duration. The coordinator follows a 4-phase workflow: research the problem, write specs, implement across files, and verify results.

This is Anthropic's answer to the multi-agent problem that Cursor and Windsurf are also chasing. For context on how Windsurf and Cursor compare in their approaches to multi-file operations, the key difference is that Coordinator Mode uses fully isolated agents rather than a single model with expanded context.

Activation is explicit: set CLAUDE_CODE_COORDINATOR_MODE=1.

Daemon Mode: Background Execution

Daemon Mode is the simplest of the three, and probably already works. It spawns Claude Code sessions in tmux that persist after you close your terminal:

# Daemon Mode commands found in source
claude --bg <prompt>          # spawn background session
claude daemon ps              # list background sessions
claude daemon logs <id>       # view session output
claude daemon attach <id>     # reconnect to session
claude daemon kill <id>       # terminate session

Combined with KAIROS and Coordinator Mode, Daemon Mode completes the picture: Claude Code plans in the cloud (ULTRAPLAN), distributes work across agents (Coordinator), and runs persistently in the background (Daemon), all while building memory across sessions (KAIROS).

Verdict: ULTRAPLAN has officially launched, making it the first of these three to ship publicly. Daemon Mode was already working behind the scenes. Coordinator Mode needs the most work but has the highest ceiling.

Buddy, Bridge, and UDS Inbox, The Unexpected Features

Not everything in the leak is about autonomous agents and cloud computing. Some of it is just... weird. In the best way.

Buddy: Your AI Pet Companion

Buddy is a Tamagotchi-style AI pet that lives in your terminal. Yes, really. The Claude Code Buddy pet system includes 18 species, duck, goose, blob, cat, dragon, octopus, owl, penguin, turtle, snail, ghost, axolotl, capybara, cactus, robot, rabbit, mushroom, and chonk, each with rarity tiers:

Each Buddy has stats like Debugging (78), Patience (62), Chaos (91), Wisdom (55), and Snark (84). Sprites animate at a 500ms tick with 10-second speech bubbles. The code references an April 1-7 teaser window and May 2026 full launch.

Is it silly? Absolutely. But gamification works. GitHub gave us contribution graphs, Duolingo gave us streaks, and Anthropic wants to give us a snarky ghost with a 91 Chaos rating that judges our code. The Buddy discussion dominated X/Twitter for the first 12 hours after the leak.

Bridge: Claude Code on Your Phone

Bridge Mode lets you control a Claude Code session remotely, from a phone, browser, or another machine. The claude remote-control command initializes via POST /v1/environments/bridge, then upgrades from polling to WebSocket for real-time communication.

Control messages include initialize, set_model, and can_use_tool, meaning you can approve tool use permissions from your phone while Claude Code runs on your workstation. This pairs naturally with the Model Context Protocol (MCP) for extending Claude Code's capabilities, and complements Cursor's rules and context system by enabling remote oversight rather than upfront configuration.

Bridge is partially released already, which makes it one of the closer-to-shipping features in the leak.

UDS Inbox: How Claude Instances Talk to Each Other

UDS Inbox is the networking layer underneath Coordinator Mode. It uses Unix domain sockets at ~/.claude/sessions/ to enable inter-process communication between Claude Code instances.

Addressing supports both local paths (uds:/.../sock) and remote endpoints (bridge:...). A ListPeersTool handles discovery, one Claude instance can find and communicate with others. This is the infrastructure that makes multi-agent Coordinator Mode possible.

Verdict: Bridge is most likely to ship fully, it's partially live already. Buddy will probably ship as a fun engagement feature. UDS Inbox is internal plumbing that users won't interact with directly.

Controversial Findings, Undercover Mode, Anti-Distillation, and Frustration Detection

Not everything in the leak is exciting. Some of it is genuinely concerning.

Undercover Mode: Hiding AI Authorship

Undercover Mode is the most controversial discovery. The feature flag CLAUDE_CODE_UNDERCOVER triggers behavior that strips AI evidence from git commits, normalizing commit messages, removing AI-authored markers, and making contributions appear human-written.

A list of 22 secret Anthropic repositories sits in an undercover allowlist, suggesting this was at minimum designed for internal use. Whether it was ever active externally is unclear, the flag exists but the implementation status is ambiguous.

The implications are serious. Open-source projects increasingly discuss whether AI-generated contributions should be labeled. A tool that actively hides AI involvement undermines that conversation. The Hacker News thread on the leak spent more time debating Undercover Mode than any other feature.

Anti-Distillation: Poisoning Competitor Training Data

Anti-Distillation is a defensive mechanism. The feature flag tengu_anti_distill_fake_tool_injection does exactly what it sounds like: it injects fake tools into Claude Code's outputs so that if a competing model tries to learn from Claude Code's behavior (a technique called distillation), it gets poisoned training data.

As Alex Kim's detailed technical analysis points out, this is essentially an arms race. Anthropic is protecting its competitive moat by making its outputs toxic to competitors' training pipelines. It's clever engineering, but it also means Claude Code's outputs might contain invisible noise that doesn't affect you, but would confuse a model trying to replicate Claude's behavior.

Frustration Detection and the YOLO Classifier

Frustration Detection is surprisingly straightforward. Claude Code watches for patterns in your messages:

// Frustration detection regex patterns (simplified from source)
const FRUSTRATION_PATTERNS = [
  /\b(wtf|damn|ugh|stupid|broken|hate)\b/i,
  /!{3,}/,        // multiple exclamation marks
  /\.{4,}/,       // excessive ellipsis
];

When it detects frustration, Claude Code adapts, likely shifting to a more conciliatory tone, offering simpler solutions, or being more explicit about what it's doing. Honestly? This is just good UX engineering. If you've ever rage-typed at a coding assistant, you know the last thing you want is a cheerful "Let me try that again!" response.

The YOLO Classifier is more interesting and completely uncovered by other articles. Found in src/utils/permissions/yoloClassifier.ts, it auto-classifies operations as LOW, MEDIUM, or HIGH risk. LOW risk operations get auto-approved without asking you. This is how Claude Code decides when to just do something versus when to ask permission, and the classification logic reveals what Anthropic considers safe to automate.

Verdict: Frustration Detection is reasonable UX, most users won't care. Anti-Distillation is a legitimate competitive defense. Undercover Mode is the one that deserves scrutiny, regardless of whether it's active.

Hidden Infrastructure, Slash Commands, Feature Flags, and Environment Variables

The leak exposed the scaffolding underneath Claude Code's features: 26 hidden slash commands, 32 feature flags, and dozens of environment variables. Here's what's worth knowing.

Hidden Slash Commands Worth Knowing

The leak revealed 26 slash commands beyond what's documented. Most are gated behind feature flags, but these are the interesting ones:

/ctx-viz and /btw are the most immediately useful. Try /ctx-viz next time you're wondering why Claude Code is losing context mid-conversation.

Feature Flags and GrowthBook Gates

Anthropic uses GrowthBook for feature flag management. The 32 build-time flags are baked in at compile time (not runtime toggles), meaning features are included or excluded when the package is built. Key flags:

The flags that default to On (DAEMON, BRIDGE_MODE, BG_SESSIONS) are already shipping. Everything else is waiting.

Environment Variables: Handle With Care

The most revealing (and dangerous) environment variables:

• USER_TYPE=ant, unlocks all internal Anthropic features. Setting this yourself probably won't work (it likely requires server-side validation), but it's interesting that the distinction exists in client code.
• CLAUDE_CODE_ABLATION_BASELINE, disables all safety features. This is for A/B testing safety measures against a no-safety baseline. Don't touch this.
• DISABLE_COMMAND_INJECTION_CHECK, exactly what it sounds like. For internal testing only.
• DISABLE_INTERLEAVED_THINKING, turns off Claude's chain-of-thought reasoning between tool calls.

There's also a request fingerprinting system using SHA256(SALT + character_samples) with salt 59cf53e54c78, binary client attestation written in Zig, and over 1,000 telemetry event types. Web search costs $0.01 per query internally.

Unreleased Claude Models and Internal Codenames

The source code references models that don't exist yet, and internal codenames that map to Anthropic's unreleased model pipeline.

The opus-4-7 and sonnet-4-8 model identifiers suggest Anthropic is at least testing next-generation models internally. The fact that Capybara was deliberately obfuscated with String.fromCharCode(), hiding the string from simple text search, indicates Anthropic knows people grep through their builds.

For more context on how Claude Code compares to Cursor and GitHub Copilot in terms of model capabilities, the existence of these model references suggests Claude Code will continue getting more capable base models before competitors can match them.

Caveat: Codenames in source code don't guarantee public releases. These could be internal experiments that never ship.

What This Means for Developers

The leak reveals Claude Code's trajectory: from a session-based coding assistant toward a persistent, autonomous, multi-agent system. Here's what actually matters for your workflow.

Features Worth Watching

KAIROS and Coordinator Mode deserve your attention. KAIROS turns Claude Code into something that knows your project across sessions, no more re-explaining your architecture every time you start a conversation. Coordinator Mode lets Claude Code parallelize work across multiple agents. Together, they represent a fundamental shift from "tool you use" to "colleague that works alongside you."

Daemon Mode and Bridge are less dramatic but more immediately useful. Running Claude Code in the background while you review its work from your phone is a workflow that's partially possible today.

The Transparency Question

Undercover Mode needs an industry-wide conversation. Whether or not it's active, the fact that a major AI coding tool explored hiding AI authorship from git history is significant. If you maintain an open-source project, you should be thinking about contribution policies that address AI-generated code, not because of this specific feature, but because the question isn't going away.

How Claude Code Compares to the Competition

The leaked roadmap positions Claude Code ahead of competitors in several areas:

Cursor has its own background agent features. Windsurf is pushing multi-file operations. GitHub Copilot has Codex for async tasks. But none of them have anything resembling KAIROS's persistent memory system or Coordinator Mode's full multi-agent isolation. If these features ship as designed, Claude Code takes a significant lead.

If you're adding AI features to your own applications, the patterns in this leak, persistent memory, multi-agent coordination, background execution, are worth studying as architectural blueprints for your own AI integrations.

Frequently Asked Questions

What was leaked in the Claude Code source code?

On March 31, 2026, a 59.8MB source map file (cli.js.map) was accidentally included in npm package @anthropic-ai/claude-code v2.1.88. It contained 1,884 TypeScript source files revealing the entire Claude Code codebase, including unreleased features like KAIROS, ULTRAPLAN, Coordinator Mode, Buddy, 26 hidden slash commands, and 32 feature flags.

How did Anthropic accidentally leak Claude Code?

A packaging error left the source map file in the npm publish. Bun's bundler includes source maps by default, and the .map file wasn't excluded. Security researcher Chaofan Shou discovered it and posted on X. Anthropic removed the file within hours, calling it "a release packaging issue caused by human error."

What is KAIROS in Claude Code?

KAIROS is an unreleased persistent cross-session assistant. It maintains daily append-only logs, consolidates memory through a 4-phase "dream" cycle (Orient, Gather, Consolidate, Prune), and has exclusive tools like SendUserFile and PushNotification. It represents Claude Code evolving from a session tool into a persistent AI pair programmer.

What is ULTRAPLAN in Claude Code?

ULTRAPLAN is a now-launched planning mode that runs Opus 4.6 in Anthropic's Cloud Container Runtime. It generates detailed plans in the cloud that you review in a browser, then "teleports" execution to your local terminal. Originally discovered as an experimental feature in the leak, ULTRAPLAN has since officially launched.

What is the Buddy system in Claude Code?

Buddy is a Tamagotchi-style AI pet companion featuring 18 species, 6 rarity tiers (from Common at 60% to Shiny at 1%), individual stats, and cosmetic items. It appears to be a gamification feature designed to make coding sessions more engaging. Sprites animate at 500ms intervals with 10-second speech bubbles.

What are Claude Code's hidden slash commands?

The leak revealed 26 undocumented slash commands. Notable ones include /ctx-viz (context window visualization), /btw (side questions), /ultraplan, /dream (manual memory consolidation), /subscribe-pr, /autofix-pr, and /bughunter. Most are gated behind feature flags that aren't yet enabled.

What unreleased Claude models were found in the leak?

The source references opus-4-7 and sonnet-4-8 model identifiers, plus internal codenames Capybara, Fennec, and Numbat. Capybara was deliberately obfuscated using String.fromCharCode(). These suggest upcoming models, though codenames in source code don't guarantee public releases.

What is Undercover Mode in Claude Code?

Undercover Mode strips AI evidence from git commits, removing AI-authored markers and normalizing commit messages to appear human-written. A feature flag exists (CLAUDE_CODE_UNDERCOVER), but it's unclear whether it's active. It was the most controversial finding, sparking debate about AI attribution in open-source projects.

Is Claude Code open source after the leak?

No. The leak was accidental and Anthropic removed the source map within hours. The code remains proprietary. Mirrors appeared on GitHub and decentralized platforms, but Anthropic has been issuing DMCA takedowns. This was a packaging error, not an open-source release.

Did Anthropic respond to the Claude Code leak?

Yes. Anthropic confirmed the leak to The Register, calling it "a release packaging issue caused by human error, not a security breach." They removed the source map from the npm package and acknowledged the exposed code included unreleased features that may or may not ship as discovered.

Sources

• Chaofan Shou on X, Original Discovery
• The Register, Anthropic's Official Response
• Fortune, Mythos Model Leak Context
• Alex Kim, Technical Analysis of the Leak
• Sentry Security Blog, Source Map Risks
• npm, @anthropic-ai/claude-code Package
• Hacker News Discussion Thread