Anthropic Accidentally Leaked Claude Code's Secret Agent

On March 31st, researcher Chao Fan Show discovered something remarkable: Anthropic's entire Claude Code source code sitting in plain view on the NPM registry. Not from a hack or sophisticated exploit—from a bundled source map file that someone forgot to exclude from the package.

The irony runs deep. Claude Code contains an internal system called "undercover mode" specifically designed to prevent the AI from revealing internal code names in public commits. They built a stealth system to stop leaks, then shipped 1,300 TypeScript files totaling 45 megabytes of source code to anyone who bothered to look.

Buried in that leak is Kairos, an unreleased feature that transforms Claude Code from a reactive chatbot into something fundamentally different: a persistent background agent that watches your development work, builds memory over time, and decides on its own when to help you.

The Architecture of Always-On

Most AI coding assistants wait. You ask, they answer. You command, they act. That interaction model—request and response—is so embedded in how we think about AI tools that we rarely question it.

Kairos inverts that relationship. It maintains append-only daily log files, continuously recording observations, sessions, and actions throughout your workday. At regular intervals, it receives what the leaked code calls "tick prompts"—heartbeat checks where the system reviews what it's been observing and decides whether there's something worth acting on right now.

The design thinking shows up in the details. Kairos enforces a 15-second rule: any proactive action that would block your workflow for longer gets deferred. As content creator Julian Goldie notes in his breakdown of the leak, "The whole system is built around being genuinely helpful without becoming annoying. That is a hard balance to strike, and they have clearly thought carefully about it."

When Kairos does speak up, it uses "brief mode"—extremely concise responses designed for an assistant that's always present. The reasoning is straightforward: if something is constantly available to help, the last thing you want is walls of text every time it has something to say.

Tools You Don't Have Yet

The leaked code reveals capabilities that aren't available in the public Claude Code release. Kairos can push files directly to you—summaries, reports, alerts—without waiting for requests. It can send push notifications to your device even when you're away from your terminal. It can subscribe to and monitor pull request activity, watching your GitHub workflow in the background.

These aren't speculative features or marketing promises. They're implemented, functional code that simply isn't in the version you can download.

Then there's Auto Dream.

The system literally dreams—or at least, it runs a background memory consolidation engine during periods of inactivity. The process requires three conditions: 24 hours since the last consolidation, at least five sessions completed, and an acquired lock to prevent conflicts with other processes.

When all three gates pass, Auto Dream executes a four-phase cycle. Orient: scan existing memory files to understand what's already known. Gather: pull new information from daily logs and session transcripts. Consolidate: merge new information into organized topic files, convert relative dates to absolute ones, delete contradicted facts. Prune: keep the master index under 200 lines and 25 kilobytes, remove stale references, resolve contradictions.

"Every time you come back to work, Kairos has already consolidated what it learned," Goldie explains. "You do not have to re-explain your project every session. It already knows."

This is context persistence through actual engineering rather than marketing copy. The system maintains a structured, evolving knowledge base about your project and workflow that survives between sessions.

What You're Actually Using

Here's where the gap becomes visible. Claude Code uses compile-time feature flags—switches evaluated when the code is built, not when it runs. When a flag is off, the associated code doesn't just become disabled. It's eliminated entirely from the build through dead code elimination.

Kairos sits behind two of these flags: "Kairos" and "Proactive." In the NPM package you install, both are off. The code doesn't exist in your version at all.

The leaked source revealed approximately 87 compile-time flags total. Features like coordinator mode for multi-agent orchestration, voice mode, and daemon mode are all gated the same way. They're being built and tested internally. They're not in your hands.

This is standard practice in software development—build features behind flags, test them internally, release when ready. But the scale of what's hidden is notable. The publicly available tool and the tool Anthropic is actually building have diverged significantly.

The Source Map Slip

Source maps exist to help developers debug production code. When JavaScript or TypeScript gets minified for deployment, the compressed code becomes nearly unreadable. Source maps let you trace errors back to the original, human-readable code.

The catch: source maps embed the entire original source code inside them. Every file, every comment, every internal constant. Claude Code is built using the Bun runtime, which generates source maps by default unless explicitly disabled.

Someone didn't disable them. The maps shipped with the NPM package, and the whole codebase became publicly accessible. It's the kind of operational security failure that happens when automation handles packaging and no one manually audits the output.

Anthropic has since patched this—the source maps are no longer included in the package. But the leak revealed enough that the AI developer community is still unpacking the implications.

The Pattern That Matters

This isn't the first time we've seen a gap between what AI companies demo internally and what they ship publicly. It's not even the first time that gap has been revealed through a leak or accident. But Kairos represents something specific: a clear architectural direction where AI assistants shift from reactive tools to proactive agents.

The pattern shows up across the industry. Microsoft's Copilot, GitHub's Copilot Workspace, Cursor's agent mode—all moving toward systems that observe, remember, and initiate rather than simply respond. The difference is that Kairos's implementation details are now public record, documented in leaked source code rather than marketing materials.

What remains uncertain is whether this direction is what developers actually want. An always-on agent that watches your work and builds persistent memory about your projects is either incredibly useful or incredibly intrusive, depending on your workflow, privacy expectations, and trust in the system's judgment about when to interrupt.

The 15-second rule and brief mode suggest Anthropic is thinking carefully about those tensions. Whether they've solved them is a different question—one that can't be answered until Kairos actually ships and developers use it in production environments with real projects and real stakes.

For now, you're using a version of Claude Code that's significantly behind what Anthropic is building. The tool in your terminal and the tool in their internal builds have diverged. Whether that gap narrows through public release or widens through continued internal development is Anthropic's call to make.

Marcus Chen-Ramirez is a senior technology correspondent covering AI, software development, and the intersection of technology and society.