AI Security
Anthropic's Two Leaks in Five Days: What Enterprise Security Leaders Must Do Now
The company warning the U.S. government about AI cybersecurity risks shipped a misconfigured CMS and an unstripped Claude Code source map to npm. Neither required a hacker.
New here? Subscribe to Enterprise Field Notes, one new issue every week.
On March 26, a Cambridge University cybersecurity researcher found something unusual. Anthropic’s content management system was configured to make unpublished content publicly accessible by default. No authentication. No access controls on unpublished drafts. A searchable data lake open to anyone who knew where to look.
Inside it: a draft blog post revealing ‘Mythos’ (internal codename: ‘Capybara’), an unreleased Anthropic model described internally as a ‘step change’ above Claude Opus. The model Anthropic had been quietly briefing U.S. government officials about because of its potential to dramatically lower the barrier to large-scale cyberattacks.
The company warning governments about AI security risks had a CMS misconfiguration exposing its most sensitive unreleased work.
Five days later, on March 31, a routine npm package update for Claude Code shipped with a debugging .map file that pointed to a zip archive containing the full source code. 500,000 lines of obfuscated TypeScript across 1,900 files. Forty-four unreleased feature flags. The complete internal architecture of the product. A textbook source map leak through a public npm package.
Anyone who pulled that npm package had it.
Both causes: human error. No hackers. No sophisticated attacks. No insider threat. A misconfigured content management system. A packaging pipeline that did not strip debug artifacts before publishing. This is an AI supply chain security failure in the most literal sense.
Was This a Hack?
Anthropic’s official statement on the Claude Code incident was clear: ‘No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach.’
They are technically correct. There was no external attacker. No credentials were stolen. No customer data was exposed. By the traditional definition of a breach, this was not one.
But the semantic debate misses the point. 500,000 lines of source code are now in the hands of anyone who pulled that npm package before it was patched. Competitors, researchers, and bad actors alike. The AI vendor security posture question this raises is not ‘was there a hacker?’ It is ‘who has the data now, and what will they do with it?’
A misconfiguration data breach and a traditional intrusion breach have the same outcome: data that should be private is now public. How it got there matters for the post-mortem. It does not change the exposure.
Why I’m Writing About This
I spent over four years as Director of Site Reliability Engineering at a Fortune 500 global retailer, and before that a decade-plus building technology infrastructure at scale. I have been in the room when a misconfiguration becomes a breach notification.
I am not writing this to pile on Anthropic. I am writing this because what happened here is a near-perfect illustration of something almost universally misunderstood in enterprise AI: the gap between ‘we take security seriously’ and ‘we have the operational controls to prove it.’
Anthropic takes security more seriously than almost any technology company on earth. Their safety mission is not marketing. They employ some of the most capable security researchers in the field. And they had two preventable data exposures in 120 hours.
That is not an indictment of their values. It is a demonstration of how hard operational security actually is at scale, and what it requires beyond intent.
Incident 1: The CMS Misconfiguration That Exposed Claude Mythos
The Mythos leak is a CMS default permissions failure. Many content management systems, Contentful, Sanity, Webflow, Notion, and other, default to making content accessible via API or direct URL regardless of publish status. The assumption baked into the product design is that ‘unpublished’ means ‘not surfaced in your UI,’ not ‘not accessible to anyone with the endpoint.’ Unless someone explicitly overrides the default and configures access controls on unpublished content, it is often reachable by anyone who knows the URL pattern.
Most teams set up their CMS once, move on, and never revisit the default permission structure. It is not negligence. It is the natural consequence of a tool that was designed for content management, not for security. The security assumption was never built in.
For Anthropic, that default-open posture exposed not just a blog draft but a briefing document on a model they were actively keeping out of public view for national security reasons. The severity was a function of what was in the CMS, not the misconfiguration itself. For most enterprises, the severity will be a function of what is in yours.
Incident 2: Claude Code’s Source Map Leak on npm
The Claude Code incident is an npm package security failure. Source maps (.map files) are debugging artifacts generated during compilation. They map minified or compiled output back to original source code, which makes debugging fast and efficient for engineers. They are essential for internal development. They should never ship in a public release artifact.
Source map leak prevention is a standard DevSecOps practice. Most mature build pipelines include an explicit step that strips .map files before publishing. The problem is that build pipelines get complicated. When a team moves fast, adds new steps, rotates engineers, or modifies packaging config, a source map that was supposed to be excluded gets included. The pipeline did not catch it. The package shipped. npm does not ask questions.
This is an AI supply chain security event in the most precise sense. Anthropic published a software artifact to a public registry. That artifact contained data that was not intended to be public. Every downstream user who installed or updated Claude Code during the exposure window received it. The distribution was not a hack. It was the standard npm delivery mechanism working exactly as designed.
Neither failure required malicious intent. They required normal human beings working in complex systems under normal time pressure.
The Number That Reframes This
97% of organizations that experienced an AI breach had no AI access controls in place — IBM Cost of a Data Breach, 2025
Not ‘insufficient’ controls. Not ‘partially implemented’ controls. None. The near-universal finding across every organization that reported an AI breach in 2025 is that governance was absent. This is not a story about sophisticated attackers defeating well-designed systems. It is a story about organizations that never built the systems in the first place.
Anthropic is one data point in that 97%. A high-profile one. A company for whom the stakes of getting this right are unusually high, which is exactly why it is instructive.
If this can happen there, what does your AI security posture look like?
Five Actions for CISOs and CTOs Right Now
1. Audit your build pipeline for source map leak prevention.
If your engineering team ships npm packages, Docker images, Python packages, or any public release artifact, when did you last audit what is bundled in them? Source maps, debug configuration, internal environment variables, and partial credentials regularly ship by accident. Add an automated gate to your CI/CD pipeline that explicitly fails the build if .map files, .env files, or debug artifacts are present in the release candidate. Not a checklist. An automated block.
2. Audit your CMS default permissions.
Your content management system almost certainly has CMS default permissions designed by the vendor for general use, not your security requirements. Unpublished content, staging environments, and draft assets are routinely accessible via API endpoints your team has never audited. Assign a named owner to this audit. It is a two-hour task that eliminates a class of exposure that tripped a world-class AI company.
3. Assess your AI vendor security posture explicitly.
If you are running AI tools from any vendor, ask four questions: Where does my data go after a session ends? What is the vendor’s default data retention policy? Has their infrastructure been independently audited? What is their incident history? A vendor’s stated values are not a substitute for documented controls. Your enterprise AI risk management framework should require answers to all four before any AI tool is approved.
4. Separate intent from controls.
‘We take security seriously’ is a value statement. It does not create controls. Tooling that enforces the behavior you want regardless of what the human intended is a security control. Human memory is not. Process documentation is not. The misconfiguration data breach pattern, the fastest-growing breach category per IBM X-Force 2026, exists precisely because organizations rely on intent instead of enforcement.
5. Run a fast audit on your AI tooling stack specifically.
Most enterprises added AI tools rapidly in 2024 and 2025. The governance review that would normally accompany a major platform adoption often did not happen. Right now, inside your organization, there are almost certainly AI tools with unreviewed default data retention policies, overly permissive CMS configurations, and build pipelines that have never been security-reviewed. This week is a good week to find out where yours are.
On Anthropic Specifically
The Mythos leak has a dimension worth noting. The model’s capabilities in cybersecurity were significant enough that Anthropic was briefing U.S. government officials about it before release. They were exercising exactly the kind of responsible pre-release coordination that AI safety advocates have been pushing for.
And the details of that process leaked through an unsecured CMS. I do not say this to be ironic. I say it because it illustrates the core tension in enterprise AI right now: the organizations most committed to doing the right thing on safety are still operating with operational security practices built for a different threat environment. The gap between principled commitment and operational execution is where exposure lives.
Closing that gap is not a values problem. It is an infrastructure problem. And infrastructure problems can be solved.
What Comes Next
Anthropic will survive this. Their reputation will recover. The leaked source code will not fundamentally change the competitive landscape in ways they cannot respond to.
But the pattern these two incidents reveal — misconfiguration, default permissions, unreviewed build artifacts, human error in complex systems — is not unique to Anthropic. It is the default state of organizations that are moving fast on AI without the operational maturity to match their ambitions.
The IBM 97% figure is not a coincidence. It is what happens when governance is an afterthought. If you are a technology leader, the question to ask yourself this week is not ‘could this happen to us?’ It almost certainly could. The question is: what would you find if you ran the same audit that Cambridge researcher ran on your own systems?
ABOUT THE AUTHOR
Ben Pickett is COO of Swa-AI and former Global Director of SRE at Nike. Swa-AI delivers enterprise AI with zero data retention by default, SOC 2 aligned controls, and deployment in under three minutes.
References
1. Fortune — ‘Anthropic leaks its own AI coding tool’s source code in second major security lapse’ (March 31, 2026)
2. Fortune — ‘Exclusive: Anthropic left details of unreleased model in public database’ (March 26, 2026)
3. Axios — ‘Anthropic leaked 500,000 lines of its own source code’ (March 31, 2026)
axios.com/2026/03/31/anthropic-leaked-source-code-ai
4. IBM Security — Cost of a Data Breach Report 2025. 97% of AI-breached orgs lacked access controls; $670K shadow AI breach premium.
5. Gizmodo — ‘Source Code for Anthropic’s Claude Code Leaks at the Exact Wrong Time’ (March 31, 2026)
gizmodo.com/source-code-for-anthropics-claude-code-leaks-at-the-exact-wrong-time-2000740379
6. VentureBeat — ‘Claude Code’s source code appears to have leaked’ (March 31, 2026)
venturebeat.com/technology/claude-codes-source-code-appears-to-have-leaked-heres-what-we-know
By Ben Pickett on .
Exported from Medium on July 21, 2026.
About the author
I'm Ben. I write Enterprise Field Notes, and by day I'm COO at Swa, after years running reliability, data protection, and database operations at Nike. The lesson that keeps proving itself: anything you cannot run without, and cannot walk away from, is a risk you have not priced yet. What is yours?
Read more of Ben's Enterprise Field Notes at benpickett.com.
© 2026 Ben Pickett · Enterprise Field Notes