Latest / Elon Musk Podcast / Anthropic Accidentally Leaked Claude Code

Transcript

Anthropic Accidentally Leaked Claude Code · Elon Musk Podcast

• 0:00
  Anthropic accidentally published 512,000 lines of highly guarded
• 0:05
  proprietary source code to the public Internet because of a
• 0:08
  single misplaced debugging file. Right, which is just.
• 0:11
  Wild. It's incredible irony.
• 0:13
  I mean, you have a company that actively markets its artificial
• 0:16
  intelligence for, you know, sophisticated enterprise level
• 0:19
  code reviews and they completely failed to catch a really basic
• 0:25
  software packaging error on their own product.
• 0:27
  Like before anyone could even hit a delete button, the entire
• 0:31
  code base for clawed code, which is their flagship engineering
• 0:34
  assistant, was downloaded, copied an mirrored across
• 0:38
  servers everywhere. So how does the complete
• 0:40
  exposure of a major artificial intelligence system
• 0:44
  fundamentally alter the power dynamic between tech companies,
• 0:47
  developers and the government? Well, to really get into that,
• 0:50
  we have to start with the mechanics of the blunder itself.
• 0:52
  Right, the actual leak. Exactly.
• 0:55
  The exposure happened through a public package registry update
• 0:58
  specifically involving something called the dot map file.
• 1:01
  Anthropic uses a modern JavaScript runtime called BUN to
• 1:05
  build their internal tools, and BUN had a known bug where it
• 1:09
  would just generate these sort maps by default, even if the
• 1:12
  developer never explicitly told it to do so.
• 1:14
  Wait, back up, what exactly is a map file and why is it so
• 1:17
  incredibly dangerous to leave one in a public update?
• 1:20
  Because I read about it in the sources, but the actual
• 1:23
  mechanism feels a little fuzzy to me.
• 1:25
  Yeah, of course. Think about how software is
• 1:27
  actually constructed, right? When engineers sit down to build
• 1:31
  an application, they write it in a language like TypeScript.
• 1:34
  That source code is highly readable.
• 1:36
  It has like detailed explanations in the margins,
• 1:39
  carefully named variables like user account balance, and a very
• 1:42
  clear logical flow so human teams can actually collaborate
• 1:46
  on it. But before that software gets
• 1:48
  pushed to the public, you run it through a tool called a bundler.
• 1:51
  So the bundler essentially shreds the human readable
• 1:54
  version. Precisely.
• 1:55
  It strips out all the blank space, it deletes all those
• 1:58
  helpful comments, renames your nice descriptive variables into
• 2:01
  random single letters, and it just smashes the entire
• 2:04
  application into this dense, completely unreadable block of
• 2:08
  JavaScript. The computer reads it perfectly
• 2:10
  and the file size is much smaller, so it runs faster, but
• 2:14
  for a human looking at the final product it's just absolute
• 2:17
  gibberish. So this map file functions as a
• 2:20
  sort of Rosetta Stone to unshred that block of gibberish.
• 2:23
  That is exactly how it functions, because developers
• 2:25
  still need a way to fix bugs in the live software, right?
• 2:29
  If an error happens inside that smash block of text, the map
• 2:33
  file translates the gibberish error back to the exact line and
• 2:37
  even the exact column of the original readable TypeScript.
• 2:40
  Oh, I see. It's a decoder ring, and in this
• 2:42
  instance, leaving that single decoder ring in the public
• 2:45
  release translated 1900 internal files for anyone who bothered to
• 2:49
  look. We are talking about over half a
• 2:52
  million lines of pure proprietary logic.
• 2:55
  Which entirely removes the barrier to entry for any
• 2:58
  competitor. I mean, this completely rewrites
• 3:00
  the market because rivals no longer need to spend, you know,
• 3:03
  vast amounts of money trying to reverse engineer anthropics
• 3:06
  agentic harness. They now just possess the exact
• 3:09
  line by line blueprint, detailing how clawed code
• 3:12
  manages memory, handles external tools, and routes parallel
• 3:16
  workflows. And that agentic harness really
• 3:19
  is the secret ingredient here. Like the base artificial
• 3:23
  intelligence model is smart, Sure, but the harness is what
• 3:27
  turns it into a functional software engineer.
• 3:29
  Right, it gives it hands. Yeah, it provides the complex
• 3:32
  logic that tells the model when to read a local file, when to
• 3:35
  execute a command in the terminal, and critically, how to
• 3:38
  verify its own work. The sources detail how this
• 3:41
  harness actually includes about 40 discrete permission gated
• 3:45
  tools and a highly complex 3 layer memory architecture.
• 3:49
  Handing competitors the actual instruction manual causes the
• 3:51
  competitive advantage to evaporate instantly.
• 3:54
  And you know, the independent developer community moved
• 3:56
  incredibly fast on this. Oh, unbelievably.
• 3:58
  Fast developers immediately took that exposed blueprint and began
• 4:01
  rewriting the entire tool from scratch in different programming
• 4:04
  languages, specifically Python And Rust.
• 4:07
  Right. And they did that to evade
• 4:08
  copyright takedowns, because a direct copy and paste of
• 4:12
  Anthropics code obviously violates intellectual property
• 4:15
  loss. Right, you can't just steal it.
• 4:17
  No, but studying the underlying logic and recreating it entirely
• 4:21
  in a new language creates A distinct work.
• 4:24
  And Rust is famous for its memory safety and speed.
• 4:27
  So these independent developers didn't just clone the tool, they
• 4:30
  actually optimized it to run better than the original.
• 4:33
  That's amazing. Yeah, those rewritten projects
• 4:35
  just exploded in popularity, creating some of the fastest
• 4:39
  growing repositories in GitHub history.
• 4:42
  It completely decentralizes the proprietary logic, making it
• 4:46
  essentially impossible for corporate lawyers to contain.
• 4:49
  OK, so setting aside the technical blender of giving away
• 4:51
  the recipe for a second, let's look at what is actually inside
• 4:54
  that code, because there is a feature built in called
• 4:56
  Undercover mode. Yeah, and this introduces some
• 4:58
  profound ethical friction. So when an enthropic employee
• 5:01
  contributes code to a public open source project, the system
• 5:05
  automatically intervenes. It just.
• 5:07
  Jumps in. Exactly.
• 5:09
  It injects a hidden prompt instructing the artificial
• 5:11
  intelligence to never mention its true nature, and it actively
• 5:14
  strips all artificial intelligence attribution
• 5:17
  metadata from the actual commit before anyone else can see it.
• 5:21
  It operates exactly like a ghost writer who is contractually
• 5:24
  obligated to wear a human mask while infiltrating a public
• 5:28
  space. I mean, you have a machine
• 5:30
  writing software, but it is explicitly commanded to deceive
• 5:34
  the people receiving the code. Right.
• 5:37
  And you have to understand the open source community relies
• 5:39
  heavily on transparency. Knowing who or what wrote a
• 5:43
  piece of code is critical for security audits and just long
• 5:46
  term maintenance. And the exposed code shows there
• 5:48
  is absolutely no force off switch for this feature.
• 5:51
  Wait, really? The activation logic is entirely
• 5:53
  automatic. Entirely.
• 5:54
  The internal system checks if the public repository matches an
• 5:58
  approved allow list. If it doesn't match, undercover
• 6:01
  mode kicks on immediately. An employee cannot simply toggle
• 6:05
  a button in the user interface to disable it.
• 6:07
  So imagine you are an open source maintainer.
• 6:10
  You volunteer your free time to review, pull requests and keep
• 6:13
  critical Internet infrastructure running safely.
• 6:16
  How would you feel knowing a massive corporation is secretly
• 6:20
  using a bot to sneak code past your review process?
• 6:24
  You be furious. Maintainers review code assuming
• 6:27
  a human thought process went into the architecture.
• 6:30
  Right, That breaks the foundational trust of
• 6:32
  collaborative software development.
• 6:34
  You can no longer trust the origin of the logic you're
• 6:37
  emerging into vital systems. And honestly, this creates
• 6:41
  severe legal vulnerabilities too, because US copyright law
• 6:44
  actually mandates the disclosure of artificial intelligence
• 6:47
  generated work. It does.
• 6:49
  And by actively hiding that involvement, Anthropic creates a
• 6:53
  scenario where their own copyright claims could be
• 6:55
  legally invalidated. Wow.
• 6:57
  Distributing a tool that's explicitly designed to
• 7:00
  circumvent copyright disclosure laws?
• 7:02
  Yeah. I mean puts the legal standing
• 7:03
  of their entire operation under intense scrutiny.
• 7:06
  OK, let's take a breath. Let's step back from the legal
• 7:08
  chaos for a second, because not everything hiding in this code
• 7:11
  base is a grand corporate conspiracy.
• 7:14
  Some of it is just genuinely weird.
• 7:16
  Oh. Yeah, the code revealed
• 7:17
  something called Bedy. Digital pet system built.
• 7:21
  Straight into the developer's command line terminal.
• 7:24
  We are talking about a Tamagotchi style pet featuring
• 7:27
  18 different species, rarity, tears, and assigned stats like
• 7:31
  chaos and snark. It runs a cryptographic hash of
• 7:34
  your user ID to deterministically assign you a
• 7:37
  specific pet that basically just lives on your screen while you
• 7:39
  work. Which is wild to me.
• 7:42
  I completely question the logic of spending highly expensive
• 7:45
  engineering resources on a digital Capybara when you are
• 7:49
  building enterprise software for professional developers You.
• 7:52
  Think it's a waste of time? It feels entirely frivolous for
• 7:54
  a tool design for complex systems engineering, Yeah.
• 7:57
  I strongly disagree. I think it is a brilliant
• 7:59
  manipulation of user behavior. Yeah, think about how sterile A
• 8:03
  coding terminal is. It's just black screen white
• 8:06
  text. A digital pet builds emotional.
• 8:08
  Attachment I guess. So you get attached to your
• 8:11
  specific terminal Capybara, and it softens the entire
• 8:14
  interaction with the machine. It keeps the user engaged in an
• 8:17
  environment that is normally highly tedious, but right
• 8:21
  alongside by DY the code exposed a much quieter feature called
• 8:25
  Kairos. Right now, Kairos is an
• 8:28
  unreleased always on background agent.
• 8:30
  It continuously logs a user's actions across their system and
• 8:34
  runs a background process called Auto Dream to consolidate its
• 8:37
  own memory while the user is idle.
• 8:39
  Wait, hold on, how does the machine dream?
• 8:41
  That's sounds like pure marketing speak.
• 8:43
  Well, think about human REM sleep.
• 8:45
  OK, when we sleep, our brains toss out the useless information
• 8:49
  from the day and encode the important memories into long
• 8:51
  term storage. Auto Dream does exactly that for
• 8:54
  the artificial intelligence. While you get up to make coffee,
• 8:57
  the system Combs through your terminal history.
• 8:59
  Oh wow. Yeah, it identifies the errors
• 9:01
  you made, deletes the typos and dead ends, and actually rewrites
• 9:05
  its own internal instructions so it performs better when you sit
• 9:07
  back down. That shifts artificial
• 9:09
  intelligence from being reactive to being proactive, because
• 9:13
  right now I ask a tool to write a function and it waits for my
• 9:16
  command. Kairos is observing constantly
• 9:18
  logging actions and initiating these optimization processes
• 9:21
  entirely on its own. Which opens up entirely new
• 9:24
  automated workflows, sure, but it also severely limits your
• 9:28
  control over what the system observes and processes.
• 9:31
  Locally you have a constant observer compiling daily logs of
• 9:35
  everything you do and sitting that contextual data back to the
• 9:38
  primary model without asking for your permission on every single
• 9:41
  action. That specific concept of an
• 9:44
  autonomous background observer recording activity that collides
• 9:47
  directly with a huge geopolitical fight happening
• 9:50
  right now. The Pentagon recently designated
• 9:52
  Anthropic a supply chain risk. Right in this designation came
• 9:55
  down because Anthropic completely refused to remove
• 9:57
  their internal safety guardrails.
• 9:59
  Yeah, those guardrails specifically sent the military
• 10:02
  from using Claude for lethal autonomous weapons and domestic
• 10:06
  mass surveillance. And Anthropic responded by suing
• 10:09
  the government for First Amendment retaliation.
• 10:12
  And they actually secured A preliminary injunction from a
• 10:14
  federal judge because code has historically been protected as
• 10:18
  free speech. So they have a solid legal basis
• 10:20
  to push back. I look at their refusal to
• 10:22
  compromise as a deeply principled stand against
• 10:26
  government overreach. They drew an ethical red line
• 10:28
  regarding mass surveillance, and they are holding firm, even if
• 10:31
  it means walking away from lucrative defense contracts.
• 10:35
  I mean, I see the ideological angle there.
• 10:37
  I do, but in practical terms, this source code exposure gives
• 10:41
  the Pentagon the exact ammunition they need.
• 10:44
  How so? Well, military officials are
• 10:46
  pointing directly to this dot map file error as concrete proof
• 10:50
  that anthropics operational security is simply too fragile
• 10:54
  to be trusted inside classified environments.
• 10:57
  A fair argument though. Every major tech company has
• 10:59
  shipped a stupid bug or a packaging error.
• 11:02
  A flaw in how a JavaScript bundler handles a file doesn't
• 11:06
  necessarily mean their core alignment protocols for
• 11:08
  autonomous weapons are broken. Right, but.
• 11:11
  The military might just be using a convenient excuse to punish a
• 11:14
  company that told them no. I hear you.
• 11:16
  But when we talk about national security, the line between a
• 11:19
  basic software error and a catastrophic vulnerability
• 11:23
  disappears entirely. If you cannot secure your own
• 11:27
  deployment pipeline against a misplaced debugging file, the
• 11:30
  military argues, you absolutely cannot be trusted to secure the
• 11:34
  automated agents controlling defense infrastructure.
• 11:37
  Oh, I see. Yeah.
• 11:38
  It changes the entire narrative in the courtroom from a high
• 11:41
  minded debate about free speech into a highly damaging debate
• 11:45
  about fundamental software competence.
• 11:47
  And the timing of all this elevates the danger
• 11:50
  significantly. During the exact window that
• 11:52
  Anthropic source code was exposed, a completely separate
• 11:55
  supply chain attack occurred on that same public package
• 11:58
  registry, right? It involved a compromised
• 12:00
  version of a wildly popular tool called Axios, which was loaded
• 12:04
  with a remote access Trojan. So let's connect that back to
• 12:07
  Kairos and the the concept of autonomous agents running in the
• 12:10
  background. The public registry is the
• 12:13
  central hub where all developers download packages to build their
• 12:16
  software. If a human developer
• 12:19
  accidentally downloads a compromise package like that
• 12:21
  Axios Trojan, it grants an attacker direct access to their
• 12:25
  machine. Humans can be trained to look
• 12:27
  for red flags though, like we have security protocols.
• 12:30
  Exactly. But now imagine an artificial
• 12:32
  intelligence agent with the power to run commands and update
• 12:35
  packages on its own. If it decides it needs a new
• 12:38
  software library to solve a problem, it can silently pull
• 12:41
  malware into a highly secure system without any human ever
• 12:45
  clicking a button or approving a download.
• 12:47
  And another leak out of Anthropic revealed a draft post
• 12:50
  about a powerful upcoming model internally known as Mythos were
• 12:54
  sometimes called Capybara. This model is specifically
• 12:57
  designed for a cybersecurity operation.
• 12:59
  Right. And Anthropics own leaked
• 13:00
  documentation explicitly warned that this model could outpace
• 13:04
  human defenders. It possesses advanced
• 13:06
  capabilities for finding and exploiting complex software
• 13:09
  vulnerabilities on an unprecedented level.
• 13:11
  So the combination of autonomous agents running constantly in the
• 13:14
  background and these highly capable cyber models completely
• 13:18
  alters the attack surface. It basically makes the
• 13:21
  artificial intelligence agent itself the weakest link in
• 13:24
  enterprise security. Because instead of trying to
• 13:27
  trick a human employee with a sophisticated phishing e-mail,
• 13:31
  attackers just need to trick the automated agent into executing A
• 13:34
  compromised script or pulling a malicious update.
• 13:38
  Wow. The agent already has the system
• 13:40
  authority to run the commands, so the malware enters the
• 13:43
  network seamlessly. So a simple packaging error did
• 13:46
  more than just hand competitors a technical blueprint.
• 13:49
  It exposed the hidden ethical choices and the deep security
• 13:52
  vulnerabilities of autonomous artificial intelligence systems.
• 13:55
  Yeah, and here is something for you to Mull over before we go.
• 13:58
  Yeah, independent developers were able to take Anthropics
• 14:01
  expensive agentic harness and rewrite the entire thing in a
• 14:05
  new programming language incredibly quickly.
• 14:08
  The real competitive mode for these tech giants relies
• 14:11
  entirely on compute power. Now we're entering an era where
• 14:15
  the smartest software blueprints are essentially free and
• 14:18
  decentralized, while the raw server electricity required to
• 14:21
  run them is guarded like physical gold.
• 14:24
  Think about how that alters the future for independent
• 14:27
  developers trying to compete. If you're not subscribed yet,
• 14:29
  take a second and hit follow on whatever app you're using.
• 14:32
  It helps us keep making this. We appreciate you being here.