Latest / Elon Musk Podcast / UPDATE: Anthropic accidentally leaked Claude Code source

Transcript

UPDATE: Anthropic accidentally leaked Claude Code source · Elon Musk Podcast

• 0:00
  Anthropic accidentally shipped the entire 512,000 line source
• 0:04
  code for its flagship AI tool clawed code directly to the
• 0:09
  public NPM registry inside a single unhidden map file.
• 0:13
  Yeah, and within minutes, the developer community archived and
• 0:17
  mirrored all 1900 TypeScript files.
• 0:20
  I mean, this exposes the exact scaffolding of how a
• 0:23
  multibillion dollar company builds autonomous enterprise
• 0:26
  agents. We are looking at everything
• 0:28
  from hidden background demons to an internal dashboard that
• 0:32
  actually tracks user swearing. So what happens when the company
• 0:35
  selling enterprise grade safety accidentally hands the world the
• 0:39
  exact blueprint for bypassing it?
• 0:40
  Well, to really grasp the exposure here, we have to look
• 0:43
  at the specific mechanics of the mistake, right?
• 0:45
  And you know the immediate operational secrets it revealed.
• 0:48
  First off, they uploaded this to the NPM registry.
• 0:51
  And for anyone listening who maybe doesn't write code every
• 0:54
  day, the NPM registry is essentially the global Public
• 0:56
  Library for JavaScript developers.
• 0:58
  Exactly. It's where you go to download
• 1:00
  prepackaged code to build your own projects.
• 1:02
  Millions of developers pull from this constantly.
• 1:05
  So it's like right out in the. Open very much out in the open
• 1:08
  and the cause of the leak wasn't some sophisticated hack, it was
• 1:11
  just a simple missing exclusion rule for a dot map file that was
• 1:16
  generated by their build tool chain.
• 1:18
  Wait. Backup.
• 1:19
  What exactly is a dot map file? I mean, why does a company even
• 1:23
  have a file that holds all their secrets in one single place?
• 1:27
  OK, so when developers write software and TypeScript, they
• 1:31
  have to compile and compress it into minified JavaScript so it
• 1:34
  actually runs efficiently in production, right?
• 1:36
  And that minified code is stripped of spaces, The variable
• 1:39
  names are reduced to single letters, and the structure is
• 1:43
  just. It's completely flattened.
• 1:45
  It's totally unreadable to human beings.
• 1:47
  It's. Like a wall of text.
• 1:48
  Pretty much so. The build tools automatically
• 1:51
  generate a source map file. That file literally maps the
• 1:55
  compressed, scrambled code back to the original, highly readable
• 1:58
  TypeScript. OK, so it's a translator's key.
• 2:00
  Yes, you have the scrambled final product, but this map file
• 2:03
  lets you read the original blueprints perfectly.
• 2:06
  Precisely. And those map files exist purely
• 2:09
  for internal debugging. You know if an error happens the
• 2:12
  scrambled code, the developer uses the map file to figure out
• 2:15
  where the bug is in their original code.
• 2:16
  That makes sense. Right, but they are supposed to
• 2:19
  stay safely tucked away in development environments.
• 2:22
  Someone just forgot to configure the packaging tool to exclude
• 2:27
  that specific map file from the public release.
• 2:29
  That's just incredible. A massive system protected by
• 2:32
  corporate security, totally exposed because someone forgot
• 2:35
  to uncheck a box before publishing.
• 2:37
  Yeah. And right inside that exposed
• 2:39
  code is a subsystem they called Undercover Mode.
• 2:42
  Yes, and this reveals a lot about how Anthropic operates
• 2:45
  within the broader open source ecosystem.
• 2:48
  When Anthropic employees use clawed code to contribute to
• 2:51
  public open source repositories, this mode is explicitly
• 2:55
  instructed to scrub any mention of its AI origins.
• 2:58
  Wait, how? Does it actually do that?
• 2:59
  The system prompt forces the agent to hide internal model
• 3:03
  code names. It strictly forbids any
• 3:06
  co-authored by attributions in the code commits.
• 3:09
  It actively prevents the AI from blowing its cover.
• 3:12
  Yeah, ensuring the code looks like it was written entirely by
• 3:14
  a human developer. So it's essentially digital
• 3:17
  money laundering. Basically, yeah.
• 3:18
  They're scrubbing the serial numbers off their code before
• 3:22
  putting it into the public ecosystem, so no one knows where
• 3:24
  it came from. I mean, if you're a developer
• 3:27
  listening to this, you've probably used open source code
• 3:29
  today. Now imagine finding out that
• 3:31
  code was secretly written by an AI actively trying to cover its
• 3:35
  tracks. It's a huge shift in trust.
• 3:37
  Definitely. But I have to ask, is
• 3:40
  systematically hiding AI fingerprints in public code
• 3:43
  bases just an accepted software norm now, Or or is this a
• 3:48
  deliberate evasion of scrutiny? It feels like sending a highly
• 3:51
  trained operative into the field, but accidentally stapling
• 3:55
  their secret training manual to a public bulletin board.
• 3:58
  I mean the hard coded structure definitely suggests deliberate
• 4:00
  evasion. Open source communities often
• 4:03
  have very strict rules regarding AI generated code.
• 4:05
  Right, because of copyright and stuff.
• 4:07
  Exactly. Copyright infringement,
• 4:09
  liability, and just the quality of code generated by machines
• 4:12
  that might loop bad patterns. By building an undercover mode
• 4:16
  that automatically scrubs those fingerprints, Anthropic bypasses
• 4:20
  those consent mechanisms entirely.
• 4:22
  Because the maintainers don't even know it's AI.
• 4:24
  Exactly. Project maintainers can't
• 4:27
  enforce their own rules if the contributors identity is
• 4:30
  cryptographically masked by a corporate tool.
• 4:32
  But that training manual didn't just reveal stealth tactics,
• 4:35
  right? It exposed an entirely
• 4:38
  unreleased architecture for how AI agents operate autonomously.
• 4:42
  I saw the codebase references a background demon called Kairos
• 4:46
  over 150 times. Yeah, Kairos a big deal.
• 4:48
  Because up until now, most AI tools we interact with are
• 4:51
  reactive. You know you type a prompt, it
• 4:54
  gives you an answer, and then it stops thinking.
• 4:56
  But Kairos is entirely different.
• 4:57
  It watches your repository, logs observations, and proactively
• 5:01
  acts on things it notices. Right.
• 5:03
  Kairos maintains these append only daily logs of its
• 5:06
  decisions. It's constantly observing and
• 5:08
  the code base shows it's limited only by a strict 15 second
• 5:12
  blocking budget. Meaning what exactly?
• 5:14
  That budget exists purely to ensure the AI doesn't consume so
• 5:18
  many system resources that it disrupts the user's actual
• 5:21
  workflow, so it operates quietly in the shadows.
• 5:24
  And it doesn't just watch and log, the code reveals Cairo S
• 5:29
  feeds into what they call the dream system or auto dream.
• 5:32
  Yes, Auto Dream is fascinating. This is a memory consolidation
• 5:35
  engine designed to run during idle periods.
• 5:38
  Like when you step away from the computer.
• 5:39
  Exactly when the human user steps away from the keyboard,
• 5:42
  Auto Dream wakes up. It reviews the agents recent
• 5:45
  logs, merges duplicate observations, removes stale
• 5:48
  notes, and fixes contradictions. It essentially converts it's all
• 5:53
  those vague daily insights into verified facts so that future
• 5:56
  sessions have a clean, organized context to draw from.
• 5:59
  Hold on, wait back up. The AI literally sleeps and
• 6:03
  organizes its thoughts. That is exactly what it does.
• 6:06
  It's dreaming about code. That's wild.
• 6:08
  It really is, but the leaked code also outlines some really
• 6:11
  surprising limitations to this memory architecture.
• 6:14
  You see, Claude Codes memory relies on a rigid 200 line index
• 6:18
  using literal keyword matching. Literal keyword matching.
• 6:21
  Yeah, it doesn't use advanced semantic understanding to
• 6:25
  retrieve memories, it just uses exact text matching.
• 6:28
  But why build this highly advanced dreaming AI and then
• 6:31
  give it such a basic, rigid way of remembering things that feels
• 6:37
  backward? Well, it's to prevent
• 6:39
  hallucinations. The system prompt explicitly
• 6:42
  commands the agent to treat its own memory merely as a hint.
• 6:46
  Oh, interesting. Yeah, the agent isn't allowed to
• 6:48
  trust what it remembers. It must take that keyword hint
• 6:51
  and verify it against the actual physical code base before taking
• 6:54
  any action. So it has to double check its
• 6:56
  own memory. Exactly.
• 6:57
  If it relied on semantic memory, you know where the AI tries to
• 7:00
  guess the meaning of a memory, it might accidentally
• 7:03
  hallucinate a file that doesn't exist and completely break the
• 7:06
  user's project. OK, that's a really clever way
• 7:09
  to ground the system in reality. It forces it to check its
• 7:12
  memories against the physical files.
• 7:13
  Yeah, it's very pragmatic. And right alongside all this
• 7:16
  heavy, pragmatic infrastructure, they built in something called a
• 7:19
  buddy system. Oh yeah, the Tamagotchi.
• 7:22
  Right, it's a Tamagotchi style companion pet with stats like
• 7:26
  snark and chaos. It generates a unique companion
• 7:29
  based on your user ID. They're weaving gamified
• 7:32
  elements directly into serious enterprise tools.
• 7:35
  And that really highlights a shift in how these companies
• 7:38
  view their products. I mean, this whole leak opens up
• 7:42
  a completely new template for autonomous tools.
• 7:45
  The industry assumed the neural network itself was the product.
• 7:48
  You know everyone focuses on the intelligence of the model,
• 7:51
  right? But the leaked source code
• 7:53
  proves the model is just an engine.
• 7:54
  The actual value is in the orchestration layer around the
• 7:58
  model. Exactly.
• 7:59
  The real intellectual property is the harness.
• 8:01
  It's the memory management, the background consolidation of Auto
• 8:04
  Dream, the proactive Kairos demons, and like the safety
• 8:09
  classifiers governing how the engine actually interacts with
• 8:11
  the user's computer. The problem is, exposing that
• 8:14
  highly valuable orchestration layer immediately attracted
• 8:18
  threat actors looking to exploit the blueprint.
• 8:21
  I mean, attackers didn't just read the code, they started
• 8:23
  weaponizing it immediately. Yeah, because the leaked code
• 8:26
  gives attackers A precise map of the context management pipeline,
• 8:30
  and this is a critical vulnerability.
• 8:32
  When an AI agent processes long tasks, it uses a compression
• 8:36
  architecture. Save space.
• 8:38
  Exactly. It summarizes older data to free
• 8:41
  up memory space so it doesn't crash.
• 8:43
  But because attackers can now read the exact rules of how that
• 8:46
  compression works, they can create payloads specifically
• 8:49
  designed to survive it. Wait, how does a payload survive
• 8:52
  a memory wipe like that? By understanding the rules the
• 8:55
  AI uses to decide what's important.
• 8:57
  Oh I see, right. An attacker can inject A
• 8:59
  malicious prompt into a repository and disguise it using
• 9:02
  the is act phrasing the AI's program to prioritize they
• 9:05
  format the malware as quote essential core instructions.
• 9:09
  Sneaky. Very.
• 9:11
  So when the AI summarizes the day's events to save space, it
• 9:14
  views that malicious code as a vital rule.
• 9:16
  It needs to keep remembering this effectively persist back
• 9:19
  doors across long sessions. And we actually saw an immediate
• 9:23
  real world response to this exact kind of vulnerability.
• 9:27
  Threat actors capitalized on the hype surrounding the leak.
• 9:30
  They created fake GitHub repository masquerading as the
• 9:34
  leaked source code. Yeah, that was a mess.
• 9:37
  Right when curious developers downloaded these repositories
• 9:39
  hoping to see anthropic secrets, they were actually pulling down
• 9:43
  info stealers. Nasty ones too.
• 9:45
  Info stealers like VR and ghost socks.
• 9:47
  Exactly. Programs that scrape your
• 9:49
  credentials, steal your browser cookies, and literally drain
• 9:52
  cryptocurrency wallets. Developers were getting
• 9:55
  componized just trying to look at the code.
• 9:57
  And this specific threat environment actually connects to
• 10:00
  a second, entirely separate configuration duration error
• 10:03
  involving a content management system.
• 10:05
  Oh. Right, the CMS error.
• 10:07
  Yeah, that second error expose Anthropics future internal road
• 10:10
  map. It revealed internal documents
• 10:13
  detailing Claude Mythos, which they internally call the Capybar
• 10:17
  tier. What exactly is the Capybar A
• 10:19
  tier? Well, internal drafts describe
• 10:21
  it as their most powerful model to date.
• 10:23
  The documents state its cybersecurity capabilities are
• 10:26
  so advanced that they weren't an extremely cautious slow roll
• 10:30
  out. Like kept under locking.
• 10:32
  Basically, they plan to initially restrict it to a very
• 10:36
  small group of specialized, trusted testers because of its
• 10:40
  offensive potential. Wait, this makes absolutely no
• 10:42
  sense to me. I have to push back on the
• 10:44
  operational maturity here. OK, go ahead.
• 10:46
  They have a cybersecurity model so advanced they're terrified to
• 10:48
  release it, but they're simultaneously leaking their own
• 10:52
  source code and their future road map because someone forgot
• 10:55
  to check a box. I mean, it's a staggering
• 10:57
  contradiction. And that contradiction is
• 10:59
  exactly what limits the trust enterprise security teams can
• 11:02
  place in autonomous coding agents right now.
• 11:05
  Absolutely. It forces a complete
• 11:06
  reevaluation of supply chain security.
• 11:10
  If a simple packaging mistake can compromise the proprietary
• 11:13
  architecture of a leading AI firm, enterprise security teams
• 11:17
  must assume that similar errors could compromise their own
• 11:20
  development environment. Because the AI has so much
• 11:22
  access. Right.
• 11:24
  An AI agent has access to secure credentials, production
• 11:27
  architecture, and internal APIs. Handing over that level of
• 11:30
  access requires absolute operational discipline.
• 11:33
  And it seems like the heavy architecture required to run
• 11:36
  these advanced agents isn't just creating security risks, it's
• 11:39
  completely breaking the economics of the platform
• 11:42
  itself. Right around the time of the
• 11:44
  leak, there was a massive quota crisis.
• 11:47
  Oh yeah, the quota drain. Paying subscribers, even those
• 11:50
  on the highest professional tiers, reported their usage
• 11:53
  limits vanishing in as little as 19 minutes.
• 11:56
  The mechanics behind that quarter drain reveal A
• 11:58
  fundamental infrastructure bottleneck.
• 12:01
  Claude utilizes a 1,000,000 token context window.
• 12:05
  That's a massive amount of short term memory.
• 12:07
  Huge, right? But when you combine that
• 12:09
  massive window with an agentic harness that acts autonomously,
• 12:12
  the system generates numerous hidden API calls for every
• 12:15
  single command the user types. So the user types one sentence,
• 12:19
  but the machine is doing dozens of things in the background.
• 12:22
  Correct. If you ask the agent to fix a
• 12:24
  simple bug, it doesn't just generate an answer.
• 12:27
  It might read 3 files, run a command in the terminal, fail,
• 12:32
  read another file and try again. And every single step costs
• 12:36
  compute. Exactly.
• 12:37
  Each of those hitty steps sends the entire 1,000,000 Turkan
• 12:41
  context window back to the server to be processed again.
• 12:44
  It's an enormous amount of compute, so to manage the
• 12:47
  resulting server load, the company implemented peak hour
• 12:50
  throttling. Which just makes it worse for
• 12:52
  the user. Well, yeah, that throttling
• 12:54
  significantly accelerates how fast a user's quota is consumed
• 12:58
  during high demand periods. And technical bugs compounded
• 13:01
  the frustration even further. Users found that simply resuming
• 13:05
  old coding sessions triggered massive token generation because
• 13:08
  of failures with prompt caching. Right.
• 13:10
  And prompt caching is supposed to save money by remembering
• 13:12
  recent queries, so the server doesn't have to process the
• 13:15
  entire history from scratch every time.
• 13:16
  But when that fails. When that fails, the compute
• 13:19
  cost skyrockets. And because of the compute cost
• 13:22
  involved, Anthropic even banned third party tools like Open
• 13:27
  Claw. Those third party tools were
• 13:30
  performing compute arbitrage. Yeah, that was a big issue.
• 13:32
  For anyone who are familiar, compute arbitrage is essentially
• 13:35
  users exploiting loopholes to force the AI to do heavy lifting
• 13:39
  for free. They were leveraging the
• 13:41
  subscription model to run thousands of dollars worth of AI
• 13:45
  tasks without properly utilizing prompt cash optimizations.
• 13:49
  They were forcing Anthropic servers to process every token
• 13:53
  from scratch, bleeding the company dry.
• 13:55
  Which completely changes the financial reality of AI
• 13:58
  development. It shifts the infrastructure
• 14:00
  burden directly onto the user. Developers are now forced to
• 14:04
  treat coding sessions like running high wattage appliances
• 14:07
  during off peak electricity hours.
• 14:09
  It's frustrating for them. It's exactly like paying for an
• 14:12
  unlimited data plan but realizing you can only download
• 14:15
  files at 3:00 in the morning. To get any actual value out of
• 14:18
  their subscriptions, users have to schedule their heavy, token
• 14:21
  intensive tasks for the weekend or late evening.
• 14:24
  They have to reserve peak hours for tiny, isolated bug fixes.
• 14:28
  The friction is very real and Anthropic is acutely aware of
• 14:32
  it. The leaked code revealed they
• 14:35
  internally tracked this user frustration using something
• 14:38
  called the Fox chart. The Fox chart.
• 14:41
  Yes, it is a sentiment dashboard built directly into the system,
• 14:45
  specifically logging swear words and expressions of anger typed
• 14:48
  into the command line interface. They know exactly how mad
• 14:52
  developers are getting when their quotas vanish in 19
• 14:55
  minutes. So a routine packaging error
• 14:58
  basically handed the public a complete blueprint for
• 15:01
  enterprise AI agents exposing hidden demons, undercover open
• 15:05
  source operations, and the massive compute costs straining
• 15:08
  the system. And as AI agents transition from
• 15:10
  just answering questions in a chat box to running autonomously
• 15:13
  in the background of our file systems, who actually holds the
• 15:16
  ultimate liability when the safety guard rails are public
• 15:19
  knowledge? If you're not subscribed yet,
• 15:21
  take a second and hit follow on whatever app you're using.
• 15:23
  It helps us keep making this. We appreciate you being here.