Claude Code leak reports ANTI_DISTILLATION_CC, fake_tools, and a 3,167-line print.ts loop

• The main Hacker News report says Anthropic shipped @anthropic-ai/claude-code version 2.1.88 with a 59.8 MB source map that exposed roughly 512,000 lines of TypeScript.
• According to the HN discussion roundup, one of the stranger finds was ANTI_DISTILLATION_CC, which reportedly injects anti_distillation: ['fake_tools'] into API requests.
• The same HN discussion also fixated on src/cli/print.ts, a 3,167 line file that commenters said had 12 nesting levels and about 486 branch points.
• The HN report and the linked thread both point to unreleased or half-buried features, including a /buddy companion system and internal codenames like Kairos.
• One HN comment summary floated a Bun packaging bug as the root cause, but the follow-up in Bun issue #28001 points at Bun.serve, not bun build, and the original commenter later walked that claim back.

You can read the main HN thread, the narrower Bun-cause subthread, and the actual Bun issue #28001. Anthropic's public line, quoted by InfoWorld, was that the release exposed no customer data or credentials and came from a packaging mistake.

The core fact is simple: a source map rode along with the npm package, and the map was enough to reconstruct the CLI's readable TypeScript. The primary HN report puts the exposed artifact at 59.8 MB and the recovered codebase at about 512,000 lines.

Anthropic told multiple outlets, including InfoWorld, that the incident was a human packaging error rather than a broader breach. The npm package page for @anthropic-ai/claude-code shows Claude Code is still distributed as a public package, which made a bad publish unusually easy to inspect and mirror.

The most memorable guardrail detail came from cedws's quoted HN comment, which said ANTI_DISTILLATION_CC injects anti_distillation: ['fake_tools'] into requests. That is a very specific anti-scraping idea: poison any attempt to learn Claude Code's tool behavior by watching traffic.

The interesting part is not just the existence of anti-distillation logic. It is that the leak turned a vague industry suspicion into an implementation detail, complete with a flag name and a concrete mechanism.

mohsen1's cited comment described src/cli/print.ts as a 3,167 line choke point with 12 levels of nesting and roughly 486 branch points. The same comment says that one file was carrying agent loop control, SIGINT handling, rate limits, AWS auth, MCP lifecycle, plugins, and worktree bridging.

That kind of file tells you a lot about where the product's complexity actually lives. In Claude Code's case, the answer seems to be the interactive terminal loop, not some cleanly isolated agent core.

The HN roundup includes an early theory from jakegmaths that a Bun bug exposed source maps in production. The canonical bug report, Bun issue #28001, describes source maps being served by Bun.serve even with development: false.

That mapping does not cleanly fit this leak. In the same HN subthread, captured in the direct comment page, the original commenter later said, "My apologies, this isn't the cause," while other replies noted that issue #28001 was specific to Bun's frontend dev server path.

The leak also surfaced product archaeology. The main HN report mentions an unreleased codename, Kairos, while fatcullen's quoted comment points to a /buddy feature with deterministic generation from an account UUID.

That last detail matters because it moved beyond source browsing into reproducible behavior. According to the HN summary, someone used the UUID rule to build a checker site, which means the leak exposed not just names and flags, but enough product logic for outsiders to test hidden features.