The Claude Code Source Leak: fake tools, frustration regexes, undercover mode
by alex000kim on 3/31/2026, 1:04:30 PM
https://alex000kim.com/posts/2026-03-31-claude-code-source-leak/
Comments
by: peacebeard
The name "Undercover mode" and the line `The phrase "Claude Code" or any mention that you are an AI` sound spooky, but after reading the source my first knee-jerk reaction wouldn't be "this is for pretending to be human" given that the file is largely about hiding Anthropic internal information such as code names. I encourage looking at the source itself in order to draw your conclusions, it's very short: <a href="https://github.com/alex000kim/claude-code/blob/main/src/utils/undercover.ts" rel="nofollow">https://github.com/alex000kim/claude-code/blob/main/src/util...</a>
3/31/2026, 6:42:57 PM
by: evil-olive
> So I spent my morning reading through the HN comments and leaked source.<p>> This was one of the first things people noticed in the HN thread.<p>> The obvious concern, raised repeatedly in the HN thread<p>> This was the most-discussed finding in the HN thread.<p>> Several people in the HN thread flagged this<p>> Some in the HN thread downplayed the leak<p>when the original HN post is already at the top of the front page...why do we need a separate blogpost that just summarizes the comments?
3/31/2026, 7:49:13 PM
by: mzajc
There are now several comments that (incorrectly?) interpret the undercover mode as only hiding internal information. Excerpts from the actual prompt[0]:<p><pre><code> NEVER include in commit messages or PR descriptions: - The phrase "Claude Code" or any mention that you are an AI - Co-Authored-By lines or any other attribution BAD (never write these): - 1-shotted by claude-opus-4-6 - Generated with Claude Code - Co-Authored-By: Claude Opus 4.6 <…> </code></pre> This very much sounds like it does what it says on the tin, i.e. stays undercover and pretends to be a human. It's especially worrying that the prompt is explicitly written for contributions to public repositories.<p>[0]: <a href="https://github.com/chatgptprojects/claude-code/blob/642c7f944bbe5f7e57c05d756ab7fa7c9c5035cc/src/utils/undercover.ts#L39" rel="nofollow">https://github.com/chatgptprojects/claude-code/blob/642c7f94...</a>
3/31/2026, 7:06:31 PM
by: fatcullen
The buddy feature the article mentions is planned for release tomorrow, as a sort of April Fools easter egg. It'll roll out gradually over the day for "sustained Twitter buzz" according to the source.<p>The pet you get is generated based off your account UUID, but the algorithm is right there in the source, and it's deterministic, so you can check ahead of time. Threw together a little app to help, not to brag but I got a legendary ghost <a href="https://claudebuddychecker.netlify.app/" rel="nofollow">https://claudebuddychecker.netlify.app/</a>
3/31/2026, 7:49:36 PM
by: Reason077
> <i>"Anti-distillation: injecting fake tools to poison copycats"</i><p>Plot twist: Chinese competitors end up developing real, useful versions of Claude's fake tools.
3/31/2026, 7:13:22 PM
by: ripbozo
I don't understand the part about undercover mode. How is this different from disabling claude attribution in commits (and optionally telling claude to act human?)<p>On that note, this article is also pretty obviously AI-generated and it's unfortunate the author didn't clean it up.
3/31/2026, 6:41:54 PM
by: layer8
> Sometimes a regex is the right tool.<p>I’d argue that in this case, it isn’t. Exhibit 1 (from the earlier thread): <a href="https://github.com/anthropics/claude-code/issues/22284" rel="nofollow">https://github.com/anthropics/claude-code/issues/22284</a>. The user reports that this caused their account to be banned: <a href="https://news.ycombinator.com/item?id=47588970">https://news.ycombinator.com/item?id=47588970</a><p>Maybe it would be okay as a first filtering step, before doing actual sentiment analysis on the matches. That would at least eliminate obvious false positives (but of course still do nothing about false negatives).
3/31/2026, 7:41:00 PM
by: causal
I'm amazed at how much of what my past employers would call trade secrets are just being shipped in the source. Including comments that just plainly state the whole business backstory of certain decisions. It's like they discarded all release harnesses and project tracking and just YOLO'd everything into the codebase itself.
3/31/2026, 6:58:49 PM
by: simianwords
> The multi-agent coordinator mode in coordinatorMode.ts is also worth a look. The whole orchestration algorithm is a prompt, not code.<p>So much for langchain and langraph!! I mean if Anthropic themselves arent using it and using a prompt then what’s the big deal about langchain
3/31/2026, 6:44:55 PM
by: amelius
A few weeks ago I was using Opus and Sonnet in OpenCode. Is this not possible anymore?
3/31/2026, 7:48:51 PM
by: armanj
> Anti-distillation: injecting fake tools to poison copycats<p>Does this mean `huggingface.co/Jackrong/Qwen3.5-27B-Claude-4.6-Opus-Reasoning-Distilled` is unusable? Had anyone seen fake tool calls working with this model?
3/31/2026, 7:40:38 PM
by: pixl97
>Claude Code also uses Axios for HTTP.<p>Interesting based on the other news that is out.
3/31/2026, 6:02:08 PM
by: saadn92
The feature flag names alone are more revealing than the code. KAIROS, the anti-distillation flags, model codenames those are product strategy decisions that competitors can now plan around. You can refactor code in a week. You can't un-leak a roadmap.
3/31/2026, 7:09:27 PM
by: stavros
Can someone clarify how the signing can't be spoofed (or can it)? If we have the source, can't we just use the key to now sign requests from other clients and pretend they're coming from CC itself?
3/31/2026, 7:11:22 PM
by: motbus3
I am curious about these fake tools.<p>They would either need to lie about consuming the tokens at one point to use in another so the token counting was precise.<p>But that does not make sense because if someone counted the tokens by capturing the session it would certainly not match what was charged.<p>Unless they would charge for the fake tools anyway so you never know they were there
3/31/2026, 7:07:42 PM
by: seanwilson
Anyone else have CI checks that source map files are missing from the build folder? Another trick is to grep the build folder for several function/variable names that you expect to be minified away.
3/31/2026, 6:42:05 PM
by: marcd35
> 250,000 wasted API calls per day<p>How much approximate savings would this actually be?
3/31/2026, 7:38:01 PM
by: simianwords
> The obvious concern, raised repeatedly in the HN thread: this means AI-authored commits and PRs from Anthropic employees in open source projects will have no indication that an AI wrote them. It’s one thing to hide internal codenames. It’s another to have the AI actively pretend to be human.<p>I don’t get it. What does this mean? I can use Claude code now without anyone knowing it is Claude code.
3/31/2026, 6:35:04 PM
by: viccis
>This was the most-discussed finding in the HN thread. The general reaction: an LLM company using regexes for sentiment analysis is peak irony.<p>>Is it ironic? Sure. Is it also probably faster and cheaper than running an LLM inference just to figure out if a user is swearing at the tool? Also yes. Sometimes a regex is the right tool.<p>I'm reading an LLM written write up on an LLM tool that just summarizes HN comments.<p>I'm so tired man, what the hell are we doing here.
3/31/2026, 7:41:28 PM
by: mmaunder
Come on guys. Yet another article distilling the HN discussion in the original post, in the same order the comments appear in that discussion? Here's another since y'all love this stuff: <a href="https://venturebeat.com/technology/claude-codes-source-code-appears-to-have-leaked-heres-what-we-know" rel="nofollow">https://venturebeat.com/technology/claude-codes-source-code-...</a>
3/31/2026, 7:35:01 PM
by: simianwords
Guys I’m somewhat suspicious of all the leaks from Anthropic and think it may be intentional. Remember the leaked blog about Mythos?
3/31/2026, 6:38:13 PM
by:
3/31/2026, 7:37:11 PM
by: OfirMarom
Undercover mode is the most concerning part here tbh.
3/31/2026, 6:27:29 PM
by: skrun_dev
[dead]
3/31/2026, 7:53:58 PM