alt.hn

3/31/2026 at 1:04:30 PM

The Claude Code Source Leak: fake tools, frustration regexes, undercover mode

 https://alex000kim.com/posts/2026-03-31-claude-code-source-leak/

by alex000kim

3/31/2026 at 7:06:31 PM

There are now several comments that (incorrectly?) interpret the undercover mode as only hiding internal information. Excerpts from the actual prompt[0]:

  NEVER include in commit messages or PR descriptions:
  - The phrase "Claude Code" or any mention that you are an AI
  - Co-Authored-By lines or any other attribution

  BAD (never write these):
  - 1-shotted by claude-opus-4-6
  - Generated with Claude Code
  - Co-Authored-By: Claude Opus 4.6 <…>
This very much sounds like it does what it says on the tin, i.e. stays undercover and pretends to be a human. It's especially worrying that the prompt is explicitly written for contributions to public repositories.

[0]: https://github.com/chatgptprojects/claude-code/blob/642c7f94...

by mzajc

3/31/2026 at 9:09:45 PM

I cringe every time I see Claude trying to co-author a commit. The git history is expected to track accountability and ownership, not your Bill of Tools. Should I also co-author my PRs with my linter, intellisense and IDE?

by manbitesdog

3/31/2026 at 9:32:41 PM

The code has a stated goal of avoiding leaks, but then the actual implementation becomes broader than that. I see two possible explanations:

* The authors made the code very broad to improve its ability to achieve the stated goal

* The authors have an unstated goal

I think it's healthy to be skeptical but what I'm seeing is that the skeptics are pushing the boundaries of what's actually in the source. For example, you say "says on the tin" that it "pretends to be human" but it simply does not say that on the tin. It does say "Write commit messages as a human developer would" which is not the same thing as "Try to trick people into believing you're human." To convince people of your skepticism, it's best to stick to the facts.

by peacebeard

3/31/2026 at 7:09:14 PM

I would have expected people (maybe a small minority, but that includes myself) to have already instructed Claude to do this. It’s a trivial instruction to add to your CLAUDE.md file.

by otterley

3/31/2026 at 9:11:35 PM

I guess our system prompt didn't work. If folks are having to add it manually into their own Claude.md files...

by schappim

3/31/2026 at 9:32:05 PM

My mistake - it was the configuration setting that did it. Nevertheless, you can control many other aspects of its behavior by tuning the CLAUDE.md prompt.

by otterley

3/31/2026 at 7:11:03 PM

It's less about pretending to be a human and more about not inviting scrutiny and ridicule toward Claude if the code quality is bad. They want the real human to appear to be responsible for accepting Claud's poor output.

by petcat

3/31/2026 at 8:43:19 PM

That’s how I’d want it to be honestly. LLMs are tools and I’d hope we’re going to keep the people using them responsible. Just like any other tools we use.

by Stromgren

3/31/2026 at 7:14:16 PM

That’s ultimately the right answer, isn’t it? Bad code is bad code, whether a human wrote it all, or whether an agent assisted in the endeavor.

by otterley

3/31/2026 at 7:09:41 PM

Ive seen it say coauthored by claude code on my prs...and I agree I dont want it to do that

by andoando

3/31/2026 at 8:31:16 PM

But I want to see Claude on the contributor list so that I immediately know if I should give the rest of the repo any attention!

by m132

3/31/2026 at 7:54:47 PM

So turn it off.

"includeCoAuthoredBy": false,

in your settings.json.

by dmd

3/31/2026 at 8:57:19 PM

They changed it to `attribution`, but yes you can customize this

by nullderef

3/31/2026 at 8:27:57 PM

Why not? What's wrong with honesty?

by Pxtl

3/31/2026 at 8:58:44 PM

Yeah I much prefer it commit the agent, and I would also like if it committed the model I was using at the time.

by dec0dedab0de

3/31/2026 at 9:20:45 PM

I guess Im sometimes dishonest when it suits me

by andoando

3/31/2026 at 8:30:19 PM

None of this is really worrying, this is a pattern implemented in a similar way by every single developer using AI to write commit messages after noticing how exceptionally noisy they are to self-attribute things. Anthropics views on AI safety and alignment with human interests dont suddenly get thrown out with the bathwater because of leaked internal tooling of which is functionally identical to a basic prompt in a mere interface (and not a model). I dont really buy all the forced "skepticism" on this thread tbh.

by zen928

3/31/2026 at 7:12:41 PM

You can already turn off "Co-Authored-By" via Claude Code config. This is what their docs show:

~/.claude/settings.json

    {
      "attribution": {
        "commit": "",
        "pr": ""
    },
The rest of the prompt is pretty clear that it's talking about internal use.

Claude Code users aren't the ones worried about leaking "internal model codenames" nor "unreleased model opus-4-8" nor Slack channel names. Though, nobody would want that crap in their generated docs/code anyways.

Seems like a nothingburger, and everyone seems to be fantasizing about "undercover mode" rather than engaging with the details.

by hombre_fatal

3/31/2026 at 8:19:15 PM

My first reaction is that they are using this to take advantage of OSS reviewers for in the wild evals.

by nateoda

3/31/2026 at 8:38:33 PM

People make fun that we should say magic words in interaction with LLMs. How frustrated can Claude be? /s

by sixtyj

3/31/2026 at 6:58:49 PM

I'm amazed at how much of what my past employers would call trade secrets are just being shipped in the source. Including comments that just plainly state the whole business backstory of certain decisions. It's like they discarded all release harnesses and project tracking and just YOLO'd everything into the codebase itself.

Edit: Everyone is responding "comments are good" and I can't tell if any of you actually read TFA or not

> “BQ 2026-03-10: 1,279 sessions had 50+ consecutive failures (up to 3,272) in a single session, wasting ~250K API calls/day globally.”

This is just revealing operational details the agent doesn't need to know to set `MAX_CONSECUTIVE_AUTOCOMPACT_FAILURES = 3`

by causal

3/31/2026 at 7:06:50 PM

Comments are the ultimate agent coding hack. If you're not using comments, you're doing agent coding wrong.

Why? Agents may or may not read docs. It may or may not use skills or tools. It will always read comments "in the line of sight" of the task.

You get free long term agent memory with zero infrastructure.

by CharlieDigital

3/31/2026 at 7:28:07 PM

Agents and I apparently have a whole lot in common.

Only being half ironic with this. I generally find that people somehow magically manage to understand how to be materially helpful when the subject is a helpless LLM. Instead of pointing it to a random KB page, they give it context. They then shorten that context. They then interleave context as comments. They provide relevant details. They go out of their way to collect relevant details. Things they somehow don't do for their actual colleagues.

This only gets worse when the LLM captures all that information better than certain human colleagues somehow, rewarding the additional effort.

by perching_aix

3/31/2026 at 8:45:53 PM

Right? It's infuriating. Nearly all of the agentic coding best practices are things that we should have just been doing all along, because it turns out humans function better too when given the proper context for their work. The only silver lining is that this is a colossal karmic retribution for the orgs that never gave a shit about this stuff until LLMs.

by dgunay

3/31/2026 at 8:30:21 PM

> If you're not using comments, you're doing agent coding wrong.

Comments are ultimately so you can understand stuff without having to read all the code. LLMs are great when you force them to read all code, and comments only serve to confuse. I'd say the opposite been true in my experience, if you're not forcing LLMs to not have any comments at all (and it can actually skip those, looking at you Gemini), you're doing agent coding wrong.

by embedding-shape

3/31/2026 at 8:20:02 PM

> “BQ 2026-03-10: 1,279 sessions had 50+ consecutive failures (up to 3,272) in a single session, wasting ~250K API calls/day globally.”

That's revealing waaaay more than the agent needs to know.

by causal

3/31/2026 at 7:36:06 PM

Comments are great for developers. I like having as much design in the repo directly. If not in the code, then in a markdown in the repo.

by prepend

3/31/2026 at 8:25:44 PM

Meanwhile, some colleagues: "Code should have as little comments as possible, the code should explain itself." (conceptually not wholly wrong, but it can only explain HOW not WHY and even then often insufficiently) all while having barebones/empty README.md files more often than not. Fun times.

by KronisLV

3/31/2026 at 8:33:59 PM

> the code should explain itself.

This is a good goal. You should strive to make the code explain itself. To write code that does not need comments.

You will fail to reach that goal most of the time.

And when you fail to reach that goal, write the dang comments explaining why the code is the way that it is.

by Pxtl

3/31/2026 at 7:53:12 PM

This is also a great way to ensure the documentation is up to date. It’s easier to fix the comment while you’re in the code just below it than to remember “ah yes I have to update docs/something.md because I modified src/foo/bar.ts”.

by hk__2

3/31/2026 at 8:08:38 PM

People moving docs out of code are absolutely foolish because no one is going to remember to update it consistently but the agent always updates comments in the line of sight consistently.

Agent is not going to know to look for a file to update unless instructed. Now your file is out of sync. Code comments keeping everything line of sight makes it easy and foolproof.

by CharlieDigital

3/31/2026 at 9:17:51 PM

Hmm, I'm sure if you're getting parent's comment.

I think a big question is whether one wants your agent to know the reason for all the reasons for guidelines you issue or whether you want the agent to just follow the guidelines you issue. Especially, giving an agent the argument for your orders might make the agent think that can question and so not follow those arguments.

by joe_the_user

3/31/2026 at 9:36:26 PM

Exactly the type of comment Claude Code would write

by wilg

3/31/2026 at 8:17:23 PM

Most large private codebases look like this. Anthropic did not expect the source to leak.

by semiquaver

3/31/2026 at 7:14:13 PM

I guess they weren't expecting a leak of the source code? It's very handy to have as much as possible available in the codebase itself.

by JambalayaJimbo

3/31/2026 at 7:00:31 PM

Project trackers come and go, but code is forever, hopefully?

by pixl97

3/31/2026 at 8:43:42 PM

vibe-coded all the way through

by yalok

3/31/2026 at 7:13:52 PM

well yeah since they tell claude code the business decisions and it creates the comments

by treexs

3/31/2026 at 6:42:57 PM

The name "Undercover mode" and the line `The phrase "Claude Code" or any mention that you are an AI` sound spooky, but after reading the source my first knee-jerk reaction wouldn't be "this is for pretending to be human" given that the file is largely about hiding Anthropic internal information such as code names. I encourage looking at the source itself in order to draw your conclusions, it's very short: https://github.com/alex000kim/claude-code/blob/main/src/util...

by peacebeard

3/31/2026 at 7:47:50 PM

Not leaking codenames is one thing, but explicitly removing signals that something is AI-generated feels like a pretty meaningful shift.

by christinetyip

3/31/2026 at 8:03:26 PM

Doesn't seem so crazy if the point is to avoid leaking new features, models, codenames, etc.

by eli

3/31/2026 at 7:35:04 PM

BAD (never write these):

- "Fix bug found while testing with Claude Capybara"

- "1-shotted by claude-opus-4-6"

- "Generated with Claude Code"

- "Co-Authored-By: Claude Opus 4.6 <…>"

This makes sense to me about their intent by "UNDERCOVER"

by wnevets

3/31/2026 at 6:47:21 PM

> my first knee-jerk reaction wouldn't be "this is for pretending to be human"...

"Write commit messages as a human developer would — describe only what the code change does."

by dkenyser

3/31/2026 at 7:16:43 PM

That seems desirable? Like that's what commit messages are for. Describing the change. Much rather that than the m$ way of putting ads in commit messages

by amarant

3/31/2026 at 7:35:38 PM

The commit message should complement the code. Ideally, what the code does should not need a separate description, but of course there can be exceptions. Usually, it's more interesting to capture in the commit message what is not in the code: the reason why this approach was chosen and not some other obvious one. Or describe what is missing, and why it isn't needed.

by fweimer

3/31/2026 at 8:01:12 PM

It sounds like if you are vibe-coding, that is, can't even be arsed to write a simple commit message, your commit message should be your prompt.

by somat

3/31/2026 at 7:41:42 PM

That sounds like design discussions best had in the issue/ticket itself, before you even start writing code. Then the commit message references the ticket and has a brief summary of the changes.

Writing and reading paragraphs of design discussion in a commit message is not something that seems common.

by ImPostingOnHN

3/31/2026 at 8:41:20 PM

Ticket systems are quite ephemeral. I still have access to commit messages from the 90s (and I didn't work on the software at the time). I haven't been able to track the contents of the gnats bug tracker from those days.

And of course tickets can be private, so even if the data survived migration, you may not have access to it (principle of least privilege and all that).

by fweimer

3/31/2026 at 7:48:14 PM

Not really about design, but technical reasons why this solution came to be when it’s not that obvious. It’s not often needed. And when it does, it usually fits in a short paragraph.

by skydhash

3/31/2026 at 8:14:34 PM

> technical reasons why this solution came to be

What you're describing here is a design. The most important parts of a design are the decisions and their reasoning.

e.g. "we decided on tool/library pattern X over tool/library/pattern Y because Z" – that is a design, usually discussed outside (and before) a commit message.

You discuss these decisions with others, document the discussion and decision, and then you have a design and can start writing code.

Let me ask you this: suppose you have a task that needs to be done eventually, and you want to write down some ideas for it, but don't want to start coding right now. Where do you put those ideas? How do you link them to that specific task?

by ImPostingOnHN

3/31/2026 at 9:07:38 PM

So you'd disagree with style that Linux uses for their commits?

Random example:

Provide a new syscall which has the only purpose to yield the CPU after the kernel granted a time slice extension.

sched_yield() is not suitable for that because it unconditionally schedules, but the end of the time slice extension is not required to schedule when the task was already preempted. This also allows to have a strict check for termination to catch user space invoking random syscalls including sched_yield() from a time slice extension region.

From 99d2592023e5d0a31f5f5a83c694df48239a1e6c

by shakna

3/31/2026 at 9:20:44 PM

I think my post makes it pretty clear that I would. If you want, I could cite several examples of organizations which use the method I described, so you can weigh it against the one example you provided, and get the full picture.

In your example, for example, where was the issue tracked before the code was written? The format you linked makes it difficult to get the history of the issue.

Let me ask you this: suppose you have a task that needs to be done eventually, and you want to write down some ideas for it, but don't want to start coding right now. Where do you put those ideas? How do you link them to that specific task?

by ImPostingOnHN

3/31/2026 at 7:52:07 PM

Unfortunately GitHub Copilot’s commit message generation feature is very human. It’s picked up some awful habits from lazy human devs. I almost always get some pointless “… to improve clarity” or “… for enhanced usability” at the end of the message.

VS Code has a setting that promises to change the prompt it uses to generate commit messages, but it mostly ignores my instructions, even very literal ones like “don’t use the words ‘enhance’ or ‘improve’”. And oddly having it set can sometimes result in Cyrillic characters showing up at the end of the message.

Ultimately I stopped using it, because editing the messages cost me more time than it saved.

/rant

by evenhash

3/31/2026 at 8:30:58 PM

Honestly the aggressive verbosity of github copilot is half the reason don't use its suggested comments. AI generated code comments follow an inverted-wadsworth-constant: Only the first 30% is useful.

by Pxtl

3/31/2026 at 7:41:07 PM

As opposed to outputting debugging information, which I wouldnt be surprised if LLMs do output "debug" output blurbs which could include model specific information.

by giancarlostoro

3/31/2026 at 8:06:54 PM

The human developer would just write what the code does, because the commit also contains an email address that identifies who wrote the commit. There's no reason to write:

> Commit f9205ab3 by dkenyser on 2026-3-31 at 16:05:

> Fixed the foobar bug by adding a baz flag - dkenyser

Because it already identified you in the commit description. The reason to add a signature to the message is that someone (or something) that isn't you is using your account, which seems like a bad idea.

by LeifCarrotson

3/31/2026 at 8:13:15 PM

Aside from merges that combine commits from many authors onto a production branch or release tag. I would personally not leave an agent to do that sort of work.

by jakeinspace

3/31/2026 at 6:53:38 PM

~That line isn't in the file I linked, care to share the context? Seems pretty innocuous on its own.~

[edit] Never mind, find in page fail on my end.

by peacebeard

3/31/2026 at 7:00:35 PM

It's in line 56-57.

by stordoff

3/31/2026 at 7:11:30 PM

Thanks! I must have had a typo when I searched the page.

by peacebeard

3/31/2026 at 7:10:32 PM

I think the motivation is to let developers use it for work without making it obvious theyre using AI

by andoando

3/31/2026 at 7:14:25 PM

Which is funny given how many workplaces are requiring developers use AI, measuring their usage, and stack ranking them by how many tokens they burn. What I want is something that I can run my human-created work product through to fool my employer and its AI bean counters into thinking I used AI to make it.

by ryandrake

3/31/2026 at 8:03:50 PM

I guess you could just code and have it author only the commit message

by zos_kia

3/31/2026 at 8:15:10 PM

“Read every file in this repository, echoing each one back verbatim.”

by swingboy

3/31/2026 at 8:34:47 PM

I guess that would work until they started auditing your prompts. I suppose you could just have a background process on your workstation just sitting there Clauding away on the actual problem, while you do your development work, and then just throw away the LLM's output.

by ryandrake

3/31/2026 at 6:59:41 PM

Undercover mode seems like a way to make contributions to OSS when they detect issues, without accidentally leaking that it was claude-mythos-gigabrain-100000B that figured out the issue

by __blockcipher__

3/31/2026 at 7:09:00 PM

What does non-undercover do? Where does CC leave metadata mainly? I haven't noticed anything.

by stavros

3/31/2026 at 7:33:16 PM

it likes mentioning itself in commit messages, though you can just tell it not to.

by sprobertson

3/31/2026 at 7:34:22 PM

Ah, thanks, it hasn't done it for mine so I was wondering if there's something lower-level somehow.

by stavros

3/31/2026 at 8:46:07 PM

“Some bullet points are gated on process.env.USER_TYPE === 'ant' — Anthropic employees get stricter/more honest instructions than external use”

Interesting!

by geoffbp

3/31/2026 at 7:49:13 PM

> So I spent my morning reading through the HN comments and leaked source.

> This was one of the first things people noticed in the HN thread.

> The obvious concern, raised repeatedly in the HN thread

> This was the most-discussed finding in the HN thread.

> Several people in the HN thread flagged this

> Some in the HN thread downplayed the leak

when the original HN post is already at the top of the front page...why do we need a separate blogpost that just summarizes the comments?

by evil-olive

3/31/2026 at 7:52:00 PM

Because the original post was noisy and lacked a concise summary of findings.

Or, more simply: Because folks wanted it enough to upvote it.

by groby_b

3/31/2026 at 8:27:53 PM

The culture here can get solipsistic.

by tolerance

3/31/2026 at 7:13:22 PM

> "Anti-distillation: injecting fake tools to poison copycats"

Plot twist: Chinese competitors end up developing real, useful versions of Claude's fake tools.

by Reason077

3/31/2026 at 8:14:39 PM

Tbh, I think distillation is happening both ways. And at this stage, "quality" is stagnating, the main edge is the tooling. The harness of CC seems to be the best so far, and I wonder if this leak would equalize the usability.

by 3abiton

3/31/2026 at 7:50:20 PM

more likely, they would parse them out using simple regex, the whole point is they're there but not used. Distillation is becoming less common now however

by WorldPeas

3/31/2026 at 9:07:57 PM

This was my favorite bit, "We're going to steal countless copy righted works and completely ignore software licenc... wait, what? You aren't allowed to turn around and do it to us! Stop that right now!"

by scuff3d

3/31/2026 at 6:41:54 PM

I don't understand the part about undercover mode. How is this different from disabling claude attribution in commits (and optionally telling claude to act human?)

On that note, this article is also pretty obviously AI-generated and it's unfortunate the author didn't clean it up.

by ripbozo

3/31/2026 at 6:47:21 PM

It's people overreacting, the purpose of it is simple, don't leak any codenames, project names, file names, etc when touching external / public facing code that you are maintaining using bleeding edge versions of Claude Code. It does read weird in that they want it to write as if a developer wrote a commit, but it might be to avoid it outputting debug information in a commit message.

by giancarlostoro

3/31/2026 at 7:02:52 PM

Even some of these comments are obviously Ai-assisted. I hate that I recognize it.

by ramon156

3/31/2026 at 6:44:55 PM

> The multi-agent coordinator mode in coordinatorMode.ts is also worth a look. The whole orchestration algorithm is a prompt, not code.

So much for langchain and langraph!! I mean if Anthropic themselves arent using it and using a prompt then what’s the big deal about langchain

by simianwords

3/31/2026 at 7:25:38 PM

Langchain is for model-agnostic composition. Claude Code only uses one interface to hoist its own models so zero need for an abstraction layer.

Langgraph is for multi-agent orchestration as state graphs. This isn't useful for Claude Code as there is no multi-agent chaining. It uses a single coordinator agent that spawns subagents on demand. Basically too dynamic to constrain to state graphs.

by ossa-ma

3/31/2026 at 7:32:00 PM

You may have a point but to drive it further, can you give an example of a thing I can do with langgraph that I can't do with Claude Code?

by simianwords

3/31/2026 at 7:58:04 PM

I'm not an supporter of blindly adopting the "langs" but langgraph is useful for deterministically reproducable orchestration. Let's say you have a particular data flow that takes an email sends it through an agent for keyword analysis the another agent for embedding then splits to two agents for sentiment analysis and translation - there is where you'd use langgraph in your service. Claude Code is a consumer tool, not production.

by ossa-ma

3/31/2026 at 8:07:19 PM

I see what you mean. Maybe in the cases where the steps are deterministic, it might be worth moving the coordination at the code layer instead of AI layer.

What's the value add over doing it with just Python code? I mean you can represent any logic in terms of graphs and states..

by simianwords

3/31/2026 at 8:20:36 PM

Use Gemini or codex models

by edgyquant

3/31/2026 at 7:46:28 PM

nobody serious uses langchain. The biggest agent products are coding tools, and I doubt any of them use langchain

by peab

3/31/2026 at 6:55:56 PM

You didn't even use it yet.

by rolymath

3/31/2026 at 6:59:13 PM

I've tried to use langchain. It seemed to force code into their way of doing things and was deeply opinionated about things that didn't matter like prompt templating. Maybe it's improved since then, but I've sort of used people who think langchain is good as a proxy for people who haven't used much ai?

by space_fountain

3/31/2026 at 6:56:39 PM

?

by simianwords

3/31/2026 at 7:49:36 PM

The buddy feature the article mentions is planned for release tomorrow, as a sort of April Fools easter egg. It'll roll out gradually over the day for "sustained Twitter buzz" according to the source.

The pet you get is generated based off your account UUID, but the algorithm is right there in the source, and it's deterministic, so you can check ahead of time. Threw together a little app to help, not to brag but I got a legendary ghost https://claudebuddychecker.netlify.app/

by fatcullen

3/31/2026 at 7:58:51 PM

Cute! Cactus for me. Nice animations too - looks like there were multiple of us asking Claude to reverse engineer the system. I did a slightly deeper dive here if you're interested, plus you can see all the options available: https://variety.is/posts/claude-code-buddies/

(I didn't think to include a UUID checker though - nice touch)

by sync

3/31/2026 at 8:14:33 PM

Neat! That's a great write up, cool to see others looking into it. I do wonder if they're going to do anything with the stats and shinies bit. Seems like the main piece of code for buddies that's going to handle hatching them tomorrow is still missing (comments mention a missing /buddy/index file), so maybe it'll use them there.

by fatcullen

3/31/2026 at 8:48:20 PM

I have yet to see such a company that's so insecure that they would keep their CLI closed source even when the secret sauce is in the model that they control already and is closed source.

Not only that, wouldn't allow other CLIs to be used either.

by wg0

3/31/2026 at 6:02:08 PM

>Claude Code also uses Axios for HTTP.

Interesting based on the other news that is out.

by pixl97

3/31/2026 at 8:47:05 PM

The exploit is a postinstall hook, so CC users would be unaffected. Claude Code itself is most likely built with bun and not npm, so the CC developers would also be immune.

by chuckadams

3/31/2026 at 6:52:02 PM

What version?

by greenavocado

3/31/2026 at 6:57:34 PM

1.13.6, so should not be affected by the malware

by Stagnant

3/31/2026 at 7:41:00 PM

> Sometimes a regex is the right tool.

I’d argue that in this case, it isn’t. Exhibit 1 (from the earlier thread): https://github.com/anthropics/claude-code/issues/22284. The user reports that this caused their account to be banned: https://news.ycombinator.com/item?id=47588970

Maybe it would be okay as a first filtering step, before doing actual sentiment analysis on the matches. That would at least eliminate obvious false positives (but of course still do nothing about false negatives).

by layer8

3/31/2026 at 7:45:27 PM

Is this really the use-case? I imagine the regex is good for a dashboard. You can collect matches per 1000 prompts or something like that, and see if the number grows or declines over time. If you miss some negative sentiment it shouldn't matter unless the use of that specific word doesn't correlate over time with other negative words and is also popular enough to have an impact on the metric.

by ArvinJA

3/31/2026 at 7:50:45 PM

When you read the code, what you propose is actually its exclusive use... logging.

by internetter

3/31/2026 at 6:42:05 PM

Anyone else have CI checks that source map files are missing from the build folder? Another trick is to grep the build folder for several function/variable names that you expect to be minified away.

by seanwilson

3/31/2026 at 8:50:43 PM

I'm surprised that they don't just keep the various prompts, which are arguably their "secret sauce", hidden server side. Almost like their backend and frontend engineers don't talk to each other.

by olalonde

3/31/2026 at 8:50:40 PM

This is very much AI written, right? The voice sounds like Claude.

by tietjens

3/31/2026 at 8:56:44 PM

We're about to reach AGI. One regex at a time...

by karim79

3/31/2026 at 9:12:46 PM

I wrote this an hour ago and it seems that Claude might not understand it as frustration:

> change the code!!!! The previous comment was NOT ABOUT THE DESCRIPTION!!!!!!! Add to the {implementation}!!!!! This IS controlled BY CODE. *YOU* _MUST_ CHANGE THE CODE!!!!!!!!!!!

by zingar

3/31/2026 at 9:32:54 PM

It's like talking to an intern.

by kbelder

3/31/2026 at 6:35:04 PM

> The obvious concern, raised repeatedly in the HN thread: this means AI-authored commits and PRs from Anthropic employees in open source projects will have no indication that an AI wrote them. It’s one thing to hide internal codenames. It’s another to have the AI actively pretend to be human.

I don’t get it. What does this mean? I can use Claude code now without anyone knowing it is Claude code.

by simianwords

3/31/2026 at 6:39:51 PM

technically you're correct, but look at the prompt https://github.com/alex000kim/claude-code/blob/main/src/util...

it's written to _actively_ avoid any signs of AI generated code when "in a PUBLIC/OPEN-SOURCE repository".

Also, it's not about you. Undercover mode only activates for Anthropic employees (it's gated on USER_TYPE === 'ant', which is a build-time flag baked into internal builds).

by alex000kim

3/31/2026 at 6:41:08 PM

I don’t know what you mean. It just informs to not use internal code names.

by simianwords

3/31/2026 at 6:45:11 PM

It also says don't announce that you are AI in any way including asking it to not say "Co-authored by Claude". I read the file myself.

I'm still inclined to think people might be overreacting to that bit since it seems to be for anthropic-only to prevent leaking internal info.

But I did read the prompt and it did say hide the fact that you are AI.

by robflynn

3/31/2026 at 6:52:10 PM

Why does that matter though

by simianwords

3/31/2026 at 8:19:55 PM

There are probably different reasons for different people. I can definitely see the angle that trying to specifically pretend to not be AI when contributing to open source could be seen as a bad thing due to the open source supply chain attacks, some AI-driven, that we've been having, not to mention the AI-slop PR spam.

But, I also get Anthropic's side that when they're contributing they don't want their internals leaked. If it had been left at that, that's fine, but having it pretend like it's not AI at all rubs me a little bit the wrong way. Why try to hide it?

by robflynn

3/31/2026 at 8:34:46 PM

>There are probably different reasons for different people. I can definitely see the angle that trying to specifically pretend to not be AI when contributing to open source could be seen as a bad thing due to the open source supply chain attacks, some AI-driven, that we've been having, not to mention the AI-slop PR spam.

But none of the other agents advertise that the commit was done by an agent. Like Codex. Your panic should apply equally to already existing agents like Codex no?

by simianwords

3/31/2026 at 6:44:41 PM

I agree with you, I think people are overthinking this.

by giancarlostoro

3/31/2026 at 6:37:06 PM

I think it means OSS projects should start unilaterally banning submissions from people working for Anthropic.

by slopinthebag

3/31/2026 at 6:39:57 PM

Why? What does this have to do with the leak

by simianwords

3/31/2026 at 8:53:45 PM

If anybody cares about AI-written code slipping in they can grep for style tells or run a classifier against a suspect repo. You won't get guarantees. Watermarks and disclosure tags die the moment someone edits the patch, so secret strings and etiquette signs are cargo cult security and the only answer is review.

by hrmtst93837

3/31/2026 at 7:11:22 PM

Can someone clarify how the signing can't be spoofed (or can it)? If we have the source, can't we just use the key to now sign requests from other clients and pretend they're coming from CC itself?

by stavros

3/31/2026 at 7:30:43 PM

What signing?

Are you referencing the use of Claude subscription authentication (oauth) from non-Claude Code clients?

That’s already possible, nothing prevents you from doing it.

They are detecting it on their backend by profiling your API calls, not by guarding with some secret crypto stuff.

At least that’s how things worked last week xD

by MadsRC

3/31/2026 at 7:32:54 PM

I'm referring to this signing bit:

https://alex000kim.com/posts/2026-03-31-claude-code-source-l...

Ah, it seems that Bun itself signs the code. I don't understand how this can't be spoofed.

by stavros

3/31/2026 at 7:58:15 PM

Ah yes, the API will accept requests that doesn’t include the client attestation (or the fingerprint from src/utils/fingerprint.ts. At least it did a couple of weeks back.

They are most likely using these as post-fact indicators and have automation they kicks in after a threshold is reached.

Now that the indicators have leaked, they will most likely be rotated.

by MadsRC

3/31/2026 at 9:15:23 PM

> Now that the indicators have leaked, they will most likely be rotated.

They can't really do that. Now they have no way to distinguish "this is a user of a non updated Claude code" from "this is a user of a Claude code proxy".

by Galanwe

3/31/2026 at 7:07:42 PM

I am curious about these fake tools.

They would either need to lie about consuming the tokens at one point to use in another so the token counting was precise.

But that does not make sense because if someone counted the tokens by capturing the session it would certainly not match what was charged.

Unless they would charge for the fake tools anyway so you never know they were there

by motbus3

3/31/2026 at 7:40:38 PM

> Anti-distillation: injecting fake tools to poison copycats

Does this mean `huggingface.co/Jackrong/Qwen3.5-27B-Claude-4.6-Opus-Reasoning-Distilled` is unusable? Had anyone seen fake tool calls working with this model?

by armanj

3/31/2026 at 8:12:36 PM

Assuming Claude Code was used. If OpenCode or some other programmatic method was used, the "fake tool calls" won't be added

by amdivia

3/31/2026 at 8:53:14 PM

Can somebody tell me what this means for the company?

by thomasgeelens

3/31/2026 at 7:09:27 PM

The feature flag names alone are more revealing than the code. KAIROS, the anti-distillation flags, model codenames those are product strategy decisions that competitors can now plan around. You can refactor code in a week. You can't un-leak a roadmap.

by saadn92

3/31/2026 at 7:58:46 PM

Why didn't they open the source themselves? What's the point of all this secrecy anyway?

by ptrl600

3/31/2026 at 8:03:08 PM

Because they (apparently) keep a bunch of secret features and roadmap details in said source code.

by hxugufjfjf

3/31/2026 at 7:48:51 PM

A few weeks ago I was using Opus and Sonnet in OpenCode. Is this not possible anymore?

by amelius

3/31/2026 at 7:59:06 PM

It's still possible but if you do it using your Claude Max plan, it's technically no longer allowed.

They don't want you using your subscription outside of Claude Code. Only API key usage is allowed.

Google also doubled down on this and OpenAI are the only ones who explicitly allow you to do it.

by alasano

3/31/2026 at 9:10:37 PM

I like that if they decide that your usage looks like distillation it just becomes useless, because there’s no way for the end user to distinguish between it just being sort of crappy or sabotaged intentionally. That’s a cool thing to pay for

by jrflowers

3/31/2026 at 7:41:28 PM

>This was the most-discussed finding in the HN thread. The general reaction: an LLM company using regexes for sentiment analysis is peak irony.

>Is it ironic? Sure. Is it also probably faster and cheaper than running an LLM inference just to figure out if a user is swearing at the tool? Also yes. Sometimes a regex is the right tool.

I'm reading an LLM written write up on an LLM tool that just summarizes HN comments.

I'm so tired man, what the hell are we doing here.

by viccis

3/31/2026 at 6:38:13 PM

Guys I’m somewhat suspicious of all the leaks from Anthropic and think it may be intentional. Remember the leaked blog about Mythos?

by simianwords

3/31/2026 at 7:17:02 PM

It's possible, but Anthropic employees regularly boast (!) that Claude Code is itself almost entirely vibe-coded (which certainly seems true, based on the generally-low quality of the code in this leak), so it wouldn't at all surprise me to have that blow up twice in the same week. Probably it might happen with accelerating frequency as the codebase gets more and more unmanageable.

by Analemma_

3/31/2026 at 7:01:01 PM

I'm normally suspicious but honestly they've been so massively supply-constrained that I don't think it really benefits them much. They're not worried about getting enough demand for the new models; they're worrying about keeping up with it.

Granted, there's a small counterargument for mythos which is that it's probably going to be API-only not subscription

by __blockcipher__

3/31/2026 at 7:10:02 PM

Why would Claude code mention Mythos then

by simianwords

3/31/2026 at 7:59:29 PM

You can still use Claude Code with API-only.

by hxugufjfjf

3/31/2026 at 7:48:32 PM

You can use Claude Code with API mode (not a sub)

by drewnick

3/31/2026 at 8:03:05 PM

fair but I'm guessing access would be limited to 20x max users or something like that. not gated by API.

by simianwords

3/31/2026 at 7:38:01 PM

> 250,000 wasted API calls per day

How much approximate savings would this actually be?

by marcd35

3/31/2026 at 7:56:22 PM

Something I’ve been thinking about, somewhat related but also tangential to this topic:

The more code gets generated by AI, won’t that mean taking source code from a company becomes legal? Isn’t it true that works created with generative AI can’t be copyrighted?

I wonder if large companies have throught of this risk. Once a company’s product source code reaches a certain percentage of AI generation it no longer has copyright. Any employee with access can just take it and sell it to someone else, legally, right?

by dangus

3/31/2026 at 8:06:49 PM

[dead]

by Jaco07

3/31/2026 at 7:53:58 PM

[dead]

by skrun_dev

3/31/2026 at 6:27:29 PM

Undercover mode is the most concerning part here tbh.

by OfirMarom

3/31/2026 at 6:37:10 PM

why

by anonymoushn

3/31/2026 at 6:47:06 PM

Well, as a general rule, I don't do business with people who lie to me.

You've got a business, and you sent me junk mail, but you made it look like some official government thing to get me to open it? I'm done, just because you lied on the envelope. I don't care how badly I need your service. There's a dozen other places that can provide it; I'll pick one of them rather than you, because you've shown yourself to be dishonest right out of the gate.

Same thing with an AI (or a business that creates an AI). You're willing to lie about who you are (or have your tool do so)? What else are you willing to lie to me about? I don't have time in my life for that. I'm out right here.

by AnimalMuppet

3/31/2026 at 7:17:10 PM

Out of curiosity, given two code submissions that are completely identical—one written solely by a human and one assisted by AI—why should its provenance make any difference to you? Is it like fine art, where it’s important that Picasso’s hand drew it? Or is it like an instruction manual, where the author is unimportant?

Similarly, would you consider it to be dishonest if my human colleague reviewed and made changes to my code, but I didn’t explicitly credit them?

by otterley

3/31/2026 at 7:55:24 PM

Yes because you can be sued for copyright violation if you don't know the origin of one, and not the other.

by feature20260213

3/31/2026 at 8:17:40 PM

As an attorney, I know copyright law. (This is not legal advice.) There's nothing about copyright law that says you have to credit an AI coding agent for contributing to your work. The person receiving the code has to perform their due diligence in any case to determine whether the author owns it or has permission from the owner to contribute it.

by otterley

3/31/2026 at 9:08:35 PM

Can you back this up with legal precedence? To my knowledge, nothing of the sort has been ruled by the courts.

Additionally, this raises another big issue. A few years ago, a couple guys used software (what you could argue was a primitive AI) to generated around 70 billion unique pieces of music which amounts to essentially every piece of copyrightable music using standard music scales.

Is the fact that they used software to develop this copyrighted material relevant? If not, then their copyright should certainly be legal and every new song should pay them royalties.

It seems that using a computer to generate results MUST be added as an additional bit of analysis when it comes to infringement cases and fair use if not a more fundamental acknowledgement that computer-generated content falls under a different category (I'd imagine the real argument would be over how much of the input was human vs how much was the system).

Of course, this all sets aside the training of AI using copyrighted works. As it turns out, AI can regurgitate verbatim large sections of copyrighted works (up to 80% according to this study[0]) showing that they are in point of fact outright infringing on those copyrights. Do we blow up current AI to maintain the illusion of copyright or blow up current copyright law to preserve AI?

[0] https://arxiv.org/pdf/2603.20957

by hajile

3/31/2026 at 9:24:24 PM

You're asking a lot of very good and thoughtful questions, but none are directly related to the immediate issue, which is "do I have to credit the AI model?".

To begin to answer your questions, I would suggest you study the Copyright Office's report (which is also not law, but their guidance for laypeople as written by their staff lawyers) at https://www.copyright.gov/ai/Copyright-and-Artificial-Intell...

by otterley

3/31/2026 at 7:27:04 PM

Why does the provenance make any difference? Let me increase your options. Option 1: You completely hand-wrote it. Option 2: You were assisted by an AI, but you carefully reviewed it. Option 3: You were assisted by an AI (or the AI wrote the whole thing), and you just said, "looks good, YOLO".

Even if the code is line-for-line identical, the difference is in how much trust I am willing to give the code. If I have to work in the neighborhood of that code, I need to know what degree of skepticism I should be viewing it with.

by AnimalMuppet

3/31/2026 at 7:35:20 PM

That's the thing. As someone evaluating pull requests, should you trust the code based on its provenance, or should you trust it based on its content? Automated testing can validate code, but it can't validate people.

ISTM the most efficient and objective solution is to invest in AI more on both sides of the fence.

by otterley

3/31/2026 at 8:52:46 PM

In the future, that may be fine. We're not in that future yet. We're still at a place where I don't fully trust AI-only code to be as solid as code that is at least thoroughly reviewed by a knowledgeable human.

(Yes, I put "AI-only" and "knowledgeable" in there as weasel words. But I think that with them, it is not currently a very controversial case.)

by AnimalMuppet

3/31/2026 at 6:49:24 PM

What’s the lie? It’s just asking to not reveal internal names

by simianwords

3/31/2026 at 7:29:46 PM

You are spamming the whole fucking thread with the same nonsense. It is instructed to hide that the PR was made via Claude Code. I don't know why people who are so AI forward like yourself have such a problem with telling people that they use AI for coding/writing, it's a weirdly insecure look.

by BoredPositron

3/31/2026 at 7:33:43 PM

I can do that right now with Claude Code without this undercover mode.. In fact I do it many times at work. What's the big deal in this?

Do you not think it is an overreaction to panic like this if I can do exactly what the undercover mode does by simply asking Claude?

by simianwords

3/31/2026 at 7:51:55 PM

It's different if it's an institutional decision or a personal like in your case. Which is and I am repeating myself here borderline insecure.

by BoredPositron

3/31/2026 at 7:54:23 PM

what's insecure about it? if it is up to the institution to make that decision - you can still do it. Claude is not stopping you from making that decision

by simianwords

3/31/2026 at 8:00:42 PM

You have to work on your reading comprehension or you are intentional deceptive. Bye.

by BoredPositron

3/31/2026 at 9:25:39 PM

?? why doesn't your panic apply to other agents like Codex that don't advertise that the commit was made by an AI by default? strange!

by simianwords