Anthropic spends a month

Anthropic has built its public identity around the good idea of ​​being a prudent AI company. The company has published detailed research on AI risks, hired some of the best researchers in the field, and been vocal about the responsibility that comes with building such powerful technology. Of course, it’s so vocal that it’s currently in contention with the Department of Defense. Unfortunately, on Tuesday, someone forgot to check the box.

What’s noteworthy is that this is the second time this has happened in the past week. Last Thursday, Fortune reported that Anthropic accidentally released nearly 3,000 internal files, including a draft blog post describing a powerful new model that the company had not yet announced.

Here’s what happened on Tuesday. When Anthropic released version 2.1.88 of its Claude Code software package, it inadvertently included files that exposed nearly 2,000 source code files and over 512,000 lines of code (i.e., a complete architectural blueprint for one of its most important products). A security researcher named Chaofan Shou noticed this almost immediately and posted it on X. Anthropic’s statements to multiple news outlets were rather nonchalant in light of all this: “This is an issue with the release package caused by human error, and is not a security breach.” (I’m guessing things weren’t as well-received internally.)

Claude Code is not a minor product. It’s a command-line tool that lets developers write and edit code using Anthropic’s AI, making it powerful enough to make rivals nervous. OpenAI has discontinued its video generation product Sora after just six months of public availability, in part in response to Claude Code’s growing momentum and to refocus on developers and enterprises, according to WSJ.

What was leaked was not the AI ​​model itself, but the software scaffolding around it: the instructions that told the model how to behave, what tools to use, and what its limits were. Developers quickly began publishing detailed analysis, with one developer describing the product as “a production-grade developer experience, not just a wrapper around an API.”

Whether this turns out to be important in any lasting sense is a question best left to the developers. Competitors may find this architecture beneficial. At the same time, the field moves quickly.

Either way, I can imagine that somewhere in Anthropic, one extremely talented engineer is quietly spending the rest of his days wondering if he still has a job. I just hope it’s not the same engineer or engineering team as late last week.