From the directory listing having a cost-tracker.ts, upstreamproxy, coordinator, buddy and a full vim directory, it doesn&#x27;t look like just an API client to me.

Doesn&#x27;t look like just a thin wrapper to me. The interesting part seems to be the surrounding harness&#x2F;workflow layer rather than only the model call itself.I was trying to keep track of the better post-leak code-analysis links on exactly this question, so I collected them here:
<a href="https:&#x2F;&#x2F;github.com&#x2F;nblintao&#x2F;awesome-claude-code-postleak-insights" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;nblintao&#x2F;awesome-claude-code-postleak-ins...</a>

Are there any interesting&#x2F;uniq features present in it that are not in the alternatives? My understanding is that its just a client for the powerful llm

No, it was never open source. You could always reverse engineer the cli app but you didn&#x27;t have access to the source.

You may have mistaken it with Codex<a href="https:&#x2F;&#x2F;github.com&#x2F;openai&#x2F;codex" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;openai&#x2F;codex</a>

&gt; its not even source availableIt _wasn&#x27;t_ even source available.

&gt; Isn&#x27;t it open source?No, its not even source available,.&gt; Or is there an open source front-end and a closed backend?No, its all proprietary. None of it is open source.

Wow it&#x27;s true. Anthropic actually had me fooled. I saw the GitHub repository and just assumed it was open source. Didn&#x27;t look at the actual files too closely. There&#x27;s pretty much nothing there.So glad I took the time to firejail this thing before running it.

The Github repo is only for issue tracker

Isn&#x27;t it open source?Or is there an open source front-end and a closed backend?

So close to April Fool&#x27;s too. I&#x27;m sure it will still be a surprise for a majority of their users.

lol that&#x27;s funny, I have been working seriously [1] on a feature like this after first writing about it jokingly [2] earlier this year.The joke was the assistant is a cat who is constantly sabotaging you, and you have to take care of it like a gacha pet.The seriousness though is that actually, disembodied intelligences are weird, so giving them a face and a body and emotions is a natural thing, and we already see that with various AI mascots and characters coming into existence.[1]: serious: <a href="https:&#x2F;&#x2F;github.com&#x2F;mech-lang&#x2F;mech&#x2F;releases&#x2F;tag&#x2F;v0.3.1-beta" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;mech-lang&#x2F;mech&#x2F;releases&#x2F;tag&#x2F;v0.3.1-beta</a>[2]: joke: <a href="https:&#x2F;&#x2F;github.com&#x2F;cmontella&#x2F;purrtran" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;cmontella&#x2F;purrtran</a>

(spoiler alert)Buddy system is this year&#x27;s April Fool&#x27;s joke, you roll your own gacha pet that you get to keep. There are legendary pulls.They expect it to go viral on Twitter so they are staggering the reveals.

Not necessarily; I would very much like to use those features on a Linux server. Currently the Anthropic implementation forces a desktop (or worse, a laptop) to be turned on instead of working headless as far as I understand it.I’ll give clappie a go, love the theme for the landing page!

Clappie looks much more fabulous than CC though. I&#x27;ll have to give it a try. I like how you put the requests straight into an already running CC session instead of calling `claude -p` every time like the claws.

Dispatch and scheduled tasks have been available for a few weeks already, although with limitations.

I didn&#x27;t know this existed. I had claude put this together for me from scratch a week ago. Tmux and claude and telegram is a really powerful combo!

If this true. My old personal agent Claude Code setup I open sourced last month will finally be obsolete (1 month lol):<a href="https:&#x2F;&#x2F;clappie.ai" rel="nofollow">https:&#x2F;&#x2F;clappie.ai</a>- Telegram Integration =&gt; CC Dispatch- Crons =&gt; CC Tasks- Animated ASCII Dog =&gt; CC Buddy

all these flags are findable by pointing claude at the binary and asking it to find festure flags.

People already can look at the source without this leak. People have had hacked builds force enabling feature flags for a long time.

one of those is adorable and the other one is unethical

This seems like a good way to weed out models: ask them to include the term capybara in their commit messages

At least this was known with the Mythos &quot;early blog post&quot; fiasco.

Note also the &quot;Claude Capybara&quot; reference in the undercover prompt: <a href="https:&#x2F;&#x2F;github.com&#x2F;chatgptprojects&#x2F;claude-code&#x2F;blob&#x2F;642c7f944bbe5f7e57c05d756ab7fa7c9c5035cc&#x2F;src&#x2F;utils&#x2F;undercover.ts#L39" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;chatgptprojects&#x2F;claude-code&#x2F;blob&#x2F;642c7f94...</a>

Is there an AGI mode FF? Asking for a friend…

The big loss for Anthropic here is how it reveals their product roadmap via feature flags. A big one is their unreleased &quot;assistant mode&quot; with code name kairos.Just point your agent at this codebase and ask it to find things and you&#x27;ll find a whole treasure trove of info.Edit: some other interesting unreleased&#x2F;hidden features- The Buddy System: Tamagotchi-style companion creature system with ASCII art sprites- Undercover mode: Strips ALL Anthropic internal info from commits&#x2F;PRs for employees on open source contributions

the &quot;useCanUseTool.tsx&quot; hook, is definitely something I would hate seeing in any code base I come across.It&#x27;s extremely nested, it&#x27;s basically an if statement soup`useTypeahead.tsx` is even worse, extremely nested, a ton of &quot;if else&quot; statements, I doubt you&#x27;d look at it and think this is sane code

<pre><code> 1. Randomly peeking at process.argv and process.env all around. Other weird layering violations, too.
 2. Tons of repeat code, eg. multiple ad-hoc implementations of hash functions &#x2F; PRNGs.
 3. Almost no high-level comments about structure - I assume all that lives in some CLAUDE.md instead.</code></pre>

have a look at src&#x2F;bootstrap&#x2F;state.ts :D

Can you give an example? Looks fairly decent to me

Nothing a couple &#x2F;simplify&#x27;s can&#x27;t take care of.

Team has been extremely open how it has been vibe coded from day 1. Given the insane amount of releases, I don’t think it would be possible without it.

Honestly when using it, it feels vibe coded to the bone, together with the matching weird UI footgun quirks

This is the dumbest take there is about vibe coding. Claiming that managing complexity in a codebase doesn&#x27;t matter anymore. I can&#x27;t imagine that a competent engineer would come to the conclusion that managing complexity doesn&#x27;t matter anymore. There is actually some evidence that coding agents struggle the same way humans do as the complexity of the system increases [0].[0] <a href="https:&#x2F;&#x2F;arxiv.org&#x2F;abs&#x2F;2603.24755" rel="nofollow">https:&#x2F;&#x2F;arxiv.org&#x2F;abs&#x2F;2603.24755</a>

It may be economically effective but such heartless, buggy software is a drain to use. I care about that delta, and yes this can be extrapolated to other industries.

Do compilers care about their assembly generated code to look good? We will soon reach that state with all the production code. LLMs will be the compiler and actual today&#x27;s human code will be replaced by LLM generated assembly code, kinda sorta human readable.

&gt;Two things that matter at this day and age.That&#x27;s all that has mattered in every day and age.

It really doesn’t matter anymore. I’m saying this as a person who used to care about it. It does what it’s generally supposed to do, it has users. Two things that matter at this day and age.

Code quality no longer carries the same weight as it did pre LLMs. It used to matter becuase humans were the ones reading&#x2F;writing it so you had to optimize for readability and maintainability. But these days what matters is the AI can work with it and you can reliably test it. Obviously you don’t want code quality to go totally down the drain, but there is a fine balance.Optimize for consistency and a well thought out architecture, but let the gnarly looking function remain a gnarly function until it breaks and has to be refactored. Treat the functions as black boxes.Personally the only time I open my IDE to look at code, it’s because I’m looking at something mission critical or very nuanced. For the remainder I trust my agent to deliver acceptable results.

It&#x27;s impressive how fast vibe coders seem to flip-flop between &quot;AI can write better code than you, there&#x27;s no reason to write code yourself anymore; if you do, you&#x27;re stuck in the past&quot; and &quot;AI writes bad code but I don&#x27;t care about quality and neither should you; if you care, you&#x27;re stuck in the past&quot;.I hope this leak can at least help silence the former. If you&#x27;re going to flood the world with slop, at least own up to it.

It&#x27;d dogfooding the entire concept of vibe coding and honestly, that is a good thing.  Obviously they care about that stuff, but if your ethos is &quot;always vibe code&quot; then a lot of the fixes to it become model &amp; prompting changes to get the thing to act like a better coder &#x2F; agent &#x2F; sysadmin &#x2F; whatever.

The code looks, at a glance, as bad as you expect.

&gt; The source code of the slot machine is not relevant to the casino manager.Famously code leaks&#x2F;reverse engineering attempts of slot machines matter enormously to casino managers[0] -<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Ronald_Dale_Harris#:~:text=Ronald%20Dale%20Harris,coins%20were%20inserted." rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Ronald_Dale_Harris#:~:text=Ron...</a>[1] - <a href="https:&#x2F;&#x2F;cybernews.com&#x2F;news&#x2F;software-glitch-loses-casino-millions&#x2F;#:~:text=An%20Australian%20casino,slot%20machine%20earnings." rel="nofollow">https:&#x2F;&#x2F;cybernews.com&#x2F;news&#x2F;software-glitch-loses-casino-mill...</a>[2] - <a href="https:&#x2F;&#x2F;sccgmanagement.com&#x2F;sccg-news&#x2F;2025&#x2F;9&#x2F;24&#x2F;superbet-pays-e30-million-to-romanian-players-following-slot-glitch&#x2F;#:~:text=The%20company%E2%80%99s%20decision,Wizard%20slot%20game." rel="nofollow">https:&#x2F;&#x2F;sccgmanagement.com&#x2F;sccg-news&#x2F;2025&#x2F;9&#x2F;24&#x2F;superbet-pays...</a>

That’s not a good analogy, in a casino you don’t own the slot machine, in this case you download the client side code to your machine

Is this significant?Copilot on OAI reveals everything meaningful about its functionality if you use a custom model config via the API. All you need to do is inspect the logs to see the prompts they&#x27;re using. So far no one seems to care about this &quot;loophole&quot;. Presumably, because the only thing that matters is for you to consume as many tokens per unit time as possible.The source code of the slot machine is not relevant to the casino manager. He only cares that the customer is using it.

Very easily these days, even if minified is difficult for me to reverse engineer... Claude has a very easy time of finding exactly what to patch to fix something

&gt; It exposes all your frontend source code for everyoneI hope it&#x27;s a common knowledge that _any_ client side JavaScript is exposed to everyone. Perhaps minimized, but still easily reverse-engineerable.

LoL! <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=30337690">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=30337690</a>Not exactly this, but close.

You&#x27;d be playing cat and mouse like yt-dlp, but there&#x27;s probably more value to this code than just a temporary way to milk claude subscriptions.

Just use one of the distilled claude clones instead 
<a href="https:&#x2F;&#x2F;x.com&#x2F;0xsero&#x2F;status&#x2F;2038021723719688266?s=46" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;0xsero&#x2F;status&#x2F;2038021723719688266?s=46</a>

The problem is the oauth and their stance on bypassing that. You&#x27;d want to use your subscription, and they probably can detect that and ban users. They hold all the power there.

I love the irony on seeing the contribution counter at 0Who&#x27;d have thought, the audience who doesn&#x27;t want to give back to the opensource community, giving 0 contributions...

It is a real product. They take real payments and deliver on whats promised.
Not sure if its an attempt to subvert criticism by using satirical language, or if they truly have so little respect for the open source community.

Yeah... look again.<a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=6godSEVvcmU" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=6godSEVvcmU</a>

Oh god, I was so close to believing Malus was a real product and not satire.

They accept real money though.<a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=6godSEVvcmU" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=6godSEVvcmU</a>

First time I hear about this, it&#x27;s interesting to have written all of this out.Now this makes me think of game decompilation projects, which would seem to fall in the same legal area as code that would be generated by something like Malus.Different code, same end result (binary or api).We definitely need to know what the legal limits are and should be

It&#x27;s not a parody when they accept money and deliver the service.

Malus is not a real project btw, it&#x27;s a parody:“Let&#x27;s end open source together with this one simple trick”<a href="https:&#x2F;&#x2F;pretalx.fosdem.org&#x2F;fosdem-2026&#x2F;talk&#x2F;SUVS7G&#x2F;feedback&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pretalx.fosdem.org&#x2F;fosdem-2026&#x2F;talk&#x2F;SUVS7G&#x2F;feedback&#x2F;</a>Malus is translating code into text, and from text back into code.It gives the illusion of clean room implementation that some companies abuse.The irony is that ChatGPT&#x2F;Claude answers are all actually directly derived from open-source code, so...

What are they worried about? Someone taking the company&#x27;s job? Hehe

This has happened before. It was called anon kode.

Eh, the value is the unlimited Max plan which they have rightfully banned from third-party use.People simply want Opus without fear of billing nightmare.That’s like 99% of it.

What about trade secrets, breach of contract, etc, etc?

No real reason to do that, they say Claude Code is written by Claude, which means it has no copyright. Just use the code directly

Maybe <a href="https:&#x2F;&#x2F;github.com&#x2F;instructkr&#x2F;claw-code" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;instructkr&#x2F;claw-code</a>

Malus is a homophone of &quot;malice.&quot; But then again &quot;Claude&quot; is a homophone of &quot;clod.&quot;

Would be interesting to run this through Malus [1] or literally just Claude Code and get open source Claude Code out of it.I jest, but in a world where these models have been trained on gigatons of open source I don&#x27;t even see the moral problem. IANAL, don&#x27;t actually do this.<a href="https:&#x2F;&#x2F;malus.sh&#x2F;" rel="nofollow">https:&#x2F;&#x2F;malus.sh&#x2F;</a>

Not really, except that they have a bunch of weird things in the source code and people like to make fun of it. OpenCode&#x2F;Codex generally doesn&#x27;t have this since these are open-source projects from the get go.(I work on OpenCode)

Is there anything special here vs. OpenCode or Codex?There were&#x2F;are a lot of discussions on how the harness can affect the output.

<a href="https:&#x2F;&#x2F;xcancel.com&#x2F;Fried_rice&#x2F;status&#x2F;2038894956459290963" rel="nofollow">https:&#x2F;&#x2F;xcancel.com&#x2F;Fried_rice&#x2F;status&#x2F;2038894956459290963</a>

won&#x27;t they just try to dmca or take these down especially if they&#x27;re more popular

Popular, yes... but have you seen the issues? SOMETHING is going on in that repo: <a href="https:&#x2F;&#x2F;github.com&#x2F;instructkr&#x2F;claude-code&#x2F;issues" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;instructkr&#x2F;claude-code&#x2F;issues</a>

I don&#x27;t understand how you can have a &#x27;clean-room port.&#x27; Seems contradictory to me.

What do stars mean in the context of random github accounts mirroring leaked source code?

<a href="https:&#x2F;&#x2F;github.com&#x2F;instructkr&#x2F;claude-code" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;instructkr&#x2F;claude-code</a>this one has more stars and more popular

Source here <a href="https:&#x2F;&#x2F;github.com&#x2F;chatgptprojects&#x2F;claude-code&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;chatgptprojects&#x2F;claude-code&#x2F;</a>

Your favorite LLM is great at building a super buggy renderer, so that&#x27;s no longer a moat

Gemini-cli is much worse in my experience but I agree

Well, Claude does boast an absolutely cursed (and very buggy) React-based TUI renderer that I think the others lack! What if someone steals it and builds their own buggy TUI app?

Codex and gemini cli are open source already. And plenty of other agents. I don&#x27;t think there is any moat in claude code source.

I believe GitHub can and does suspend accounts that use such proxies.

does this not work? <a href="https:&#x2F;&#x2F;www.mintlify.com&#x2F;samarth777&#x2F;claude-code-copilot&#x2F;introduction">https:&#x2F;&#x2F;www.mintlify.com&#x2F;samarth777&#x2F;claude-code-copilot&#x2F;intr...</a>

I am waiting now for someone to make it work with a Copilot Pro subscription.

And while they are at it, open source Opus and Sonet. :)

I guess it&#x27;s time for Anthropic to open source Claude Code.

You are not allowed to use the assistance of Claude to manufacture hacks and bombs on your computer

Well, the thing is, I do not just use my computer, but connect to their computers and I do not like to get banned. I suppose simple UI things like expanding source files won&#x27;t change a thing, but the more interesting things, editing the context etc. do have that risk, but no idea if they look for it or enforce it. Their side is, if I want to have full control, I need to use the API directly(way more expensive) and what I want to do is basically circumventing it.

I think that you do not need to feel uneasy at all. It is your computer and your memory space that the data is stored and operating in you can do whatever you like to the bits in that space. I would encourage you to continue that experiment.

The first trick will be avoiding getting flagged for running an unofficial build.

The trick isn&#x27;t to patch it once, but to create a system that can reproduce your patches against each release as they come in.  Then, when code changes make fixes non-trivial calling in a headless session to heal your fixes.

Neat. Coincidently recently I asked Claude about Claude CLI, if it is possible to patch some annoying things (like not being able to expand Ctrl + O more than once, so never be able to see some lines and in general have more control over the context) and it happily proclaimed it is open source and it can do it ... and started doing something. Then I checked a bit and saw, nope, not open source. And by the wording of the TOS, it might brake some sources. But claude said, &quot;no worries&quot;, it only break the TOS technically. So by saving that conversation I would have some defense if I would start messing with it, but felt a bit uneasy and stopped the experiment. Also claude came into a loop, but if I would point it at this, it might work I suppose.

Responsibility goes upwards.Why weren&#x27;t proper checks in place in the first place?Bonus: why didn&#x27;t they setup their own AI-assisted tools to harness the release checks?

Ha. I&#x27;m surprised it&#x27;s not a CI job

<pre><code> the poor guy
</code></pre>
Do you mean the LLM?

I wonder what will happen with the poor guy who forgot to delete the code...

Yes, I also doubt it&#x27;ll ever happen considering how hard Anthropic went after Clawdbot to force its renaming.

I have a feeling this is like llama.Original llama models leaked from meta. Instead of fighting it they decided to publish them officially. Real boost to the OS&#x2F;OW models movement, they have been leading it for a while after that.It would be interesting to see that same thing with CC, but I doubt it&#x27;ll ever happen.

I hope everyone provides excellent feedback so they improve Claude Code.

is that the reason why Anthropic acquired Bun, a javascript tooling company?

He commented here about it (sort of)<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21934336">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21934336</a>Thanks hackernewsbooks for sending me that!

Original author of Claude Code is expert on TypeScript [1][1] <a href="https:&#x2F;&#x2F;www.amazon.com&#x2F;Programming-TypeScript-Making-JavaScript-Applications&#x2F;dp&#x2F;1492037656" rel="nofollow">https:&#x2F;&#x2F;www.amazon.com&#x2F;Programming-TypeScript-Making-JavaScr...</a>

It&#x27;s not a desktop tool, it&#x27;s a CLI tool.But a lot of desktop tools are written in JS because it&#x27;s easy to create multi-platform applications.

Because it&#x27;s the most popular programming language in the world?

I am happy you woke up from your 10 year coma.

This is a common take but language servers bridge the gap well.Language servers, however, are a pain on Claude code. <a href="https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;claude-code&#x2F;issues&#x2F;15619" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;claude-code&#x2F;issues&#x2F;15619</a>

Would have believed you if you have said that a day later.

LLMs are good in JS and Python which means everything from now on will be written in or ported to either of those two languages.
So yeah, JS is the future of all software.

Anthropic acquired bun last year <a href="https:&#x2F;&#x2F;bun.com&#x2F;blog&#x2F;bun-joins-anthropic" rel="nofollow">https:&#x2F;&#x2F;bun.com&#x2F;blog&#x2F;bun-joins-anthropic</a>

Why is Claude Code, a desktop tool, written in JS? Is the future of all software JS or Typescript?

The source is linked to in this thread. Is that not the source code?

The only exciting leak would be the Opus weights themselves.

If it was included unintentionally, then it&#x27;s a leak.

Can we stop referring to source maps as leaks? It was packaged in a way that wasn’t even obfuscated. Same as websites - it’s not a “leak” that you can read or inspect the source code.

They stole everything and now they want to close the gates behind them.&quot;I got the loot, Steve!&quot;I feel like the distillation stuff will end up in court if they try to sue an American company about it. We&#x27;ll see what a judge says.

That isn&#x27;t irony, it&#x27;s hypocrisy.

I would say not all that ironic. Book publishers, Reddit, Stackoverflow, etc., tried their best to attract customers while not letting others steal their work. Now Anthropic is doing the same.Unfortunately (for the publishers, at least) it didn&#x27;t work to stop Anthropic and Anthropic&#x27;s attempts to prevent others will not work either; there has been much distillation already.The problem of letting humans read your work but not bots is just impossible to solve perfectly. The more you restrict bots, the more you end up restricting humans, and those humans will go use a competitor when they become pissed off.

It is absolutely not paranoia. People are distilling Claude code all the time.

It&#x27;s not really paranoia if it&#x27;s happening a lot. They wrote a blog post calling several major Chinese AI companies out for distillation.[0] Perhaps it is ironic, but it&#x27;s within their rights to protect their business, like how they prohibit using Claude Code to make your own Claude Code.[1][0]: <a href="https:&#x2F;&#x2F;www.anthropic.com&#x2F;news&#x2F;detecting-and-preventing-distillation-attacks" rel="nofollow">https:&#x2F;&#x2F;www.anthropic.com&#x2F;news&#x2F;detecting-and-preventing-dist...</a>
[1]: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=46578701">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=46578701</a>

Paranoia. And also ironic considering their base LLM is a distillation of the web and books etc etc.

Why would this be in the client code though?

Not sure, and not completely convinced of the explanation, but the way this sticks out so obviously makes it look like a honeypot to me.

Haven’t looked at the code, but is the server providing the client with a system prompt that it can use, which would contain fake tool definitions when this is enabled? What enables it? And why is the client still functional when it’s giving the server back a system prompt with fake tool definitions? Is the LLM trained to ignore those definitions?Wonder if they’re also poisoning Sonnet or Opus directly generating simulated agentic conversations.

It made me raise my eyebrows when everyone was rushing to jump to Claude because OpenAI agreed to work with the DoW. Both companies are just as shitty as each other and will resort to underhanded tactics to stay on top.Go China to be honest. They&#x27;re the most committed to open AI research and they have more interesting constraints to work under, like restricted access to NVIDIA hardware.

I like these guys less every day. The rate limits are so low they are close to not even useful as a provider.

I was thinking just yesterday that the research that Anthropic was sharing regarding how it&#x27;s easy to poison training was unlikely to be conducted out of goodness of the heart.

It looks like it worked, fwiw.The qwen 27b model distilled on Opus 4.6 has some known issues with tool use specifically: <a href="https:&#x2F;&#x2F;x.com&#x2F;KyleHessling1&#x2F;status&#x2F;2038695344339611783" rel="nofollow">https:&#x2F;&#x2F;x.com&#x2F;KyleHessling1&#x2F;status&#x2F;2038695344339611783</a>Fascinating.

This made me think of something - at work, if we wfh, we have to use one of those MITM proxies that intercept HTTPS at the kernel level. Imo such a thing can easily read the traffic and thus is indistinguishable from a distillation attempt from CC&#x27;s PoV. I&#x27;ve had CC freak out on my machine, and sometimes generate pretty bad results, the CoT is often also not available.I wonder it CC thinks I&#x27;m trying to distill the model. This is a common enough use case that I think the devs at Anthropic should consider.

Good explanation here <a href="https:&#x2F;&#x2F;alex000kim.com&#x2F;posts&#x2F;2026-03-31-claude-code-source-leak&#x2F;" rel="nofollow">https:&#x2F;&#x2F;alex000kim.com&#x2F;posts&#x2F;2026-03-31-claude-code-source-l...</a> its a server side flag set by the distillation detection, shouldn&#x27;t affect most user&#x27;s sessions. I don&#x27;t think?

It is a RCE, if what’s being injected is an executable and malicious tool

<pre><code> ANTI_DISTILLATION_CC
 
 This is Anthropic&#x27;s anti-distillation defence baked into Claude Code. When enabled, it injects anti_distillation: [&#x27;fake_tools&#x27;] into every API request, which causes the server to silently slip decoy tool definitions into the model&#x27;s system prompt. The goal: if someone is scraping Claude Code&#x27;s API traffic to train a competing model, the poisoned training data makes that distillation attempt less useful.</code></pre>

I think pi has stolen the top honors, but people consider the Claude code harness very good (at least, better than Cursor)

What&#x27;s special about Claude Code? Isn&#x27;t Opus the real magic?Surely there&#x27;s nothing here of value compared to the weights except for UX and orchestration?Couldn&#x27;t this have just been decompiled anyhow?

Once the USA wakes up, this will be insane news

i wish that&#x27;s for their logging&#x2F;alert. i definitely gauge model&#x27;s performance by how much those words i type when i&#x27;m frustrated in driving claude code.

If anyone at anthropic is reading this and wants more logs from me add jfc.

They&#x27;re searching for multiple substrings in a single pass, regexes are the optimal solution for that.

Because they want it to be executed quickly and cheaply without blocking the workflow? Doesn’t seem very weird to me at all.

what you are suggesting would be like a truck company using trucks to move things within the truck

Good to have more than a hammer in your toolbox!

I used regexes in a similar way but my implementation was vibecoded, hmmm, using your analysis Claude Code writes code by hand.

Because they actually want it to work 100% of the time and cost nothing.

hmm not a terrible idea (I think).You have a semi expensive process. But you want to keep particular known context out. So a quick and dirty search just in front of the expensive process. So instead of &#x27;figure sentiment (20seconds)&#x27;. You have &#x27;quick check sentiment (&lt;1sec)&#x27; then do the &#x27;figure sentiment v2 (5seconds)&#x27;. Now if it is just pure regex then your analogy would hold up just fine.I could see me totally making a design choice like that.

They had the problem of sentiment analysis. They use regexes.You know the drill.

because impact of WTF might be lost in the result of the analysis if you solely rely on LLM.parsing WTF with regex also signifies the impact and reduces the noise in metrics&quot;determinism &gt; non-determinism&quot; when you are analysing the sentiment, why not make some things more deterministic.Cool thing about this solution, is that you can evaluate LLM sentiment accuracy against regex based approach and analyse discrepancies

Using regex with LLMs isn&#x27;t uncommon at all.

Well, regex doesn&#x27;t hallucinate....right?

More like a car company transporting their shipments by truck. It&#x27;s more efficient

Using some ML to derive a sentiment regex seems like a good actually?

Because they are engineers?
The difference between an engineer and a hobbyist is an engineer has to optimize the cost.As they say: any idiot can build a bridge that stands, only an engineer can build a bridge that barely stands.

Not everything done by claude-code is decided by LLM. They need the wrapper to be deterministic (or one-time generated) code?

This just proves its vibe coded because LLMs love writing solutions like that. I probably have a hundred examples just like it in my history.

Asking a non deterministic software to act like a deterministic one (regex) can be a significantly higher use of tokens&#x2F;compute for no benefit.Some things will be much better with inference, others won’t be.

The amount of trust and safety work that depends on google translate and the humble regex, beggars the imagination.

The difference in response time - especially versus a regex running locally - is really difficult to express to someone who hasn&#x27;t made much use of LLM calls in their natural language projects.Someone said 10,000x slower, but that&#x27;s off - in my experience - by about four orders of magnitude. And that&#x27;s average, it gets much worse.Now personally I would have maybe made a call through a &quot;traditional&quot; ML widget (scikit, numpy, spaCy, fastText, sentence-transformer, etc) but - for me anyway - that whole entire stack is Python. Transpiling all that to TS might be a maintenance burden I don&#x27;t particularly feel like taking on. And on client facing code I&#x27;m not really sure it&#x27;s even possible.

It&#x27;s almost as if LLMs are unreliable

&gt; That&#x27;s like a truck company using horses to transport parts. Weird choice.Easy way to claim more “horse power.”

Don’t worry, they used an llm to generate the regex.

it&#x27;s like a faster than light spaceship company using horses. There&#x27;s been infinite solutions to do this better even CPU only for years lol.

Oh it’s worse than that. This one ended up getting my account banned: <a href="https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;claude-code&#x2F;issues&#x2F;22284" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;anthropics&#x2F;claude-code&#x2F;issues&#x2F;22284</a>

Cloud hosted call centers using LLMs is one of my specialties.  While I use an LLM for more nuanced sentiment analysis, I definitely use a list of keywords as a first level filter.

LLMs cost money, regular expressions are free. It really isn&#x27;t so strange.

A lot if things dont make sense until you involve scale. Regex could be good enough do give a general gist.

It&#x27;s more like a truck company using people to transport some parts. 
I could be wrong here, but I bet this happens in Volvo&#x27;s fabrics a lot.

It&#x27;s more like workers on a large oil tanker using bicycles to move around it, rather than trying to use another oil tanker.

As far as I can tell they do nothing with it. They just log it.

LLMs are good at writing complex regex, from my experience

An LLM company using regexes for sentiment analysis? That&#x27;s like a truck company using horses to transport parts. Weird choice.

Glad abusing words in my list are not in that. but its surprising that they use regex for sentiments.

WTF per minute strongly correlates to an increased token spending.It may be decided at Anthropic at some moment to increase wtf&#x2F;min metric, not decrease.

I don&#x27;t know about avoided, this kind of represents the WTF per minute code quality measurement. When I write WTF as a response to Claude, I would actually love if an Antrhopic engineer would take a look at what mess Claude has created.

It&#x27;s actually pretty common for old sysadmin code too..You could always tell when a sysadmin started hacking up some software by the if-else nesting chains.

Nah, it&#x27;s a hallmark of your average codebase in pre-LLM era.

Ridiculous string comparisons on long chains of logic are a hallmark of vibe-coding.

I guess using French words is safe for now.

There is no „stupid” I often write „(this is stupid|are you stupid) fix this”.And Claude was having in chain of though „user is frustrated” and I wrote to it I am not frustrated just testing prompt optimization where acting like one is frustrated should yield better results.

everyone here is commenting how odd it looks to use a regexp for sentiment analysis, but it depends what they&#x27;re trying to do.It could be used as a feedback when they do A&#x2F;B test and they can compare which version of the model is getting more insult than the other. It doesn&#x27;t matter if the list is exhaustive or even sane, what matters is how you compare it to the other.Perfect? no. Good and cheap indicator? maybe.

I doubt they&#x27;re all classified the same. I&#x27;d guess they&#x27;re using this regex as a litmus test to check if something should be submitted at all, they can then do deeper analysis offline after the fact.

Interesting that expletives and words that are more benign like &quot;frustrating&quot; are all classified the same.

Hmm.. I flag things as &#x27;broken&#x27; often and I&#x27;ve been asked to rate my sessions almost daily. Now I see why.

i dislike LLMs going down that road, i don&#x27;t want to be punished for being mean to the clanker

you&#x27;d better be careful wth your typos, as well

That&#x27;s undoubtedly to detect frustration signals, a useful metric&#x2F;signal for UX. The UI equivalent is the user shaking their mouse around or clicking really fast.

&gt;Everyone is commenting how this regex is actually a master optimization move by AnthropicNo? I&#x27;d say not even 50% of the comments are positive right now.

Everyone is commenting how this regex is actually a master optimization move by AnthropicWhen in reality this is just what their LLM coding agent came up with when some engineer told it to &quot;log user frustration&quot;

Curiously &quot;clanker&quot; is not on the list

I always type &quot;please continue&quot;. I guess being polite is not a good idea.

The only time that function is used in the code is to log it.<pre><code> logEvent(&#x27;tengu_input_prompt&#x27;, { isNegative, isKeepGoing })</code></pre>

Makes me wonder what happens once flagged behind the api.

I&#x27;m clearly way too polite to Claude.Also:<pre><code> &#x2F;&#x2F; Match &quot;continue&quot; only if it&#x27;s the entire prompt
 if (lowerInput === &#x27;continue&#x27;) {
 return true
 }
</code></pre>
When it runs into an error, I sometimes tell it &quot;Continue&quot;, but sometimes I give it some extra information. Or I put a period behind it. That clearly doesn&#x27;t give the same behaviour.

&gt; terribleI know I used this word two days ago when I went through three rounds of an agent telling me that it fixed three things without actually changing them.I think starting a new session and telling it that the previous agent&#x27;s work &#x2F; state was terrible (so explain what happened) is pretty unremarkable. It&#x27;s certainly not saying &quot;fuck you&quot;. I think this is a little silly.

Nice, &quot;wtaf&quot; doesn&#x27;t match so I think I&#x27;m out of the dog house when the clanker hits AGI (probably).

so they think that everybody on earth swears only in english?

They also have a &quot;keep going&quot; keyword, literally just &quot;continue&quot; or &quot;keep going&quot;, just for logging.I&#x27;ve been using &quot;resume&quot; this whole time

Did you also forget to ignore case sensitivity back then?

We used this in 2011 at the startup I worked for. 20 positive and 20 negative words was good enough to sell Twitter &quot;sentiment analysis&quot; to companies like Apple, Bentley, etc...

That looks a bit bare minimum, not the use of regex but rather that it&#x27;s a single line with a few dozen words. You&#x27;d think they&#x27;d have a more comprehensive list somewhere and assemble or iterate the regex checks as needed.

Surely &quot;so frustrating&quot; isn&#x27;t explicit content?

Did you notice a change in quality after you went foul?

Probably a lot of my prompts have been logged then. I’ve used wtf so many times I’ve lost track. But I guess Claude hasn’t

oh I hope they really are paying attention. Even though I&#x27;m 100% aware that claude is a clanker, sometimes it just exhibits the most bizarre behavior that it triggers my lizard brain to react to it. That experience troubles me so much that I&#x27;ve mostly stopped using claude code. Claude won&#x27;t even semi-reliably follow its own policies, sometimes even immediately after you confirm it knows about them.

If this code is real and complete then there are no callers of those methods other than a logger line

They have an interesting regex for detecting negative sentiment in users prompt which is then logged (explicit content): <a href="https:&#x2F;&#x2F;github.com&#x2F;chatgptprojects&#x2F;claude-code&#x2F;blob&#x2F;642c7f944bbe5f7e57c05d756ab7fa7c9c5035cc&#x2F;src&#x2F;utils&#x2F;userPromptKeywords.ts#L8" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;chatgptprojects&#x2F;claude-code&#x2F;blob&#x2F;642c7f94...</a>I guess these words are to be avoided...

<a href="https:&#x2F;&#x2F;xcancel.com&#x2F;Fried_rice&#x2F;status&#x2F;2038894956459290963" rel="nofollow">https:&#x2F;&#x2F;xcancel.com&#x2F;Fried_rice&#x2F;status&#x2F;2038894956459290963</a>Related ongoing thread: The Claude Code Source Leak: fake tools, frustration regexes, undercover mode - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=47586778">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=47586778</a>

Claude Code's source code has been leaked via a map file in their NPM registry