Famous Leaks

Abstract

A leak is a copy that escaped. Once information is digital, the cost of copying it falls to nearly zero, a single insider can carry a government’s secrets out on a music CD, and encryption protects the leaker as well as it protected the secret. This article traces the leaks that changed the field: the classified troves from Manning and Snowden, the Panama Papers investigation that turned 2.6 terabytes into a graph database, the source-code escapes of Windows and Half-Life 2, and the March 2026 accident in which Anthropic published the full source of Claude Code to the npm registry by mistake. The through-line is not the secrets themselves but the mechanics: how digital material gets out, and why it can never be recalled.

From Photocopier to USB Stick

The template predates computers. In 1971 the military analyst Daniel Ellsberg spent months photocopying the 7,000-page Pentagon Papers, the classified history of US decision-making in Vietnam, and handed them to the New York Times. Copying was the bottleneck: it took a Xerox machine, nights of labor, and physical smuggling of paper.

Digitization removed the bottleneck. In 2010 US Army intelligence analyst Chelsea Manning copied roughly three-quarters of a million classified documents onto rewritable CDs labeled as Lady Gaga albums and passed them to WikiLeaks: the Iraq and Afghanistan War Logs, a quarter-million diplomatic cables, and the “Collateral Murder” video. It was the largest leak of classified material in American history to that point, and it fit in a shirt pocket. Three years later Edward Snowden, a contractor with system-administrator access, walked out of an NSA facility in Hawaii with a still-disputed number of documents on portable drives and gave them to journalists in Hong Kong. His disclosures drove the industry-wide shift to default HTTPS and end-to-end encryption. Between Ellsberg and Snowden the political act was identical; only the physics changed. One insider, once, is now enough.

The Panama Papers: A Leak as a Data Problem

The largest journalistic leak turned the story into a computing problem. In 2015 an anonymous source calling himself “John Doe” began sending the German newspaper Süddeutsche Zeitung the internal records of the Panamanian law firm Mossack Fonseca. The final trove was 2.6 terabytes and 11.5 million files spanning four decades, emails, PDFs, images, and database dumps documenting the shell companies of politicians, criminals, and billionaires.

No newsroom can read 11.5 million files. The International Consortium of Investigative Journalists (ICIJ) treated the leak as a data-engineering task: optical character recognition to make scanned documents searchable, then a graph database (Neo4j, with the Linkurious front end) to model the leak as a network of people, companies, and intermediaries so a reporter could click from a name to its hidden offshore entities. More than 370 journalists in nearly 80 countries worked the same indexed dataset through a secure collaboration platform for a year before publishing together on April 3, 2016. The fallout included the resignation of Iceland’s prime minister. The Panama Papers established data journalism as a discipline: the skill that broke the story was not a source cultivated over lunches but a pipeline that made a terabyte-scale dump queryable.

Source Code Escapes

A special category of leak is source code, because it exposes not a secret fact but the machine itself. Two cases set the pattern.

In October 2003 a German programmer, Axel Gembe, penetrated Valve’s network (the company’s name server allowed anonymous zone transfers, which mapped its internal hosts) and exfiltrated the source code to Half-Life 2, one of the most anticipated games of the decade, a year before release. The code and a playable unfinished build spread across the internet within days and forced Valve to delay the game. The arrest was stranger than the hack: Gembe emailed CEO Gabe Newell to apologize and ask for a job, Newell played along with a fake interview meant to lure him to the US and the FBI, and German police arrested him at home before he could board the flight. Gembe received a two-year suspended sentence.

In February 2004, portions of the Windows 2000 and Windows NT 4.0 source code (around 30,000 files, on the order of 13.5 million lines for the Windows 2000 archive) appeared on file-sharing networks. Microsoft’s investigation traced the leak not to a breach of its own network but to Mainsoft, an Israeli partner that had licensed the source under a 1994 agreement to port Windows applications to Unix. The episode showed that a codebase is only as confidential as the least careful company holding a copy.

The Claude Code Leak of 2026

The most instructive recent case was self-inflicted. On March 31, 2026, Anthropic published version 2.1.88 of its npm package @anthropic-ai/claude-code, the command-line coding agent. Bundled in the package by mistake was a 59.8 MB JavaScript source map: a .map file that build tools generate to aid debugging, which reconstructs the original, human-readable source from shipped code. The package normally ships compiled and minified; the source map handed anyone who unzipped it roughly 512,000 lines of unobfuscated TypeScript across about 1,900 files, the actual implementation of the agent’s tool-call loop, permission system, and integrations.

The cause was mundane, the same class of mistake as the Windows and Half-Life leaks reduced to a single missing line: the Bun runtime produced a full source map by default, and *.map was never excluded in the package’s .npmignore. A Solayer Labs intern, Chaofan Shou, spotted the file and posted about it; within hours the code was mirrored to GitHub, where copies drew tens of thousands of stars and forks. Beyond the working code, readers catalogued dozens of hidden feature flags gating unreleased functionality and references to internal model codenames, including one, “Mythos”, for a then-unannounced model tier.

Anthropic called it “a release packaging issue caused by human error, not a security breach”, noted that no model weights, customer data, or credentials were exposed, pulled the package, and filed DMCA takedown notices. The takedowns illustrated the recall problem: mirrors multiplied faster than notices could remove them, some hosted on services that advertised they would ignore the requests. The leak produced two second-order effects that outlast the news cycle:

Derivative projects. Because the leak was working application code rather than a trained model, developers could run and modify it. The most prominent fork, OpenClaude, wrapped the leaked agent in an OpenAI-compatible shim so its tools (shell, file editing, search, MCP integrations) could be driven by any model, from GPT and Gemini to local Llama, rather than only Anthropic’s. Variants targeting mobile and other runtimes followed. This was the competitive harm a source leak causes that a document leak does not: the escaped artifact keeps working for whoever picks it up.
Malware laundering. Criminals exploited the search demand for “leaked Claude Code” by publishing trojanized repositories. Security firms documented fake archives carrying a Rust dropper that installed the Vidar information stealer and GhostSocks proxy malware, some of the malicious repositories ranking near the top of search results. The leak’s fame became the delivery vehicle.

Myth: “The Claude Code leak exposed Claude’s AI.”

The leak was the source code of the client, the agent that runs in your terminal and calls a model over the network. It did not include the model weights, the training data, or the safety systems, which is why running the leaked code (as OpenClaude does) still requires pointing it at somebody’s model API. A leaked source map exposes how the software is built, not the intelligence it talks to. See Myths and Misconceptions.

What the Leaks Share

The instructive pattern is that scale and secrecy no longer correlate with difficulty of exfiltration. Ellsberg needed months at a photocopier for 7,000 pages; Manning needed a CD burner. Mossack Fonseca’s forty-year archive left the building as a single copy. Anthropic’s leak needed no attacker at all, only a default build setting and a missing entry in a config file. Encryption, the technology sold as the fix, is symmetric in whom it serves: it lets a whistleblower reach a journalist safely and lets a mirror host distribute a leak untraceably. And the deepest asymmetry is permanence. A physical document can be recovered or destroyed; a file that has been copied to the network, whether a diplomatic cable, a source tree, or a 59.8 MB map file, cannot be recalled by anyone, including the party that leaked it.