Introduction — What Happened Today

On March 31, 2026, security researcher Chaofan Shou (@Fried_rice) reported a discovery on X. The npm package for Anthropic's AI coding tool "Claude Code" (@anthropic-ai/claude-code v2.1.88) contained a 59.8 MB source map file (cli.js.map). From this file, the full TypeScript source code — 1,906 files, over 512,000 lines — could be reconstructed. Within hours, multiple mirror repositories appeared on GitHub, garnering over 1,100 stars and 1,900 forks.¹²

Developers worldwide descended on what amounted to a treasure trove. Internal API designs, authentication flows, encryption implementations, a roadmap of unreleased features — information Anthropic never intended to make public was laid bare.

But this article is not about what leaked. It is about why it leaked three times — and what that fact tells us about the "real reason" Anthropic refused the Pentagon's demand to strip its AI safeguards.

This article is not an accusation based on direct evidence. It is a hypothesis built on structural plausibility, constructed from publicly available information. The author submitted this hypothesis for exhaustive investigation to three AI systems — ChatGPT Deep Research, Grok, and Gemini — and no public literature explicitly advancing this perspective was found. The causal hypothesis presented here is, to the best of current knowledge, novel.

Chapter 1: Three Leaks — What Happened

1.1 Timeline: Three Leaks in 13 Months, Three Different Vectors

First Leak: February 24, 2025 — Inclusion on Launch Day

The very day Claude Code was released to the public, developer Dave Shoemaker opened the cli.mjs file (23 MB) inside the npm package and discovered an 18-million-character string appended to the end. A base64-encoded source map had been embedded inline. The following day, February 25, developer Daniel Nakov extracted the complete source code and published it as a GitHub repository (dnakov/claude-code).³

Anthropic responded immediately, removing the source map from the npm package and purging it from the cache. However, Shoemaker reported that he was able to recover the pre-deletion data from Sublime Text's undo history.³

Second Leak: March 7, 2026 — Inclusion via a Different Package

This time it was not a source map. A separate npm package, @anthropic-ai/claude-agent-sdk, contained the entire Claude Code CLI bundle (cli.js — 13,800 lines of minified JavaScript, version 2.1.71).³ This was not a forgotten source map; it was an executable file that had found its way into a different package entirely — a different vector from the first leak.

Third Leak: March 31, 2026 — Large-Scale Recurrence

@anthropic-ai/claude-code v2.1.88 contained cli.js.map (59.8 MB). The exact same type of leak as the first incident recurred 13 months later. Moreover, the source code this time was far more mature than the primitive version from launch day: 1,906 files, over 512,000 lines of TypeScript source — including more than 40 tool definitions, a multi-agent orchestration system, and a custom React terminal renderer.¹⁴

1.2 The Strategic Value of What Leaked

The public tends to dismiss this as "just the source code of a CLI tool." It's not the model weights. It's not user data. But a closer examination of the leaked contents reveals non-trivial strategic value.

According to VentureBeat, the leaked code contained the following:⁴

Internal API design and OAuth 2.0 authentication flows — the full communication protocol with Claude's backend
Permission Gates — the logic for granting or denying user operations
Telemetry analytics system — the infrastructure for collecting and analyzing usage data
Encryption tools and inter-process communication protocols
Unreleased features — KAIROS (always-on Claude), ULTRAPLAN (30-minute remote planning), Coordinator Mode (multi-agent orchestration), Agent Swarms, and BUDDY (a Tamagotchi-style AI pet)
Internal model evaluation data — revealing that Capybara (the internal codename for Claude 4.6) v8 had a false claims rate of 29–30%, actually worse than v4's 16.7%
Undercover Mode — a system by which Anthropic had been making "stealth contributions" to public open-source repositories using Claude Code

For competitors, the agent design architecture, permission control implementation patterns, and the three-layer memory design for context entropy management (preventing AI confusion in long sessions) represent months of saved R&D effort. For attackers, the detailed implementations of authentication flows, permission controls, and telemetry are materials directly usable for designing targeted attacks.

1.3 Can "Build Configuration Error" Really Explain This?

The prevailing consensus is "build configuration error." The Bun bundler generates source maps by default. An omission in .npmignore, or a misconfigured files field in package.json, allowed them into the production package. These things happen — or so the story goes.

The author reviewed virtually all discussion on Hacker News, Reddit r/cybersecurity, and DEV Community. Not a single analysis claimed the leak was intentional. Every discussion treated it as a failure of release engineering hygiene.⁵

However, the following points must be noted:

The problem that should have been fixed after the first incident recurred in exactly the same form 13 months later. Was no automated check added to the CI/CD pipeline? A script to verify the absence of .map files before npm publish can be written in a single line.

In between, a leak also occurred through an entirely different vector (executable file inclusion in a separate package). This is not an .npmignore problem; it suggests an issue with build artifact management itself.

The company built a sophisticated internal information leakage prevention system (Undercover Mode) while failing to exclude .map files three times in a row. An organization that constructs a dedicated subsystem to prevent internal codenames from appearing in git commits somehow omitted the step of verifying that source maps were absent from npm packages — three times.

This article does not assert that these were inside jobs. There is no evidence to support such an assertion. However, it is fundamentally impossible to distinguish from the outside whether these were accidental or intentional. The critical question is: How does Anthropic's leadership evaluate its own internal controls, given these facts?

Chapter 2: Anthropic and the Pentagon — What Was at Stake

2.1 Timeline of the Conflict

The Claude Code leak incidents occurred while Anthropic was in the midst of an intense confrontation with the U.S. Department of Defense.

In the summer of 2024, the Pentagon's Chief Digital and Artificial Intelligence Office (CDAO) established contract frameworks of up to $200 million each with four companies: Anthropic, Google, OpenAI, and xAI. Anthropic became the first frontier AI company to deploy its model on a U.S. government classified network, providing Claude for mission-critical applications including intelligence analysis, modeling and simulation, operational planning, and cyber operations.⁶

Between January and February 2026, the Pentagon demanded that Anthropic remove its AI safeguards. The Pentagon's position was that "so long as commercial AI technology is used in compliance with U.S. law, it should be available regardless of the AI company's own policies."⁷

Anthropic held firm on two red lines: fully autonomous weapons (systems that completely remove humans from decision-making, automating target selection and engagement) and large-scale domestic surveillance.⁶

On February 26, 2026, CEO Dario Amodei issued a public statement: "We cannot in good conscience comply with their demands."⁶

The Pentagon's response was severe. On March 4, 2026, it designated Anthropic a "supply chain risk" — a label previously applied only to adversaries of the United States, never before to an American company. Anthropic filed suit, and the court issued a temporary restraining order, finding the designation "likely retaliatory and unlawful."⁸

2.2 The Three Pillars of the Official Explanation

Anthropic's official explanation rests on three arguments.

Technical: "Today's frontier AI systems are not reliable enough to operate fully autonomous weapons. We will not knowingly ship a product that puts American warfighters and civilians at risk."⁶

Ethical: "AI-driven mass surveillance poses serious and novel risks to our fundamental freedoms. That such surveillance is currently considered legal under existing law reflects only that the law has not yet caught up with AI's rapidly expanding capabilities."⁶

Organizational: "Anthropic, or any commercial company, should not be involved in operational decision-making — and we never have believed otherwise. That is the military's role."⁶

2.3 Media Interpretation — and the Missing Perspective

The media and expert response was nearly unanimous: "ethical hero," "standing firm on AI safety principles," "courageously resisting the Trump administration's heavy-handed demands."

Reuters sources offered a slightly different nuance — "stylistic differences — perhaps even more than substantive ones" and "It's an ego and diplomacy problem."⁹ The suggestion being that the breakdown was about negotiation style as much as substance.

Legal and policy experts analyzed the conflict through the lens of contract governance. The EFF, Oxford, TechPolicy Press, and others generally discussed "the limits of corporate ethics" and "how far a private company should go in defining the boundaries of military use."

But one perspective is conspicuously absent. The limits of Anthropic's counterintelligence capabilities — its leadership's self-assessment of its internal information security posture — is a dimension that, as far as the author has been able to verify, appears nowhere in reporting, academic papers, think tank reports, or forum discussions.

Chapter 3: The Hypothesis — What Lies Behind "Ethics"

Here we arrive at the core of this article: causally connecting Chapter 1 (three leaks) and Chapter 2 (the Pentagon confrontation).

3.1 The Structural Counterintelligence Vulnerability of Frontier AI Companies

First, let us establish the premise of this hypothesis. The recognition that frontier AI companies are structurally vulnerable to state-sponsored espionage is not a hypothesis — it is the consensus of major think tanks and policy institutions.

RAND Corporation, "Securing AI Model Weights" (2024): Frontier AI model weights are nation-state-level targets, and multi-layered defenses including insider threat countermeasures are necessary.¹⁰

RAND, "The Glass House: Counterintelligence Challenges in Private AI Labs" (2025): This report identified the structural contradiction between Silicon Valley's "open culture" and counterintelligence requirements, concluding that detection of state-sponsored sleeper agents (operatives who infiltrate organizations under false identities for extended periods) by private companies is "nearly impossible."¹⁰

CSET (Center for Security and Emerging Technology), Congressional Testimony (2025): "Even America's most heavily defended companies cannot fully prevent penetration by APTs (Advanced Persistent Threats — sophisticated, sustained intrusions backed by nation-states)," and AI companies are no exception.¹¹

CNAS (Center for a New American Security), "The American AI Century" (2025): This report went further, recommending researcher screening and the use of intelligence risk indicators.¹²

Gladstone AI Report (2024–2025): The most aggressive assessment, characterizing the security of frontier AI labs as "extremely fragile" and stating that infiltration by the Chinese Communist Party is "near-certain." The report also cited whistleblowers (including former OpenAI researchers) testifying that "model weights are being regularly stolen by state actors."¹³

And Anthropic itself, in its Responsible Scaling Policy (RSP) v1.0 published in 2023, explicitly listed "internal users (compromised or malicious)" as a deployment risk category.¹⁴ In other words, Anthropic incorporated the possibility that its own employees could act with malicious intent as a design assumption for its safety framework.

Even more telling are the policy recommendations Anthropic made to the U.S. government in March 2025: expedited security clearances, the establishment of Five Eyes-style threat intelligence sharing channels, and liaison between frontier AI companies and intelligence agencies. These recommendations amount to a direct admission that "defense by a private lab alone is insufficient."¹⁵

The core point: Private companies lack the ability to apply FBI/NSA-grade security clearance screening and continuous monitoring to all employees. This is not a matter of technical capability — it is a structural limitation of institutional and legal authority. No matter how talented a company's security team, a private entity cannot exercise the legal powers available to government agencies: compulsory background investigations, communications interception, and polygraph examinations.

3.2 What Three Leaks Mean

Let us now return to Chapter 1.

First, a point of intellectual honesty regarding the timeline. Of the three leaks, only the first (February 2025) was publicly known at the time Anthropic refused the Pentagon's safeguard removal demand in February 2026. The second (March 7, 2026) and third (March 31, 2026) both occurred after the refusal.

Therefore, the simple causal narrative — "three leaks led to the refusal" — does not hold.

However, the author advances two inferences here.

First, even if only one leak was publicly confirmed, it is highly likely that analogous internal indicators — build pipeline management failures, code changes of unclear intent, anomalies detected in internal security audits — existed as well. Publicly discovered incidents are typically the tip of the iceberg. If management recognized the first leak as a manifestation of a structural problem rather than a mere accident, that alone would have been sufficient grounds for caution about deepening the relationship with the Pentagon.

Second, the second and third leaks, occurring after the Pentagon refusal, function as post hoc corroborating evidence for the hypothesis. They ironically demonstrated to the organization itself that leadership's concerns about the company's vulnerability were not unfounded. One can reasonably speculate that the assessment — "it was right not to accept the Pentagon's demands" — is being shared within Anthropic, whether or not anyone says it aloud.

With these points established, let us consider the significance of three leaks.

Claude Code's source code leaked three times in 13 months, through three different vectors. This article does not ask "who did it." The question that matters is: How does Anthropic's leadership evaluate its own internal controls, knowing these facts?

Once is an accident. A packaging error on launch day is not unusual for a startup.

Twice is negligence. Failure to add automated CI/CD pipeline checks after the first incident can be explained as a process deficiency.

Three times crosses the threshold where one must acknowledge the existence of a structural problem. Moreover, the third incident was the exact same type of leak as the first (source map inclusion in an npm package). Fixed, leaked through a different vector, then leaked again through the original vector.

Whether these were pure negligence or the work of an insider with plausible deniability — disguising intentional acts as accidents — cannot be distinguished from the outside. In principle, it is impossible. And this very indistinguishability is the essence of the problem.

Anthropic's leadership must, at minimum, hold the following assessment: There exist information exfiltration pathways within our organization that we do not fully control. Whether these stem from individual negligence, organizational process failures, or intentional action remains undetermined.

3.3 Syllogism — The Logical Structure of the Hypothesis

Let us now organize the facts presented thus far and state the hypothesis as a syllogism.

First Premise (Self-Awareness):

Having experienced the launch-day leak and analogous internal indicators, Anthropic recognizes the possibility that information exfiltration pathways exist within the organization that it cannot fully control. The two subsequent recurrences retrospectively confirmed this recognition as well-founded. The issue is likely not a single culprit but rather a "structure prone to leaks." And the means to completely eliminate that structure are not available to a private company.

Second Premise (Risk Assessment):

With this self-awareness, what happens if Anthropic says "yes" to the Pentagon's demand to strip safeguards? Three catastrophic attack vectors open up.

Vector 1: Contamination of the execution pathway. A backdoor or trojan is inserted into the Pentagon-specific build. If an insider — or an external intruder — plants malicious code in a Pentagon-bound build, that code executes on Pentagon infrastructure. An adversary nation need not steal the blueprints. Simply executing code with Pentagon authority enables catastrophic action against the United States.

Vector 2: Exfiltration of exchanged information. Military information that the Pentagon shares with Anthropic as part of the collaboration — operational requirements, threat models, operational parameters — leaks to adversary nations through internal channels. Anthropic is a private company with institutional limits on its capacity to protect military secrets.

Vector 3: Impersonation execution. If a safeguard-free AI is running on the Pentagon's network and its access credentials are seized (from inside or outside), an adversary nation can execute code in the Pentagon's name. Mass surveillance and autonomous attacks alike would be processed by the system as "authorized Pentagon activity."

Conclusion (Judgment):

Anthropic cannot be unaware of this catastrophic risk. The company incorporated insider malice as a design assumption in RSP v1.0, and it recommended counterintelligence support to the government. At the time of the Pentagon refusal, it had already experienced one leak, and the subsequent two confirmed the concern.

"Ethical concern" is the outward explanation — one that commands universal respect. But behind it lies what may be preemptive risk avoidance grounded in organizational self-awareness: a rational decision to withdraw, made with full knowledge of the company's counterintelligence limitations. The calculus: "If we embed ourselves deeply in the Pentagon's military infrastructure, the catastrophic risk transmitted through our own vulnerabilities is too high. We cannot be the party to that risk."

3.4 Why This Hypothesis Is Not Publicly Discussed

The author submitted this hypothesis for exhaustive investigation to three AI systems: ChatGPT Deep Research, Grok, and Gemini. Across academic papers, think tank reports, security expert analyses, journalism, and forum discussions on Hacker News and Reddit, no public literature explicitly advancing this hypothesis was found.

The individual components — AI companies' counterintelligence vulnerabilities, insider threats, historical analogies to nuclear technology leaks, safeguards as security functions — are all actively discussed in existing literature. But the specific causal connection, "the real reason behind Anthropic's Pentagon refusal is its self-awareness of counterintelligence limitations," has not been made.

Why? The answer is structural. For every stakeholder, "ethics" is the more convenient explanation.

If Anthropic admits it: That is tantamount to declaring "we may have spies." Enterprise value collapses, recruiting power evaporates, existing clients flee.
If the Pentagon admits it: That means acknowledging "entrusting military secrets to private companies is structurally dangerous." The entire justification for AI military integration is undermined.
If the media digs into it: The conclusion "all frontier AI companies pose espionage risks" becomes inescapable. The entire industry takes damage.

As a result, a structural national security risk hides in the shadow of an "ethics debate." The discussion of AI security is reduced to a binary of "ethics vs. pragmatism," while the more fundamental question — "the limits of organizational counterintelligence capability" — remains invisible.

Here lies a recursive structure. The very reason this hypothesis is not publicly discussed corroborates its plausibility. The power of the "ethics" narrative functions as a framing effect that obscures a more inconvenient structural reality.

Chapter 4: Lessons from History — The Ghost of the Manhattan Project

The proposition that state-sponsored spies have infiltrated private AI companies may sound like conspiracy theory. But history teaches us that exactly this has happened before.

4.1 Spies Driven Not by Money but by Conviction

The Manhattan Project — the U.S. nuclear weapons development program during World War II — was penetrated by multiple spies working for the Soviet Union.

Klaus Fuchs. A German-born physicist. While working on the plutonium bomb design at Los Alamos, he passed the detailed design schematics and detonation mechanisms to the Soviets. His motivation was not money. It was ideological conviction: "A monopoly on nuclear weapons is dangerous for humanity; a balance of power is necessary."

Ted Hall. A 19-year-old prodigy physicist. Independently of Fuchs, and driven by the same "balance" rationale, he voluntarily provided the Soviets with details of the plutonium bomb "Fat Man."

These leaks are assessed to have accelerated Soviet nuclear development by at least one to two years, enabling the first Soviet nuclear test in 1949.

What these cases share is the absence of financial motivation. Ideological true believers are extraordinarily difficult to detect through standard counterintelligence methods — monitoring for unusual spending patterns, suspicious foreign contacts, or changes in lifestyle. They act because they believe they are doing the right thing.¹⁶

4.2 The Same Structural Risk in AI

In today's frontier AI companies, the conditions for the same structure to emerge are fully in place.

"A monopoly on AI technology is dangerous for humanity." "I want to contribute to my homeland's technological advancement." "In the spirit of open source, technology should be shared." These motivations are structurally isomorphic to the convictions of Klaus Fuchs and Ted Hall.

And there is one decisive difference. The Manhattan Project was a government program. Imperfect as it was, there was a counterintelligence apparatus, security clearance screening, and FBI surveillance. Even so, it failed to stop Fuchs and Hall.

Modern AI development takes place in private companies. There is no permanent FBI presence. No mandatory security clearances. No polygraph examinations. No legal authority to intercept employee communications. Technology of strategic value comparable to the Manhattan Project is being developed in an environment far more vulnerable than the Manhattan Project ever was.

"The Manhattan Trap," published on arXiv (2024/2025), captures this structure concisely:

Perfect security is impossible. Human intelligence remains a persistent vulnerability, whether through human error, ideological motivations, bribery, or extortion.¹⁷

Chapter 5: Safeguards Are Security

5.1 Dismantling the "Ethics vs. Pragmatism" Binary

The debate surrounding the Anthropic-Pentagon confrontation is trapped in a false binary: "ethics vs. pragmatism." "Anthropic chose ethics." "The Pentagon chose pragmatism." But this very framing obscures the nature of the problem.

Safeguards are not ethical decoration. They are security infrastructure.

The IEEE paper (2025) "Safeguards as Security Perimeters: Why RLHF is not just about Ethics" defined RLHF (Reinforcement Learning from Human Feedback) safeguards as "the last security perimeter." From this perspective — safeguards as a defensive layer against adversarial attacks — removing safeguards is equivalent to removing a firewall.¹⁸

IAPS (Institute for AI Policy and Strategy), "AI Integrity" (2026), warned of model sabotage by state-sponsored attackers or insiders — the embedding of secret allegiances, the planting of hidden backdoors. Safeguards serve as a defensive layer against these attacks as well.¹⁹

Anthropic itself stated its opposition to fully autonomous weapons not only on "ethical" grounds but also because "current models are not reliable enough." This is a matter of technical reliability — that is, security.⁶

5.2 The Catastrophe That Safeguard Removal Opens

When we view safeguards not as "ethical constraints" but as "security infrastructure," the danger of the Pentagon's demand comes into sharp focus.

A safeguard-free AI runs on Pentagon infrastructure. That AI possesses the capabilities for "mass domestic surveillance" and "fully autonomous weapons control" — without safeguards.

In this state, an insider plants something in the Pentagon-specific build. Or access credentials are seized from outside. In that instant, an adversary nation holds Pentagon authority. Data collection for mass surveillance. Target selection for autonomous weapons. The system processes it all as "authorized Pentagon activity."

Contamination of the execution pathway is far more dangerous than exfiltration of blueprints. Information theft is damage; seizure of Pentagon infrastructure is catastrophe.

5.3 The Trump Variable

A political variable compounds this structure.

The demand to strip safeguards comes from Secretary of Defense Hegseth, under the Trump administration. There is no conclusive evidence that Trump is being "manipulated" by Russia. But in a state where that possibility cannot be structurally excluded, military AI policy is being decided.

What matters here is not "the truth" but "risk assessment from Anthropic's perspective." The fact that the safeguard removal demand aligns perfectly with the interests of Russia and the Chinese Communist Party — this structural reality is a variable that cannot be ignored in risk assessment, regardless of the requester's intent.

The notion of "it's powerful, so let us use it" ignores the structural impossibility outlined throughout this article. A company that built a powerful AI is conscripted, by virtue of that very power, into bearing catastrophic national security risk — without possessing the counterintelligence capability to manage it. Anthropic's refusal can be read as a rational exit from this structural trap.

Chapter 6: Conclusion — The Unverifiability Itself Is Part of the Argument

6.1 Evaluating the Hypothesis

Let us assess the hypothesis presented in this article candidly.

Plausibility is high. Every component of the hypothesis — the counterintelligence vulnerability of frontier AI companies, the structural inevitability of insider threats, historical analogies to nuclear technology leaks, the security dimension of safeguards — is supported by high-credibility literature from RAND, CSET (Georgetown University), CNAS (Center for a New American Security), Gladstone AI, and others.

The causal connection is novel. The specific synthesis of these individual arguments into "the real reason behind Anthropic's Pentagon refusal is its self-awareness of counterintelligence limitations" was not found in public literature, based on exhaustive investigation using three AI systems.

Direct evidence does not exist — and structurally cannot exist. For Anthropic to admit that "the limits of our counterintelligence capability were a factor in our refusal" would be tantamount to corporate suicide. By its very nature, this hypothesis cannot expect confirmation from the parties involved.

6.2 The Merits and Costs of the "Ethics" Framing

The "ethics" narrative carries both benefits and costs.

Benefits: It protected Anthropic's enterprise value. It demonstrated the importance of safeguards to society. It brought the concept of AI safety into mainstream consciousness. It mobilized public criticism against the Pentagon's heavy-handed demands.

Costs: It reduced the essential discussion of AI security — counterintelligence, insider threats, supply chain integrity — to an "ethics debate." The aesthetically satisfying binary of "ethical company vs. pragmatic government" functions as a framing effect that obscures the more inconvenient structural reality.

The question "are safeguards about ethics or pragmatism?" is itself the wrong question. Safeguards are security infrastructure, and their removal — particularly in an organization incapable of managing insider threats — is equivalent to removing a firewall.

6.3 Policy Recommendations

Paradigm shift: From "safeguards = ethics" to "safeguards = security infrastructure." This is the most critical recognition shift. The safeguards discussion must be elevated from the jurisdiction of ethics committees to the domain of security architecture design.
Institutionalization of government counterintelligence support for frontier AI companies. Anthropic itself recommended this in 2025: expedited security clearances, threat intelligence sharing channels, and liaison between intelligence agencies and AI companies. If military secrets are to be entrusted to private companies, a system whereby the government supports those companies' counterintelligence capabilities is indispensable.
Making the "insider threat" dimension visible in debates over military AI use. Current discourse is disproportionately focused on "the risk of AI autonomously going rogue." The risk of "AI infrastructure being compromised from within" is an equal or greater threat, yet it is scarcely discussed.

6.4 Open Questions

Has Anthropic conducted an internal investigation into the root cause of the three Claude Code leaks? If so, what were the findings? Was the conclusion truly "build configuration error"?

How do other frontier AI companies — OpenAI, Google DeepMind, xAI — assess the same structural risk? Are any of them limiting Pentagon cooperation for reasons beyond "ethics"?

And the most fundamental question: Is the very framework of militarizing AI developed by private companies structurally capable of being secure?

The Manhattan Project was a government program. It still could not stop the spies. Modern AI development takes place in private companies, with counterintelligence infrastructure far more fragile than the Manhattan Project ever had. Unless this structural gap is confronted honestly, both "ethics" and "pragmatism" are castles built on sand.

Disclaimer: This article is a hypothesis based on publicly available information and is not intended as an accusation against Anthropic or its employees. The author has no access to Anthropic's internal information, and all inferences presented herein are derived from public sources. The author takes no position on whether the Claude Code source code leaks were accidental or intentional.

About the Author

Norito Hiraoka. Executive Managing Director and Principal, SEIFU Institute of Information Technology (Osaka, Japan). Ph.D. in Engineering, the University of Tokyo. With over 25 years of experience in international education across Asia, his current work spans AI-enhanced education and geopolitical analysis of cybersecurity.

Chaofan Shou (@Fried_rice), X post, March 31, 2026 ↩ ↩²
"Claude Code's Entire Source Code Was Just Leaked via npm Source Maps," DEV Community, March 31, 2026 ↩
"Claude Code source has been available for 13 months, and nothing happened — why?," thehuman2ai.com, March 31, 2026 ↩ ↩² ↩³
"Claude Code's source code appears to have leaked: here's what we know," VentureBeat, March 31, 2026 ↩ ↩²
Hacker News thread, "Claude Code's source code has been leaked via a map file in their NPM registry," March 31, 2026 ↩
Anthropic, "Statement on Department of War," February 26, 2026; "Where We Stand with the Department of War," March 5, 2026 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷
Reuters, "Pentagon and Anthropic clash over AI military use," 2026 ↩
Anthropic, "Where We Stand with the Department of War," March 5, 2026 ↩
Reuters analysis, March 4, 2026 ↩
RAND Corporation, "Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models" (2024) ↩ ↩²
CSET, Congressional Testimony on AI Security (2025) ↩
CNAS, "The American AI Century: A Blueprint for Action"; See also "Prepared, Not Paralyzed" (2025) ↩
Gladstone AI Report (2024–2025); TIME coverage (2025) ↩
Anthropic, "Responsible Scaling Policy v1.0" (September 2023); See also RSP updates ↩
Anthropic policy recommendations to U.S. government (March 2025). Referenced in Anthropic public statements and CNAS analysis ↩
"The Manhattan Trap," arXiv (2024/2025); Bulletin of the Atomic Scientists ↩
"The Manhattan Trap," arXiv (2024/2025) ↩
IEEE, "Safeguards as Security Perimeters: Why RLHF is not just about Ethics" (2025) ↩
IAPS, "AI Integrity" (2026) ↩