What the Harness Exposure Actually Changes
The engineering community's read on this leak converged quickly: the model was never the defensible asset. As one analysis of the exposed architecture put it within days of the disclosure, the agent harness — the orchestration layer, the memory system, the multi-agent coordination — was the real competitive surface, and that surface is now fully documented in public. Security researcher Chaofan Shou first noticed the exposure in Anthropic's npm registry; the disclosure traced to a 59.8 MB JavaScript source map file bundled into version 2.1.88 of the @anthropic-ai/claude-code package.
Open-source developers now hold something more valuable than a reverse-engineered approximation — they hold Anthropic's own implementation. The enterprises that chose Claude Code for its opacity now face a specific question: the harness they are paying for will not remain proprietary long enough to justify the contract renewal cycle they are already inside. Anthropic's silence is the answer they are getting.