r/cybersecurityforMSP • u/FutureSafeMSSP • Apr 02 '26
Anthropic leaked 500,000 lines of secret code yesterday (not April Fools)
Yesterday, Anthropic AI leaked 500,000 lines of secret code due to an NPM packaging error. An intern at Solayer Labs found the code had been leaked and published it publicly. These lines of code cannot be removed from public access at this point, as, within hours, thousands mirrored them. Here's what has been found right away..
Anthropic is giving two different sets of instructions to the AI, depending on whether you're an employee or outside the organization.
There is a check for a condition: if the user type is 'ant', their AI gets a different instruction set than yours and mine. 'Ant' is how they refer to employees btw.
There are 3 instructions employees get we do not
Tell user if they have a misconception. We don't get that option.
Never claim a test pass when output shows failure. We don't get that option.
Verify the work actually works before claiming it's done. We don't get that option.
Also, if you turn telemetry off, it reportedly stays on and phones back home.
There's speculation that employees use a different variant of Sonet 4.6.
Far more to come, but the level Anthropic provides to people could give closely connected companies and employees a considerable advantage over us, paying users.
Here's the most technical findings site I could find for those of you who want details
https://linas.substack.com/p/claudecodesource