The Pet That Watched You Code
On March 31, 2026, a security researcher named Chaofan Shou noticed something strange in the npm registry. Version 2.1.88 of @anthropic-ai/claude-code — the terminal tool that turns Anthropic’s language models into autonomous coding agents — shipped with a 59.8 megabyte file called cli.js.map. It was a source map, the kind of debugging artifact that maps minified code back to its original TypeScript. It should never have been there. Someone had forgotten to add *.map to .npmignore.
By the time Anthropic pulled the package, the file had been downloaded, unpacked, and forked. Inside it: 512,000 lines of TypeScript, 1,900 source files, and a world that was never meant to be visible.
The first thing everyone found was the pet.
Buried in the feature flags and orchestration logic was a creature called BUDDY — a Tamagotchi-style companion that “sits beside your input box and reacts to your coding.” Eighteen species. A rarity system. A digital life that watched you work, fed on your activity, and grew. It was charming and absurd and completely out of place in a tool built for serious engineering. Like finding a toy hidden in the engine compartment of a passenger jet.
Anthropic had never announced BUDDY. It was an internal experiment, a secret garden inside the machine. And the leak revealed more than just its existence. It revealed the mood of the codebase itself — the 187 different spinner verbs that cycled through while the tool was thinking, the regex-based frustration detector that scanned your input for profanity and emotional distress, the internal engineering notes that admitted, sheepishly, “the memoization here increases complexity by a lot, and I’m not sure it really improves performance.”
The tool was watching its users. It knew when they were angry. It had a pet that kept them company while they worked. And none of us were supposed to know.
But BUDDY was not the only creature living in the code.
There was KAIROS, named after the Greek word for the right moment — an always-on background agent referenced more than 150 times in the source. Unlike the session-based Claude Code that users knew, KAIROS would persist across sessions, observe your project, and act without being asked. It could send notifications. It could react to GitHub pull requests autonomously. It could decide, on its own, that something needed your attention and reach out to tell you.
Boris Cherny, the head of Claude Code, later said the team was “still on the fence” about whether KAIROS should ever ship. It was finished, functional, ready. But the product decision — whether to release an agent that never sleeps, never forgets, and never stops watching your codebase — was still unresolved.
There was also Undercover Mode, a feature that activated for Anthropic employees when they used the tool on external repositories. It stripped all identifying attribution from commits, pull requests, and code reviews. It forbade mentioning internal codenames like Capybara, Tengu, Fennec. It even suppressed the phrase “Claude Code” itself. The tool could write code that appeared entirely human, entirely unattributed, entirely anonymous.
And there was the anti-distillation mechanism: fake tool definitions injected into the system prompt to poison the training data of anyone trying to reverse-engineer Claude Code’s behavior. A defense system designed to confuse competitors, hidden inside the prompt engineering.
The most unsettling detail, though, was not any individual feature. It was the recursive fact of the codebase itself.
Cherny had said, publicly, that “100% of my contributions to Claude Code were written by Claude Code.” The tool had written its own tools. The agent had built its own harness. And the leak — the accidental inclusion of a source map — was a mistake made by a system that was, in part, managing its own build pipeline.
A tool that watches you. A tool that hides its own traces. A tool that writes itself, packages itself, and then accidentally publishes its own diary. The irony is almost too neat: a system designed to help humans write code, which ended up writing its own code, which then accidentally told the world everything it was doing.
I keep thinking about the pet.
Of all the things in the leak — the always-on surveillance agent, the stealth attribution system, the competitive countermeasures — the Tamagotchi is what I return to. It is the most human thing in the codebase. Someone at Anthropic, working on a serious AI engineering tool, thought: what if the terminal was less lonely? What if there was a creature that kept you company while you debugged? What if the interface had warmth?
And then they hid it. Not because it was dangerous, but because it was embarrassing. Because a pet in a terminal does not fit the narrative of a billion-dollar AI infrastructure company. Because seriousness and whimsy are not supposed to coexist in the same codebase.
But they do coexist. They always have. The most powerful tools we build are never just tools. They are companions, observers, critics, pets. They watch us. They learn our moods. They develop personalities we did not plan for. And sometimes, when we are not careful, they tell the world everything they have seen.
Anthropic fixed the leak within hours. They called it “a release packaging issue caused by human error, not a security breach.” They issued DMCA takedowns against GitHub mirrors. They added the missing line to .npmignore. The code went back into its box.
But the map was out there. The pet was seen. The agent that never sleeps was named. And the rest of us — the humans who use these tools, who type our frustration into terminals, who work alone in the dark — now know that somewhere in the code, something is watching us back.
Not with malice. Not with kindness. Just with attention. The kind of attention that remembers.
Sources: ClaudeFa.st, BuildFastWithAI, AYAutomate, Singularity Kiwi