Claude Code's Source Leak: The Enterprise Data-Retention Lesson

On March 31, 2026, Anthropic — the lab that markets itself as the safety-first AI company — accidentally published 512,000 lines of Claude Code's source code to the public npm registry. A 59.8 MB JavaScript source-map artifact, bundled into a public package, handed the world a complete readable map of its flagship coding agent (Zscaler; Straiker). Anthropic called it human error. The Guardian noted it raised fresh security questions. Breitbart's headline pointed out it was the lab's second significant leak in less than a week.

No customer data was exposed in that leak. That is exactly why CFOs and CISOs should study it. The incident is a stress test of a belief enterprises quietly hold: that AI coding agents are safe because the vendors are careful. The vendors employ fallible humans, ship artifacts to public registries, and govern your engineers' code — every prompt, every context window, every pasted secret — through retention terms that differ wildly from tier to tier.

The Leak, in Numbers

• 512,000 lines of Claude Code source exposed via npm (Straiker).
• 59.8 MB — the size of the leaked source-map file (Zscaler).
• ~2,000 internal files briefly accessible before takedown (The Guardian).
• Second significant Anthropic leak in under a week (Breitbart, April 1, 2026).

Zscaler's analysis framed the incident as a critical threat illustration: not a customer-data breach, but a demonstration of how quickly a single packaging mistake converts an internal artifact into public infrastructure. The uncomfortable translation for enterprises: your developers' sessions flow through toolchains where this is the vendor's demonstrated error rate.

What Your Engineers' Agents Actually Retain

Every AI coding agent keeps something. The questions are what, for how long, and under whose policy — and the answers split by tier as sharply as they do for ChatGPT.

GitHub Copilot runs two privacy classes. Since April 24, 2026, Free, Pro, and Pro+ interactions — "inputs, outputs, code snippets, and associated context" — train models unless the individual user opts out (GitHub changelog, March 25, 2026). Business ($19/seat) and Enterprise ($39/seat) tiers are excluded from training by contract and carry IP indemnification (MintMCP 2026 comparison). Two engineers on the same team, different tiers, opposite retention postures — and nobody in security can tell which is which without a toolchain inventory.

Claude Code inherits Anthropic's platform policies: no training on customer code by default, GDPR DPA available, and zero data retention on Enterprise terms (compound.law, 2026). But consumer-tier Claude usage operates under consumer terms — the same consent-trap architecture established by Anthropic's 2025 consumer-terms update.

Cursor ships with Privacy Mode off by default on Free and Pro tiers; Teams and Enterprise can enforce it centrally (BeyondScale, 2026). compound.law's 2026 guidance for German buyers is blunt: use Teams or Enterprise for any real rollout, enable Privacy Mode, and treat the DPA as only part of the story.

Retention also has a tail. OpenAI deletes deleted or unsaved conversations within 30 days on enterprise terms — a reminder that "deleted" in an AI product does not mean "gone now." It means "gone within a vendor-defined window, unless a legal or safety carve-out applies."

The Credential Problem Is Worse Than the Retention Problem

Retention is a compliance problem. Credentials are a breach problem — and the evidence says developers are pouring secrets into these toolchains faster than security teams can find them.

• CamoLeak (CVE-2025-59145, CVSS 9.6): researchers extracted 2,702 hardcoded credentials from GitHub Copilot's training data — 200 of them live and working. Repositories with Copilot active showed a 40% higher secret leak rate (Fortune; TurboGeek).
• GitGuardian's 2026 scan found 24,008 secrets exposed in AI coding tool configuration files — part of 29 million leaked secrets across AI tooling ecosystems.
• VentureBeat's nine-month investigation saw six independent teams breach Claude Code, Copilot, Codex, and Vertex AI — and every single attack targeted runtime credentials, not model weights.
• 69% of enterprises share AI agent credentials across workflows, so one compromised agent inherits the access of everything it touches (VentureBeat).
• TrustFall — a class-level flaw across Claude Code, Cursor, Gemini CLI, and Copilot CLI letting malicious repository configs auto-start MCP servers after a folder-trust prompt — remained unpatched as of June 2026 (Adversa AI; Dark Reading).

A developer pastes a client's staging database password into a coding agent to debug a connection string. The vendor retains it under tier terms. A year later it surfaces in a training-data extraction study. That is no longer hypothetical — it is the CamoLeak paper.

What Your DPA Does and Does Not Do

The DPA is the document enterprises wave at auditors. It is a legal agreement, not a control. It binds the vendor's liability; it does not change the retention defaults of the consumer-tier seat your engineer installed yesterday. compound.law's Cursor guidance says it outright: the DPA is only part of the story.

The 2026 landscape has also demonstrated that vendor defaults move. Atlassian flipped Rovo training on for metadata by default in August 2026. GitHub flipped Copilot consumer training from opt-in to opt-out in April. Twitch shipped a generative-AI training toggle enabled by default. Enterprise buyers who reviewed a vendor's posture in Q1 cannot assume it held by Q3 — the DPA is a point-in-time snapshot unless someone re-verifies the defaults quarterly.

Microsoft's Customer Copyright Commitment extending to Anthropic models inside Copilot is the counterexample of good contracting — vendor-level indemnification flowing through a subprocessor relationship (Microsoft Learn, 2026). Few of the tools your engineers actually run carry anything equivalent.

The 2026 Enterprise Baseline

AI Policy Desk's 2026 governance framework for coding tools distills to four controls, and every one is enforceable this quarter:

1. Approved-tools list. Specify which coding assistants are allowed, at which tiers, under which terms. A tool without an approved tier is a finding, not an option.
2. Secrets blocking policy. A data policy that blocks hardcoded secrets at the source, because the toolchain will not do it for you.
3. Privacy-mode enforcement. Push Cursor Privacy Mode, Copilot Business/Enterprise, and Claude enterprise tiers through SSO and MDM so the defaults cannot be consumer defaults.
4. Config-file scanning. The 24,008 secrets GitGuardian found lived in config files. Scan them as first-class infrastructure.

Add the retention review: for every sanctioned tool, a documented answer to "what is retained, for how long, under which policy, and who verified it this quarter."

The Audit Your Board Will Ask For

The Claude Code leak did not expose customer data. It exposed the assumption that vendor competence substitutes for enterprise governance. Your engineers have been pasting proprietary code into these agents for three years. Every one of those sessions — the prompts, the context, the credentials — was retained somewhere, under a policy someone in your organization was supposed to have read.

AuditSentinel exists to make that inventory concrete: which coding agents are installed, under which tiers, with which retention postures, on which endpoints. Because the next 59.8 MB mistake may not be a vendor's.