13 Events — Full Chronology

Claude Code previously leaked source via npm source maps. This March 2026 incident is the second time.

Anthropic acquires the Bun JavaScript runtime. Claude Code is rebuilt on top of Bun, which generates source maps by default.

Bug oven-sh/bun#28001 filed: source maps served in production mode despite Bun docs saying they should be disabled. Issue remains open.

Anthropic sends legal threats to OpenCode, forcing removal of built-in Claude authentication. Third-party tools were using Claude Code's internal APIs.

Fortune discovers ~3,000 Anthropic files in a publicly accessible data cache, including draft blog post about upcoming model Mythos/Capybara.

Chaofan Shou (@Fried_rice), intern at Solayer Labs, discovers the .map file in Claude Code v2.1.88 npm package. Posts download link on X.

Code mirrored, forked 41,500+ times. claw-code (clean-room Python rewrite) hits 50K stars in ~2 hours — likely fastest-growing GitHub repo ever.

Malicious axios versions (1.14.1, 0.30.4) with embedded RAT published to npm — unrelated but coinciding. Contains plain-crypto-js trojan.

"No sensitive customer data or credentials were involved or exposed. This was a release packaging issue caused by human error, not a security breach."

Anthropic officially launches the Buddy companion pet system, confirming it as their April Fools 2026 feature. Available in v2.1.89+.

Engineering blogs (Layer5, Engineer's Codex, Alex Kim, VentureBeat) publish detailed architectural breakdowns of KAIROS, autoDream, ULTRAPLAN, Coordinator Mode, and anti-distillation.

Rep. Josh Gottheimer formally presses Anthropic on security lapses. Zscaler discovers trojanized GitHub repos disguised as Claude Code source.

User 4nzn uploads stripped version to IPFS with telemetry removed, guardrails removed, and all experimental features unlocked.

Anthropic releases Claude Sonnet 4.6 with enhanced tool use, extended thinking, and improved code generation. All LIGHT HOPE projects migrate to the new model.

Anthropic launches the Agent SDK (programmatic Claude Code access) for general availability. Developers can build custom agent loops with tool use, streaming, and context management.

LIGHT HOPE V5.4 standard extends V5.3 with mandatory MemoryBridge snapshots for P0-P2 projects, MCP accessibility standards, and single-port service pattern.

m495 MoltBot Lab reaches 1200 registered skills across 132 categories and 4 architecture layers. 96 fully upgraded, the rest at 213 LOC baseline.

m590 Research Knowledge Compiler verifies complete cancer pipeline: ingest → compile → wiki → m511 export → m495 skill. 9 oncology domain scopes with compiled knowledge.

m553 upgrades to v3.0: reference overlay (+14%), color grading (+65%), m590 knowledge HUD, 21 military SFX WAV, 8-platform auto-distribution, 175 JSONL feed entries.

Five milestones in one overnight run: 4 engine skills, headless game walker, CSAR verifier, Epic Fury indexer, 5-round E2E pipeline. 7,200 LOC produced. Game skills 66→91.

Full five-project pipeline activated. m8100 search antenna feeds m590 knowledge compiler, which exports to m495 skills, consumed by m553 media factory and m595 game.

m8100 expands from 14 to 24 discoveries, 18 to 30 mappings, 13 to 23 timeline events, adds 25+ game/CSAR/pipeline skills, 20+ glossary terms, 4 new labs, 3 new courses. JSONL feed generated with 50+ entries for m590 ingestion.

From 154 automated game traversals: bots verify mechanics (60%), humans verify emotion (40%). Together they cover 100%. This standard defines the boundary of automation.

Coordinated US-Israeli airstrikes on Iran (Operation Epic Fury / Roaring Lion) targeting military facilities, nuclear sites, and leadership. Triggered by failed nuclear negotiations. Iran retaliates with drones and missiles across 10 countries.

Iran's IRGC closes Strait of Hormuz to international shipping. 21 attacks on merchant ships, sea mines deployed. Demands tolls in Chinese yuan. Global oil prices spike. Only 2 tankers transit after ceasefire.

US-Iran ceasefire after 6 weeks of fighting. Just 3 days after WSO rescue. If they had waited, would ceasefire terms have returned the WSO? Unknown. The timing creates retrospective irony: the most expensive rescue in history may have been unnecessary.

F-15E Strike Eagle (call sign Dude 44, 494th Fighter Squadron) shot down by Iranian MANPADS over Isfahan province. Two crew eject in Zagros Mountains. First US aircraft lost to enemy fire since Iraq 2003.

Dude 44 Alpha (pilot) rescued within hours. Dude 44 Bravo (WSO, colonel rank) evades into 7,000-foot Zagros Mountain ridgeline, injured with sprained ankle. IRGC, Iranian Army, and Bakhtiari nomadic tribesmen begin search. Iran offers ~$60,000 bounty.

A-10C Thunderbolt II in Sandy (CSAR escort) role hit by enemy fire. Pilot determines aircraft not landable, ejects over Strait of Hormuz, rescued from water. Rescue operation creates new rescue need.

After 36-48 hours, WSO extracted from mountain crevice. 155 aircraft deployed (4 bombers, 64 fighters, 48 tankers, 13 rescue). DEVGRU, Delta Force, 160th SOAR, AFSOC, CIA all involved. MC-130J and Little Birds intentionally destroyed. HH-60W crew wounded.

m8100 compiles 50 structured JSONL entries from the Iran CSAR event covering operations, geography, survival, deception, authentication, equipment, narrative, and game design validation.