Claude Leaks, Lessons & What's Next
Two Weeks That Changed the AI Landscape
From an accidental source map to a $100M security initiative, the last two weeks of March–April 2026 revealed more about Claude's architecture than any official announcement.
What Was Actually Exposed
The source map wasn't just code — it was the most detailed blueprint of a production AI agent system ever made public.
Tool System (29K lines) — 50+ tools across file ops, shell, agents, web, MCP, scheduling
Command System (25K lines) — CLI parsing, slash commands, hooks, feature flags
System prompt assembly — hardcoded guardrails + CLAUDE.md + git context
Hook implementations — exact pre/post execution logic
Known CVEs — CVE-2025-59536 and CVE-2026-21852 now easier to weaponize
The Agent Architecture Blueprint
What the leak revealed is a five-layer agent execution system that goes far beyond a chatbot interface.
| Layer | Technology | Purpose |
|---|---|---|
| Runtime | Bun | Fast JS runtime for agent execution |
| Language | TypeScript | Full type safety across 512K lines |
| UI | React + Ink | Terminal UI rendering |
| Validation | Zod | Schema validation for tool inputs/outputs |
| Auth | OAuth 2.0 + JWT | Authentication + macOS Keychain |
| Telemetry | OpenTelemetry | Tracing, metrics, user frustration tracking |
What the Leak Means in Practice
The impact extends across security, competition, and the broader AI ecosystem.
Claude Mythos & Defensive Security
Days after the leak, Anthropic announced its most ambitious security initiative. Coincidence or crisis response — the move is significant either way.
Mythos autonomously found a 17-year-old RCE vulnerability in FreeBSD (CVE-2026-4747) with no human involvement after the initial request.
Anthropic says Mythos identified thousands of zero-day vulnerabilities across every major OS and browser.
AWS Apple Microsoft Google NVIDIA CrowdStrike Palo Alto Networks Cisco JPMorganChase Linux Foundation Broadcom
$100M+ in usage credits committed, plus $4M in donations to open-source security organizations.
From Prototype to Production in Days
Announced April 8, 2026, Claude Managed Agents is Anthropic's answer to the hardest part of building AI agents: the infrastructure.
- Sandboxed execution — isolated container per agent
- Checkpointing — resume after failures
- Credential management — secure secrets handling
- Scoped permissions — control tool access
- End-to-end tracing — full observability
- Error recovery — auto-resume after outages
Teams using Managed Agents across coding, task automation, and document processing workflows.
Auto prompt refinement — Improved task success by up to 10 points in internal testing
Claude Is Becoming an Operating Layer
Zoom out and the picture is clear: Anthropic shipped five major capabilities in six weeks. This is a platform play, not incremental updates.
| Date | Release | What It Means |
|---|---|---|
| Feb 5 | Opus 4.6 | 1M context window, agent teams, 300K max output tokens on Batches API |
| Feb 17 | Sonnet 4.6 | Same-price upgrade, matching 1M context |
| Mar 24 | Claude Cowork | Desktop agent: controls Mac apps, navigates browsers, handles multi-step tasks autonomously |
| Mar 31 | The Leak | Full agent architecture becomes public knowledge |
| Apr 7 | Project Glasswing | Mythos Preview for defensive security with 50+ partner organizations |
| Apr 8 | Managed Agents | Cloud-hosted agent infrastructure as a service |
Opus / Sonnet 4.6
Cowork + Dispatch
Managed Agents
Mythos / Glasswing
Codenames and What's Likely Coming
The leak and subsequent analysis surfaced internal labels and feature flags. Some are confirmed, some remain speculative.
Managed Agents — Public beta with API, pricing, and early adopters
Cowork / Computer Use — GA for macOS, Windows coming
Internal model family codenames — likely tiered development tracks
Kairos — Background/always-on execution
AutoDream — Memory consolidation / overnight synthesis
UltraPlan — Deeper multi-step planning mode
Conway: The Layer Above MCP
The leak revealed something most analysis missed: Anthropic is building a proprietary orchestration layer on top of the open MCP standard. This is the classic platform play — and it's called Conway.
Open Layer
MCP (Model Context Protocol)
- Open standard donated to Linux Foundation
- Adopted by OpenAI, Google, and others
- Portable tool connectors across platforms
- Standardized AI-to-tool communication
Purpose: Create adoption. Build the ecosystem.
Proprietary Layer
Conway (CNW)
- Always-on agent runtime with persistent memory
- Custom extensions in
.cnw.zipformat - Webhook triggers, event streams, scheduling
- UI panels: Search, Chat, System controls
Purpose: Create lock-in. Capture value.
Open • Portable
Proprietary • Persistent
App Store • Locked In
There is no export format for an agent's learned operational intelligence. No regulatory framework for migrating it. Switching means retraining — potentially months of ramp-up cost.
This is the moat. Not the model weights. Not MCP. The layer between the open standard and your daily operations.
Perspectives: The New User & the Executive
The same events read very differently depending on where you sit.
- The barrier to entry just dropped. The leak means the architecture of how AI agents work is no longer a mystery. Learning materials exploded — the blueprint is public.
- Start with Claude Code + CLAUDE.md. Write a project description file, install Claude Code, and start asking it to help with real work.
- Expect cost changes. The OpenClaw ban shows flat-rate AI access is unsustainable. Budget for API costs or stay within official tool limits.
- Pick a lane. Open-source tools (Aider, Cline, OpenCode) vs proprietary platforms (Claude Code, Conway). Your choice now shapes switching costs later.
- Vendor trust just got more complex. Evaluate AI vendors on operational competence, not just model capability.
- The Conway lock-in is real. Agents that run 24/7 accumulate institutional knowledge that doesn't port. Insist on platform-independent documentation.
- Managed Agents changes the build-vs-buy math. At $0.08/hour, many internal agent platforms no longer justify their engineering cost.
- Token economics hit the P&L directly. Model routing can cut AI costs 60–80%. This needs to be a line-item strategy.
Perspectives: The Developer & the Founder
For builders and founders, the last two weeks reshaped both the opportunity and the risk landscape.
- The leaked architecture is your study guide. Five-layer agent systems, tool routing, permission models, memory management — the reference implementation is public.
- Build on MCP, be cautious with CNW. MCP integrations are portable. Conway extensions are not. Invest in the open layer first.
- Skills and hooks are the productivity multiplier. Not the model. Not the prompt. The system you build around the model compounds over time.
- Understand the cost model. A single OpenClaw instance can burn $1K–$5K/day. Use the Batch API (50% off) for non-urgent work. Route intelligently.
- The "wrapper" startup is dead. The "harness" startup is alive. The value is in orchestration, permissions, domain-specific workflows, and the memory layer.
- Managed Agents is both opportunity and threat. Easier to launch agent-powered products, but your infra moat just evaporated. Differentiate on domain knowledge.
- Watch the CNW extension ecosystem. Early extensions could be high-value real estate — like early iOS apps. But Anthropic controls your distribution.
- Multi-model routing is a survival skill. Abstract your model layer, route by task complexity, and keep your options open.
The OpenClaw Lesson & the Cost of Intelligence
The OpenClaw ban isn't just policy drama. It's the first clear signal that flat-rate AI access cannot survive agent-scale usage — and every organization needs a token strategy.
Why: ~60% of active OpenClaw instances ran on Claude subscription credits. A single instance can consume $1,000–$5,000/day — on a $20–$200/month plan.
Boris Cherny: "Our subscriptions weren't built for the usage patterns of these third-party tools."
Result: Users must now pay API rates or stay within Claude Code's managed limits. OpenClaw creator (now at OpenAI) called it “a betrayal of open-source developers.”
OpenAI's model router — automatically sends simple requests to GPT-5.4 nano (cheapest) and complex ones to GPT-5.4 (most capable). Users don't choose; the system optimizes for cost.
Anthropic's adaptive thinking — Opus/Sonnet 4.6 skip expensive reasoning for simple requests automatically. Token spend self-adjusts.
The lesson: Every AI provider is moving from "unlimited" to "optimized." Revenue and profitability now directly shape what model answers your question.
| Model | Input | Output | Best For |
|---|---|---|---|
| Haiku 4.5 | $1 | $5 | Classification, extraction, routing |
| Sonnet 4.6 | $3 | $15 | General coding, analysis, writing |
| Opus 4.6 | $5 | $25 | Complex reasoning, architecture, planning |
| Batch API | 50% discount | Non-urgent processing within 24hr window | |
Making Claude Code Work Harder for You
Theory is nice. Here's what actually moves the needle in daily development work.
Boris Cherny (Claude Code's creator) keeps his at ~100 lines, ~2,500 tokens. His golden rule: "Anytime we see Claude do something incorrectly, we add it to CLAUDE.md so it doesn't repeat next time."
# Example CLAUDE.md structure
## Project Context
- Stack: Next.js 16, React 19, MongoDB Atlas
- Deploy: Vercel, production branch is main
## Behavioral Rules
- Run tests after every change
- Never mock the database in integration tests
- Keep files under 150 lines
- Commit early and often with descriptive messages
## Aliases
- "the dashboard" = /src/app/dashboard/
- "deploy" = git push origin main
The Two Multipliers
Skills extend what Claude can do. Hooks constrain how it does it. Together they turn a powerful but unpredictable assistant into something you can trust with your codebase.
settings.json.PreToolUse — runs before any tool call (allow / deny / defer)
PostToolUse — runs after tool execution
PreCommit — gate commits with custom checks
New in v2.1.89:
defer option lets hooks pause execution and wait for an external signal.
~/.claude/skills/ that give Claude domain knowledge and reusable workflows. No SDK, no build step.Invoked automatically when relevant, or manually with
/skill-nameExamples: research workflows, presentation generators, deployment scripts, analysis tools, code review personas
# Example: Pre-commit hook to block sensitive files
# In settings.json hooks section:
{
"hooks": {
"PreCommit": [{
"command": "bash -c 'if git diff --cached --name-only | grep -qE \"\\.(env|key|pem)$\"; then echo \"BLOCKED: sensitive files\"; exit 1; fi'"
}]
}
}
The Commands That Actually Matter
A curated list of the techniques and workflows that experienced Claude Code users rely on daily.
| Command / Technique | What It Does |
|---|---|
/clear |
Reset context. Start fresh with ~20K tokens instead of degrading at 60%+ usage. |
/compact |
Compress context without losing everything. Good for mid-task cleanup. |
claude -p "prompt" |
Non-interactive mode. Use in CI pipelines, pre-commit hooks, or automated scripts. |
--output-format stream-json |
Streaming JSON output for programmatic consumption. |
| Pattern | How It Works |
|---|---|
| Plan-then-execute | Ask Claude to draft a plan with no implementation. Annotate in editor. Send back. Repeat until solid. Then: "implement." |
| One task per session | Fresh context costs ~20K tokens. Quality loss from a degraded session costs much more. Dump plan to a file, /clear, reload. |
| Subagent delegation | Define specialist personas in .claude/agents/. Claude spawns them in isolated context windows and gets compressed summaries back. |
| MCP integration | Use claude mcp add to connect Notion, Figma, databases, monitoring. Claude queries them directly instead of copy-pasting. |
Esc — Cancel current generation
Tab — Accept autocomplete suggestion
Ctrl+C — Interrupt and get partial result
! command — Run shell command in session
/ — Browse available slash commands
@ file — Add file to context
/clear liberally. Context quality beats context quantity every time.
Managing the 200K Token Window
The leak confirmed what practitioners already knew: context management is the single biggest factor in output quality.
- Start fresh sessions for each distinct task
- Use
CLAUDE.mdfor persistent context (loads automatically) - Use skills for specialized knowledge (loads on demand)
- Dump progress to a file before
/clear - Use
@fileto pull in specific files, not entire directories
- Packing the entire codebase into context
- Running multi-hour sessions without clearing
- Putting volatile info in CLAUDE.md (it loads every time)
- Relying on context alone instead of external persistence
- Over-specifying CLAUDE.md — Claude ignores rules lost in noise
Karpathy's LLM Wiki: RAG Without RAG
On April 3, 2026 — two days after the Claude Code leak — Andrej Karpathy published something quietly more important: a knowledge architecture that replaces RAG with a living markdown wiki maintained by the AI itself.
No vector databases. No embedding pipelines. Just markdown files and an LLM that reads, writes, and maintains them. ~100 articles, ~400K words — with minimal direct human intervention.
Dump everything
LLM compiles & links
Navigate & query
1. Ingest
Research papers, repos, web articles go into raw/. Obsidian Web Clipper converts pages to .md with local images for vision models.
2. Compile
The LLM writes a structured wiki: summaries, concepts, encyclopedia-style articles, and backlinks between ideas. This is the step RAG skips.
3. Maintain
The LLM runs "health checks" — linting for inconsistencies, missing data, or new connections. The wiki evolves autonomously.
- Vector embeddings are a black box
- Retrieval noise increases with scale
- Requires embedding model + vector DB + pipeline
- Knowledge is implicit in vectors
- Markdown is human-readable and traceable
- Navigation via summaries and index pages
- Zero infrastructure: just files and an LLM
- Knowledge is explicit, editable, deletable
Why Memory Systems Are the Real Differentiator
The Claude Code leak, Conway's behavioral lock-in, and Karpathy's wiki all point to the same conclusion.
- Claude Code's
CLAUDE.md+ skills + auto-memory = a primitive brain system that compounds per-project knowledge across sessions - Conway's persistent agent memory = institutional knowledge that creates behavioral lock-in (the platform keeps it)
- Karpathy's wiki = personal knowledge that stays with you, not the platform (you keep it)
- Create a
brain/orknowledge/directory - Dump research, notes, and articles into
raw/ - Let your AI compile it into structured, interlinked markdown
- Review and edit — the human stays in the loop
- Over weeks, you'll have a second brain that you own, not your AI vendor
Where This Is All Heading
Reading the confirmed announcements and the leaked signals together, the trajectory is clear.
What I've Been Building
These concepts aren't theoretical. Here's the ecosystem of tools I'm building that put these ideas into practice — from agent orchestration to knowledge management to native apps.
AI Agent Orchestration Platform
Hive is an Electron + Next.js desktop app that autonomously dispatches Claude Code agents, streams progress in real-time, and manages approvals for risky operations. Think of it as a team of AI developers you manage via a Kanban board.
WebSocket live updates for real-time Kanban dashboard
Scheduler dispatching up to 4 concurrent agents across different projects
SQLite database — no external DB needed
PID registry + recovery for agent process management
Each profile has custom system prompts, allowed tools, and can delegate subtasks to other profiles (CEO → COO → Developer chain).
Models, Usage & Analytics
Select model per task. Route heavy architecture to Opus, daily coding to Sonnet, lightweight ops to Haiku. Local models via Ollama / LM Studio for cost-free work.
Token usage trends — bar charts by model (Haiku, Opus, Sonnet, Gemma), cost over time
Cache efficiency — hit/write/uncached rates with trend analysis. 82.8% cache hit rate achieved.
Agents That Reach Into Your Servers — With Guardrails
Hive includes an SSH MCP server that gives agents the ability to run commands on remote machines. But the real design point isn't access — it's restriction. The MCP server itself defines the security boundary: what an LLM can and cannot do, enforced at the protocol layer, not by hoping the model behaves.
mcp__ssh__list_hosts, then execute commands via mcp__ssh__exec.Example: An ops task says "tell me the uptime on digibot" — the agent SSHs into the server and returns the result. No human interaction needed.
$ ssh digibot uptime
up 178 days, 3:29 — 3 users
load average: 1.28, 1.16, 1.16
Running strong at 178 days.
Load averages are moderate and
stable across 1/5/15 min windows.
Agent used Bash → SSH → parsed output → summarized. Total time: 1m 56s including agent reasoning.
hive_list_tasks hive_create_task hive_get_task hive_update_task hive_approve_task hive_request_changes hive_move_task hive_delete_task hive_retry_task hive_add_comment hive_kill_agent hive_list_projects hive_get_agent_status
This means Claude Code running locally can create, monitor, and manage Hive tasks — an agent orchestrating agents.
Skills, Security & the Agent-Native Principle
/import-vodafone — a custom skill that triggers a Python data pipeline to pull SIM Inventory reports from the Vodafone M2M Portal and sync them to MongoDB. The agent handles the entire workflow: skill invocation, script execution, error handling, and reporting back.Pattern: Define your ops workflows as skills. Point Hive at them. Walk away.
- Allowlisted commands — the server decides which operations agents can invoke, not the model
- Scoped host access — agents only see servers explicitly registered; no lateral movement
- Audit trail — every command execution is logged with agent identity, timestamp, and full output
- No credential exposure — SSH keys and passwords live in the server process, never passed to the LLM context
The Autonomous Roadmap
Hive's next evolution: Autonomous Mode — a goal-driven execution layer where the CEO agent decomposes a high-level objective, the COO plans operationally, and specialists execute in parallel. Informed by Paperclip, Hermes Agent, and OpenMOSS.
CEO agent
COO agent
Specialists
COO validates
CEO learns
{
"goalAncestry": [
"Make the digital dashboard a more commercially competitive product",
"Increase ad revenue by optimizing load time",
"Audit bundle size, find largest deps"
]
}
Wave 1: Audit, Research, Pull bugs (parallel)
Wave 2: Optimize, Build, Fix (each depends on Wave 1)
Wave 3: Launch email (depends on Wave 2)
Replaces the current FIFO scheduler for mission tasks.
Budget, Failure Recovery & the Vision
budgetSpentUsd < budgetUsd before spawning. If budget exhausted → pause mission, notify human.
AI-Powered SSH & Git Client for macOS
Canopy is a native macOS app that combines SSH terminal, SFTP file management, Git client, and AI chat into a single workspace. Built with SwiftUI, zero external SDK dependencies, BYOK (Bring Your Own Key) for any AI provider.
Local terminal via SwiftTerm LocalProcess
Server dashboard — uptime, disk, memory, CPU at a glance
SFTP file comparison & push-to-remote
BYOK AI chat panel with terminal context injection
Supports: Claude, OpenAI, OpenRouter, Ollama, LM Studio — all via URLSession REST + SSE, no SDKs
Xcode-style toolbar toggles: Dashboard, Terminal, Git, Files, AI
| Layer | Technology | Purpose |
|---|---|---|
| UI | SwiftUI | Native macOS 15+, NavigationSplitView |
| SSH | Citadel | SSH, PTY, SFTP — pure Swift |
| Terminal | SwiftTerm | Terminal emulation (NSView + UIView) |
| Syntax | HighlightSwift | Code syntax highlighting |
| Auth | macOS Keychain | Server passwords + API keys |
| Build | SPM (Swift 6.0) | No Xcode project, pure Package.swift |
Human Interface, Agent Interface — Same Servers
Your Knowledge, Your Search, Your AI
Brainpower is Karpathy's "LLM Wiki" concept made real — a native macOS app that gives you a window into a local markdown vault with AI-powered hybrid search, vector embeddings, and a 3-tier cloud evolution. Inspired by Karpathy's knowledge architecture and Nate B Jones' "One Brain" philosophy.
~/brain — offline
Personal Atlas
Team knowledge
~/brain. Brainpower's built-in embeddings + ripgrep. Always works offline.L2 (BrainCloud): Personal MongoDB Atlas cluster with vector embeddings. Atlas Vector Search + Atlas Search for cloud-powered semantic search.
L3 (BrainMerge): Shared Atlas cluster. Multi-tenant team knowledge — everyone's notes combined. Shared AI learns from all of it.
Semantic search via Ollama embeddings (768d nomic / up to 4096d qwen3) + vDSP dot product
Reciprocal Rank Fusion merges both result sets
AI synthesis via Claude API — search results compiled into coherent answers with citations
Markdown editor with Mermaid diagram support
PDF export and AirDrop to iPhone
File watcher — auto-reloads when files change on disk
Tag system — color-coded, filterable
Atlas Vector Search & the Brain in Action
$vectorSearch (ANN/ENN), $rankFusion (MongoDB 8.0+), and $scoreFusion (MongoDB 8.2+) for native hybrid search. Pre-filtering on metadata (tags, section, date) narrows the search space before vector comparison.Free tier (M0): 512MB storage, 1 vector index — sufficient for a personal Brain.
The Supporting Cast
Not every tool is an AI orchestrator. Some are small, sharp utilities that solve one problem well.
Built with: SwiftUI, macOS 15+, SPM, zero dependencies
Architecture: CGEventTap for global keyboard monitoring, PopupWindowController for UI, PersistenceService for saved app list
Features: Hotkey-triggered popup, optional labels, Mission Control integration, onboarding wizard, settings panel
Built with: SwiftUI, macOS 15+, SPM, zero dependencies
Features: Dark / Light / System theme toggle, drag-and-drop file open, clean minimal UI
Why it exists: Every HTML presentation in this series is designed to be viewed in Beam — the app I built to present them.
What to Remember: Leadership & Developers
- The moat is the harness, not the model. Orchestration, permissions, and tool routing are the real competitive surface.
- Agent infrastructure is now a managed service. Build-vs-buy calculus shifted with Managed Agents at $0.08/hour.
- Security posture is visible. After the leak, operational competence is part of vendor trust evaluation.
- Memory ownership is a strategic decision. Conway keeps it. Karpathy's approach lets you keep it. Choose deliberately.
- Invest in CLAUDE.md now. It's the highest-ROI file in your repo. Add to it every time Claude makes a mistake.
- Learn hooks and skills. Skills extend capability, hooks enforce safety. Together they compound over time.
- Manage context aggressively. One task per session,
/clearoften, dump progress to files. - Use MCP integrations. Connect your tools directly instead of copy-pasting between interfaces.
Five Things to Do This Week
- Create a
CLAUDE.mdin your project root (start with 50–100 lines of project context and behavioral rules) - Add one pre-commit hook to block sensitive file commits — this enables unattended operation
- Try the plan-then-execute workflow on your next feature — draft plan, annotate, iterate, then implement
- Start a
brain/directory — dump research intoraw/, let AI compile it into structured markdown you own - Connect one external tool via MCP (
claude mcp add) — Notion, Figma, database, whatever you copy-paste from most