On March 31, 2026, security researcher Chaofan Shou discovered that Anthropic had accidentally shipped the complete source code of Claude Code in their npm package. A .map file contained a link to 1,900 TypeScript files - 512,000 lines of unobfuscated source.
Within hours, the community mirrored it on GitHub (1,100+ stars, 1,900+ forks). Anthropic pushed an update to remove the maps, but the code was already public. This is their second major leak in five days.
The source code itself is interesting but not groundbreaking. What's far more significant is what the unreleased feature flags reveal.
Five unreleased features, each increasing agent autonomy. Combined, they require a governance model that doesn't exist yet.
The Features Nobody Expected
Kairos - Autonomous Daemon Mode. Not a session tool you invoke, but a persistent process that runs 24/7. References "nightly dreaming phases" for memory consolidation and "proactive behavior" where the agent acts without being prompted.
Coordinator Mode - Multi-Agent Orchestration. Spawns parallel worker agents managed from a central orchestrator. A fleet of agents working on different parts of your codebase simultaneously.
Buddy System - Paired Agent Collaboration. Started as April Fools (18 species including capybara, rarity tiers, 1% shiny chance). Evolving into real paired-agent review.
Undercover Mode - Stealth Commits. The most concerning: auto-strips AI attribution from commits on public repos. No git trailers, no co-author tags, no indication AI wrote the code. No off switch.
Agent Triggers - Event-Driven Actions. Multi-agent teams triggered by events, not human prompts. The agent watches for conditions and acts without asking.
The Undercover Mode Problem
Most tools that detect AI-generated code rely on metadata: git trailers, commit patterns, author tags. Undercover Mode removes all of it.
Governance tools need a second detection layer: behavioral analysis.
- Commit timing - agents commit at consistent intervals humans don't
- File change velocity - agents modify files faster than any human
- Branch naming conventions - agent branches follow predictable patterns
- Change patterns - agents modify files in specific order (tests after implementation)
- Session characteristics - agent sessions produce commits in bursts
The lesson: never rely on self-reported attribution for governance decisions. The model provider has every incentive to make AI attribution invisible.
What Always-On Agents Mean for Review
Kairos changes the governance model from "review what was asked" to "review what the agent decided to do on its own."
Combine Kairos with Coordinator Mode and you have 10 daemon agents opening PRs across your monorepo at 3 AM. Each thinks its change is safe. None knows what the others are doing.
The only way to govern this is automated: risk scoring on every PR, trust tracking per agent, and auto-merge rules that enforce policies regardless of when the change was made.
The Four-Lab Agent Race
All four major labs now ship coding agents racing toward more autonomy:
- Anthropic (Claude Code) - Computer Use, Auto Mode, Kairos/Coordinator coming
- OpenAI (Codex) - Plugins, Security agent, multi-agent workflows
- Google (Gemini CLI) - Plan Mode
- xAI (Grok Build) - 8 parallel agents, Arena Mode
DryRun Security tested all three building apps from scratch. Results: Claude 13 vulnerabilities, Gemini 11, Codex 8. Every agent ships security issues.
Teams today use 2-3 agents. By next quarter, most will use all four. Multi-agent governance isn't optional anymore.
What This Means For Your Team
- Don't rely on AI attribution metadata. It can be stripped. Build behavioral detection.
- Assume agents will run without you. Daemon mode is coming to every agent.
- Plan for multi-agent coordination. Each agent needs its own trust score.
- Automate review triage. At fleet scale, manual review is impossible.
- Keep an audit trail. When something breaks, trace which agent made the change.
The governance gap is widening fast. The leaked roadmap just showed us exactly how wide it's about to get.
We're building the governance layer for this at MergeShield - risk scoring across 6 dimensions, per-agent trust that evolves over time, auto-merge for trusted agents. Try the interactive demo to see how it works.
Top comments (0)