Claw Code is Anthropic's new agentic coding tool — but its file system access and shell execution capabilities introduce serious security risks. Here's what attackers can exploit and how to defend against it.
On March 31, 2026, at 04:00 UTC, security researcher and Solayer Labs intern Chaofan Shou (@Fried_rice) posted on X, revealing that Anthropic had accidentally bundled a 59.8 MB JavaScript source map file (.map file) inside the npm package @anthropic-ai/claude-code v2.1.88. The .map file pointed to a complete source archive hosted in a publicly accessible Anthropic R2 cloud storage bucket, containing 2,000 files, approximately 500,000 lines of TypeScript code, and several "developed but not yet deployed" feature flags. The thread attracted 160,000 views. Anthropic later told Axios: "This was a publishing mistake caused by human error, not a security vulnerability — no sensitive customer data or credentials were exposed."
Notably, on the same day, malicious packages axios v1.14.1 / v0.30.4 containing a remote access trojan (RAT) appeared on npm — unrelated to the Claude Code leak, but the timing overlap caused brief confusion in the security community. More critically, Zscaler ThreatLabz subsequently documented attackers actively distributing Vidar infostealer and GhostSocks malware using Claw Code-themed lures — demonstrating that high-profile open-source incidents can themselves become springboards for social engineering attacks, a direct threat that security teams must factor into their risk assessments.
Shortly after the leak, Korean developer Sigrid Jin (@instructkr) — who had attended Claude Code's one-year anniversary party in San Francisco — led a team using "two people, ten OpenClaw accounts, and one MacBook Pro" to complete a clean-room Python rewrite of Claw Code overnight via the oh-my-codex (OmX) end-to-end automation workflow. Claw Code surpassed 50,000 stars within two hours and exceeded 100,000 stars and 100,000+ forks within 24 hours, becoming the fastest project in GitHub history to reach 100K stars. Over 5,000 people joined its Discord community in a single day. Jin is also driving a full Rust rewrite, calling it "the complete form of this project." Anthropic issued DMCA takedown notices targeting the leaked TypeScript source, but the legal basis for applying DMCA to the clean-room Python rewrite is considerably weaker.
The project makes three things explicitly clear:
Claw Code's Python code is primarily concentrated in the src/ directory, containing modules for the command-line interface, tool registry, permission management, execution runtime, and session logging. The entry point src/main.py exposes the following commands:
These features make Claw Code a research sandbox where developers can study how AI agents invoke tools, route requests, and design audit and logging mechanisms — without directly touching the leaked source code. It is important to be clear: Claw Code is not currently a production replacement for Claude Code — feature parity has not been reached, the Rust version remains unstable, and unresolved legal questions persist.
In AI agent architectures, "tools" are one of the largest sources of risk — they can encompass Bash commands, file read/write operations, Git actions, and even external API calls. Claw