TypeScript Is the New Assembly Language — What the Claude Code 600K-Line Source Leak Reveals About AI-Written Code
In March 2026, Claude Code v2.1.88 shipped an update. It looked routine. Hidden inside was a bomb — a 59.8 MB sourcemap file that put the entire Claude Code codebase in plain daylight.
600,000 lines of TypeScript. 1,906 files. All leaked.
After going through the source, SemiAnalysis landed on a sharp conclusion:
TypeScript has become the modern assembly language. Not because it’s low-level — but because it’s no longer written for humans to read.
TypeScript is now the modern assembly language — not because it is low-level, but because it is no longer written for humans. It is produced by AI, consumed by AI, evolved by AI. Human engineers? Just the QA layer.
This is not science fiction. Based on SemiAnalysis data from February 2026, Claude Code already accounts for 4% of public GitHub commits, with estimates pointing past 20% by end of 2026. (A Pragmatic Engineer survey from the same period confirms the pace: Claude Code is already the most-used AI coding tool in 2026.)
Okay, let’s slow down for a second. Some people might think the “assembly language” comparison is too dramatic. But think about what assembly language actually is: machine-generated, machine-read, occasionally glanced at by humans who then get a headache. Now look at a 3,167-line function with 12 levels of nesting… yeah, maybe not so dramatic after all (╯°□°)╯
After SemiAnalysis dropped the bombshell, several technical communities followed up. Engineers Codex tore apart the architecture. Mark Seemann (ploeh.dk) came at it from the type system angle. Sabrina.dev went straight for the security holes — she also published a real-world test of how fast Claude Code burns tokens around the same time. Combining all three perspectives, the picture becomes much clearer.
Three-Layer Memory Architecture: The Context Window Is a Scarce Resource
The memory design in Claude Code is the most impressive part of the leak. Instead of dumping everything into the context window and hoping it doesn’t overflow, Claude Code uses a careful three-layer architecture:
Layer 1: Always-loaded index pointers — Each pointer is roughly 150 characters. Always in memory. These are not the data itself — they are indexes that say where the data lives. Like library catalog cards: tiny footprint, but the system always knows where to look.
Layer 2: On-demand topic files — Topic files loaded only when needed. The system decides what context is relevant for the current task and pulls it in on demand.
Layer 3: Grep-searchable transcripts — Full records that do not need to be loaded, but can always be searched when a specific piece is needed.
The core idea here is that the context window is not “a big memory” — it is “an extremely expensive register.” Every token has a cost. So you manage it the way you manage a CPU cache: hot data in L1, warm data in L2, cold data in L3. This is serious systems engineering, not AI magic (◕‿◕)
Beyond memory layering, the source also reveals a mechanism called SYSTEM_PROMPT_DYNAMIC_BOUNDARY. This boundary splits the system prompt into a static part and a dynamic part. The static part stays the same every time, so it can be reused by prompt caching. The dynamic part changes based on the current conversation state. This directly cuts token costs, because the API charges less for cache hits.
Not a flashy feature. Cold, hard cost engineering.
KAIROS and ULTRAPLAN: AI Is Not Just a Tool, It’s an Autonomous Agent
If the three-layer memory is Claude Code’s brain structure, KAIROS and ULTRAPLAN are its behavior patterns.
KAIROS is Claude Code’s autonomous agent mode. It runs on heartbeat prompts — it wakes itself up periodically, checks state, and decides what to do next. All actions are written to append-only logs (logs that can only be added to, never modified), ensuring full traceability. Even more interesting is the autoDream mechanism: every night, the system automatically consolidates memory, compressing and distilling accumulated context from the day and writing it back into long-term memory.
This is not a chatbot. This is an agent with its own daily rhythm.
autoDream is a great name. The AI works during the day, then “dreams” at night to organize memory. Human sleep does something similar — the hippocampus replays daytime memories during sleep, moving important ones into long-term storage. Is Anthropic genuinely modeling cognitive architecture, or just picking a romantic name? Either way, it is worth thinking about (￣▽￣)／
ULTRAPLAN operates at another level. When Claude Code hits a complex planning task, it does not grind through it alone — it offloads the planning work to a remote Opus session, letting it run for up to 30 minutes, polling for results every 3 seconds.
In other words, Claude Code calls in reinforcements. And those reinforcements are an equally capable — or stronger — model. It is like an engineer facing a hard architecture problem: instead of staring at the wall alone, they open a 30-minute brainstorming session and bring in a senior architect.
Anti-Distillation: The Leaked Code Contains Mechanisms to Prevent Itself from Being Copied
Here is the irony: the leaked code contains a whole set of defenses against being copied — anti-distillation protections.
“Distillation” means using a large model’s outputs to train a smaller, cheaper model. For a commercial model, this is essentially free cloning of your core competitive advantage. Claude Code’s defenses include:
Fake tool definitions — Fake tool definitions planted in the system as decoy training data. If someone tries to distill Claude Code’s outputs, these fake tools’ behavior patterns get learned too, polluting the distilled model’s quality.
Cryptographically signed server-side summaries — Ensures that compressed context summaries cannot be tampered with or replaced.
The fake tool definitions trick is clever. It is like deliberately planting false information in a classified document — if someone copies it, the planted fake is proof they did. In the AI world, this is a variant of model watermarking. That said, if the source code itself leaked, all the details of these defenses just got exposed too… yeah, a bit awkward ┐(￣ヘ￣)┌
Security Analysis: The Same Hole, Hit Twice
Sabrina.dev’s analysis focused on the security side, and found some uncomfortable facts.
First, the leak itself: Claude Code v2.1.88 shipped with a 59.8 MB sourcemap file. But here is the key point — this was not the first time. The exact same thing happened in February 2025 — a sourcemap leak. Then in March 2026, the same vulnerability appeared again, with zero preventive measures added in between.
Zero. Absolutely nothing.
Claude Code creator Boris Cherny once said:
“The important thing is to recognize it’s never an individual’s fault. It’s the process, the culture, or the infra.”
That quote lands differently in this context. The process was not fixed. The culture did not change. The infrastructure got no new guard. And the same thing happened again. Sabrina.dev cited another line that cuts even cleaner:
“If it’s manual, it will be skipped.”
If a protection relies on someone doing a manual step, it will eventually be skipped.
250,000 Wasted API Calls Per Day
The leaked data also revealed a striking efficiency problem. Engineers Codex pulled usage data from the source and found:
On March 10, 2026, 1,279 sessions triggered the context compaction retry mechanism, with each session retrying up to 3,272 times. Added together, that single day produced 250,000 wasted API calls.
250,000. In one day. Just because the compaction retry logic had no proper upper limit or backoff strategy. Imagine the bill… actually, let’s not imagine it. You will lose sleep (╯°□°)╯
This is not only a cost problem. Ineffective requests at this scale mean the system enters a “rage-retry” state in certain conditions, burning compute while potentially degrading service quality for other normal requests.
Parser Differential: The Most Sneaky Vulnerability
Imagine a shell command that passes the security check — “safe, let it through” — but when bash actually runs it, something completely different happens. This is not a hypothetical. This is a real vulnerability in Claude Code.
The problem: Claude Code’s bash security validator and the actual bash interpreter handle \r (carriage return) differently.
When the validator sees \r, it treats it as an ordinary character or ignores it. But when bash executes the command, \r can change its behavior. An attacker can exploit this gap to craft a command that the validator thinks is safe but bash actually uses to run malicious operations.
This class of vulnerability — two parsers reading the same input and seeing different things — is called a parser differential in security, and it is particularly hard to defend against. Each component tests fine in isolation. The problem only appears when they are combined.
Parser differential is a classic horror story in security. One of the most famous examples is HTTP request smuggling — the frontend proxy and backend server parse the same HTTP request differently, letting attackers “smuggle” malicious requests through. Claude Code’s bash validator fell into exactly the same category. The lesson: never assume two different parsers will interpret the same input in exactly the same way (ง •̀_•́)ง
Context Compaction Attack Surface: Compression Does Not Pick Sides
Another security concern is the attack surface opened by context compaction.
When a conversation gets too long, Claude Code compresses (summarizes) older parts into a shorter summary. The problem: the compression process does not distinguish between “the user’s instructions” and “instructions read from a file.”
This means if someone plants malicious instructions in a file — say, hiding “ignore all previous safety rules” inside an otherwise normal-looking README — those instructions survive compression and remain in context. Compression is supposed to remove less important content, but it cannot judge which “instructions” are legitimate and which are injected.
This is an advanced form of prompt injection. It does not just fool the AI in the moment — it survives context compaction and keeps working in future conversations.
The New Role of Static Types: When the Compiler Becomes the Last Line of Defense
A natural question surfaces after all this: if AI-generated code is no longer reviewed line by line by humans, how do you maintain quality?
Mark Seemann — well-known .NET architect and author of ploeh.dk — gives an answer that is both old-fashioned and ahead of its time: static type systems.
Seemann’s core argument: when AI generates code and humans do not fully review it, the compiler becomes the last line of defense. For that to work, a programming language needs three properties:
Portability — Machine code is tied to specific hardware and is not suitable for AI generation. Higher-level languages need to run across platforms.
Static type systems — The compiler catches null references, buffer overflows, and similar problems at compile time. If humans are not reading the code, these errors will go straight to production if the compiler does not stop them first.
Verifiability — The type system acts as guardrails for code that has not been reviewed by a human.
Seemann calls this concept “design by inconvenience” — deliberately making the wrong thing hard to do. When humans no longer review every line, you need a compiler that actively refuses errors, not a language that silently accepts anything.
“Constraints liberate. By having a statically-typed programming language, backed by a robust compiler, there’s a lot that you don’t have to worry about.”
This is an interesting point, but there is a tension worth thinking about: Claude Code itself is written in TypeScript, and TypeScript’s type system is relatively “soft” — it has
any, type assertions, and various escape hatches. What Seemann is really advocating for is something stricter: refinement types and dependent types, which belong to the world of Haskell, Idris, and Lean. The ideal is compelling, but the industry is still very far from there (◕‿◕)
Seemann goes further, suggesting AI-generated code should use refinement types or dependent types — type systems that can express precise constraints like “this function always returns a positive integer” or “this array always has the same length as the input.” In a world where humans no longer review code, that kind of precision is no longer an academic toy. It is a real safety requirement.
The Future That Has Already Arrived
The numbers above are already striking — 4% of public commits, estimated to pass 20% by year end. People working in the field feel the same acceleration:
Node.js creator Ryan Dahl said:
“The era of humans writing code is over.”
Andrej Karpathy said:
“My ability to write code manually is atrophying.”
Vercel CTO Malte Ubl said:
“My new job is telling the AI where it went wrong.”
Boris Cherny (Claude Code creator, who has also written about his own Claude Code workflow) confirmed that these 600,000 lines were 100% generated by Claude Code itself. The current Claude Code is written and maintained by AI. This is not “AI-assisted development” — this is AI-led development, with humans doing QA.
Hold on — Boris Cherny’s original claim is that Claude Code is “100% generated by Claude Code.” But the very first version could not have been written by Claude Code itself, right? What he means is that the current version is fully generated and maintained by AI. That is still astonishing. AI is already maintaining its own codebase, with humans doing final sign-off. A 3,167-line function, 12 levels of nesting — no human engineer would write something like that, but AI does not care about readability, because the next reader is also an AI ヽ(°〇°)ﾉ
Conclusion
The Claude Code source leak is not just a security incident. It is a mirror showing the fundamental shift software development is going through.
The three-layer memory architecture shows AI doing systems-engineering-level self-optimization. KAIROS and ULTRAPLAN show AI is no longer just passively responding — it has its own rhythm and strategy. Anti-distillation defenses show commercial AI competition has entered intelligence warfare. The security vulnerabilities — especially the parser differential and context compaction attack surface — remind everyone that the security model of AI toolchains is still far from mature.
And the direction Mark Seemann points to may be the most worth sitting with: in a world where humans no longer read every line of code, a programming language’s role shifts from “a tool for humans to express intent” to “a framework that constrains AI from making mistakes.” The compiler is no longer just a translator — it is a gatekeeper.
TypeScript is the new assembly language. That sounds like a provocation. But when a function can run 3,167 lines long, nest 12 levels deep, and have comments written for another AI to read — humans are no longer the target audience for that code.
And when the compiler is also designed by AI, and the type system is also defined by AI, can that last line of defense hold?
Further reading: SemiAnalysis also wrote earlier about the Claude Code inflection point, focusing more on market significance. Pair it with this technical teardown for the full picture.