Who Owns Code That Wrote Itself?
This morning, security researcher Chaofan Shou found something wild on the npm registry. Anthropic accidentally shipped the entire source code of Claude Code inside a source map file. All 512,000 lines of TypeScript. Every feature flag, every tool-call loop, every permission model. Just sitting there because someone forgot to add *.map to their .npmignore.
Within hours, the code was mirrored across GitHub. One repository already has nearly 30,000 stars. Anthropic scrambled to pull the package, but the internet doesn't have an undo button.
Here's the thing, though. The leak is embarrassing. But the real story isn't about a packaging mistake. It's about a legal question that should keep every software company awake tonight.
Boris Cherny says Claude Code writes Claude Code
On March 7, Boris Cherny, the creator and lead engineer of Claude Code, posted something remarkable. "Can confirm Claude Code is 100% written by Claude Code."
He wasn't being cute. Cherny has been public about this for months. In January, he told Fortune he hadn't written a single line of code by hand in over two months. He shipped 22 pull requests in one day and 27 the next, each one "100% written by Claude." Across Anthropic more broadly, the company says between 70% and 90% of all code is AI-generated.
So follow this thread. Anthropic's flagship coding tool was written by that same coding tool. The humans prompted, reviewed, and decided what to build. But the actual expression of the code, the specific arrangement of logic and syntax that constitutes a copyrightable work, was generated by an AI.
And on March 2, 2026, the Supreme Court effectively settled what that means.
The Supreme Court just closed the door
Less than a month ago, the Supreme Court denied certiorari in Thaler v. Perlmutter. That's legal shorthand for: they refused to hear the case, which means the lower court ruling stands. And that ruling is unambiguous.
The D.C. Circuit held that the Copyright Act requires a human author. Period. Dr. Stephen Thaler tried to register a copyright for artwork created entirely by his AI system, DABUS. The Copyright Office said no. The district court said no. The appeals court said no. The Supreme Court said: we're not even going to discuss it.
Human authorship is, as the district court wrote, a "bedrock requirement of copyright."
The Copyright Office reinforced this in its January 2025 copyrightability report. The key line: "prompts alone do not provide sufficient human control to make users of an AI system the authors of the output." What matters is whether the human "actually formed" the creative expression in the work.
Reviewing code, deciding what to build, writing prompts? That's direction. That's creative input. But is it authorship of the code itself? When Boris Cherny says he doesn't "even make small edits by hand," that's a pretty thin thread to hang a copyright claim on.
So what did Anthropic actually lose today?
This is where it gets uncomfortable. If Claude Code was written by Claude Code, and AI-generated works can't be copyrighted, then those 512,000 lines of TypeScript might not be protectable under copyright law. At all.
I want to be precise. I'm not a lawyer. The legal landscape around AI-assisted works is still unsettled. The Copyright Office has said there's a spectrum. If a human makes sufficient creative contributions to the final work, copyright can attach to those human-authored elements. It's a case-by-case analysis.
But Anthropic has a specific problem. They've been loudly, publicly, proudly declaring that their AI writes their code. Boris Cherny's statements aren't buried in some internal Slack channel. They're in Fortune. They're on X. They're part of Anthropic's marketing narrative about how powerful Claude is.
That narrative is now evidence. If Anthropic ever needs to enforce copyright on Claude Code's source, they'll face their own lead engineer's public statements that he didn't write it. That the AI did. The courts have said AI-authored works don't get copyright protection.
The leak didn't put Claude Code in the public domain. Accidental disclosure doesn't waive copyright. But if there's no valid copyright to waive? That's a different conversation entirely.
This isn't just Anthropic's problem
Here's where this gets bigger than one company's bad npm config.
Every major tech company is moving toward agentic coding. GitHub Copilot, Cursor, Windsurf, Claude Code. Developers across the industry are using AI to generate larger and larger percentages of their production codebases. Some companies are bragging about it, the same way Anthropic has been.
Every single one of them should be asking: if our AI writes our code, can we enforce a copyright on that code?
The answer right now is murky at best. The Copyright Office says human authorship has to be more than prompting. The courts say AI can't be an author. And the companies building with AI are in a race to prove how little human involvement their workflows require. Because that's the pitch. That's how you sell the product.
They're building a legal trap for themselves and they don't even see it.
Every open source license just got an asterisk
Now let's talk about the part that could reshape the entire software industry.
Open source licenses (GPL, MIT, Apache, all of them) are built on copyright. The whole mechanism works because the author holds copyright, then grants specific permissions through a license. No copyright, no license. No license, no enforceable terms.
If open source contributions are increasingly AI-generated, and AI-generated code isn't copyrightable, the license attached to those contributions may be unenforceable. You can't license rights you don't have.
Some projects have spotted this already. QEMU banned AI-generated code contributions entirely, partly because the Developer Certificate of Origin assumes a human author. The Linux Foundation has published generative AI policies requiring disclosure of AI involvement. But most projects haven't addressed it. And the practical reality is that AI-generated code is already flowing into repositories everywhere, often without disclosure.
Think about what this means for copyleft. A license like GPL says: if you use this code, your derivative work must also be open source. But if the GPL-licensed code was AI-generated, and therefore not copyrightable, the copyleft obligation might not attach. The license might be a dead letter for those specific contributions.
That's not a hypothetical anymore. That's a live question today for every open source project accepting pull requests.
What should companies do right now?
Congress could act. They could amend the Copyright Act to address AI-generated works explicitly. The Copyright Office has been begging them to, publishing report after report laying out the issues. So far? Nothing.
The courts could refine the line between "AI-assisted" and "AI-generated." There's clearly a spectrum. A developer who writes a detailed spec, generates code with AI, then substantially modifies the output? Probably has a stronger copyright claim. A developer who types "build me a web server" and ships whatever comes back? Probably doesn't. But where exactly the line falls, nobody knows yet.
In the meantime, companies should be doing three things.
First, document human creative contributions to AI-assisted code with the same rigor you'd apply to any other IP asset. If a developer substantially shapes the output, you want a record of that.
Second, think very carefully about how much you brag about AI writing your code. Those press quotes will show up in court. Anthropic is about to learn this lesson the hard way.
Third, audit your open source dependencies for AI-generated content. The license you're relying on might have holes you haven't considered. If the code under that MIT license was generated by an AI, the "license" might just be a text file with no legal teeth.
The real story under the leak
Today's Claude Code leak is a fascinating technical story. An embarrassing mistake. A window into how a leading AI company builds its tools.
But the bigger story is the one hiding underneath. We're building an entire industry on code that might not be ownable. And we're doing it at full speed, eyes closed.
The companies that figure this out first, the ones that start building real documentation of human authorship and auditing their AI-generated code for IP risk, will have a serious advantage when the courts finally draw the line. Everyone else will be scrambling.
This is the conversation we should've started a year ago. Let's not wait another one.