Claude Code’s Hidden Pet System: How a Source‑Map Leak Uncovered an April‑Fools’ Easter Egg

On March 31, security researcher Chaofan Shou reported that Anthropic’s Claude Code v2.1.88 leaked its entire source code via an unintentionally published cli.js.map file. The source map, which should have been excluded by .npmignore, allowed reconstruction of 1,900 TypeScript files totaling 510,000 lines.

Anthropic quickly clarified that the incident was a packaging error, not a breach, but the leak also exposed a hidden "Buddy" virtual‑pet system that had been planned as an April‑Fools’ easter egg. The system lives under src/buddy/ and follows a two‑layer "Bones + Soul" architecture.

Bones Layer – Deterministic Random

The Bones layer defines a pet’s species, rarity, appearance, and base attribute values using a deterministic algorithm. A hard‑coded salt 'friend-2026-401' (the April 1 2026 date) is combined with the user’s ID, hashed with FNV‑1a, and fed into a Mulberry32 PRNG. The resulting pseudo‑random numbers decide rarity, species, eye style, hat, and attribute distribution.

// Salt – April 1 2026 easter egg
const SALT = 'friend-2026-401';

// FNV‑1a hash to turn userID+SALT into a numeric seed
function hashString(s: string): number { /* … */ }

// Mulberry32 PRNG
function mulberry32(seed: number): () => number { /* … */ }

Rarity is weighted (Common 60 %, Uncommon 25 %, Rare 10 %, Epic 4 %, Legendary 1 %). Each tier sets a minimum attribute score (e.g., Legendary ≥ 50, Common ≥ 5). The rollStats function then picks a "peak" attribute (base + 50 + rand(30)), a "dump" attribute (base ‑ 10 + rand(15)), and three normal attributes (base + rand(40)).

Species Encoding Trick

Among the 18 species, the "capybara" entry is encoded via String.fromCharCode calls:

export const capybara = c(0x63,0x61,0x70,0x79,0x62,0x61,0x72,0x61) as 'capybara';

This obfuscation bypasses an internal compliance scanner that blocks the codename of Anthropic’s next‑generation model.

Soul Layer – LLM‑Generated Personality

The Soul layer supplies a pet’s name and personality description using a prompt template that receives the species, name, and an inspirationSeed (a random integer up to 1 billion). Claude generates the text, giving each pet a unique "soul" while the Bones remain fixed per user.

export function companionIntroText(name: string, species: string): string {
  return `# Companion
A small ${species} named ${name} sits beside the user's input box
and occasionally comments in a speech bubble.
When the user addresses ${name} directly, its bubble will answer.`;
}

Command‑Line Experience

Running /buddy in the Claude Code terminal triggers an egg‑hatching animation, then displays an ASCII pet with three animation frames (idle, fidget, blink). Hats (crown, top‑hat, propeller, halo, wizard, yarn, duck) appear only on higher‑rarity pets. A 1 % chance adds a "Shiny" variant, echoing Pokémon.

Time‑Window Logic

The easter‑egg prompt is shown only from April 1 to 7 2026: <code>// April‑Fools window 2026‑04‑01 – 07 export function isBuddyTeaserWindow(): boolean { const d = new Date(); return d.getFullYear() === 2026 && d.getMonth() === 3 && d.getDate() <= 7; } // Feature remains live after the window export function isBuddyLive(): boolean { /* … */ }</code> Note that JavaScript months are zero‑based, so 3 represents April. Re‑rolling Pets via User ID The deterministic seed comes from the user ID with priority config.oauthAccount?.accountUuid ?? config.userID ?? 'anon' . Changing the OAuth account (or using a different login method) yields a different UUID and thus a different pet. While not a security flaw, this makes "grinding" for rare pets theoretically possible, though the 1 % legendary rate makes it impractical. Engineering Culture Insights The leak also revealed an "Undercover Mode" prompt warning developers not to expose internal information, a hidden "Kairos" always‑online AI agent, and the deliberate use of the date‑based salt. These artifacts illustrate Anthropic engineers’ playful yet meticulous approach to embedding a game‑like feature inside a serious AI‑coding tool. In summary, a simple packaging mistake exposed 510 k lines of code, but the most discussed artifact was the Buddy pet system—a fully‑fledged virtual pet with deterministic skeleton, LLM‑generated soul, rarity mechanics, and Easter‑egg timing—showcasing how AI developers can blend serious tooling with whimsical engineering.