AI-Generated Code: Can Copyright Still Be Claimed? The Lesson from the Anthropic Leak
On March 30, 2026, Anthropic published version 2.1.88 of the package on npm @anthropic-ai/claude-code. Included in this release: a source map of 59.8 MB, containing the entire TypeScript source code for Claude Code, approximately 512,000 lines spread across nearly 1,900 files. The leak was spotted the same day by security researcher Chaofan Shou. It went viral within hours.
Anthropic's reaction was immediate: the company sent thousands of DMCA notices to GitHub to have copies of the code removed. The initial scope covered approximately 8,100 repositories, including legitimate forks of the official public Claude Code repository. Boris Cherny, head of Claude Code at Anthropic, called the operation an 'accident' and retracted it from all but one repository, plus 96 forks.
The paradox is glaring. Just weeks earlier, the same Boris Cherny had stated that 'practically 100%' of Anthropic's code was now AI-generated, with his personal case reaching 100% for over two months. An Anthropic spokesperson later adjusted this figure to 70-90% company-wide, and approximately 90% for Claude Code itself.
Legal question: can copyright be claimed on computer code when it is primarily written by an AI?
The French and European framework: software protected under the condition of originality
Under French law, software is expressly listed among the works of the mind protected by copyright (Article L.112-2, 13° of the Intellectual Property Code). However, like any work, it is only protectable if it is original.
The French Supreme Court (Cour de cassation), in its Pachot ruling of March 7, 1986 (Cass. Ass. Plén., March 7, 1986, n° 83-10.477), defined software originality as 'the author's intellectual contribution' and a 'personalized effort going beyond the mere implementation of automatic and constraining logic'. This criterion is still applied today (notably by the Douai Court of Appeal, April 5, 2018).
European Union law upholds the same requirement. Directive 2009/24/EC of April 23, 2009, on the legal protection of computer programs, states in Article 1, paragraph 3, that a program 'shall be protected if it is original in the sense that it is the author's own intellectual creation'. The Court of Justice of the European Union has clarified that originality implies a creation reflecting the author's personality, expressing 'free and creative choices' (CJEU, July 16, 2009, Infopaq, C-5/08; CJEU, December 1, 2011, Painer, C-145/10).
Logical conclusion: the more the proportion of AI-generated code increases, the harder it becomes to characterize the human intellectual contribution, and the more copyright protection diminishes.
The Human Author Requirement
Copyright law remains structured around one figure: that of the human creator. The Intellectual Property Code refers to the 'author of a work of the mind' (Article L.111-1), without contemplating that a machine could occupy this role. To date, no French jurisprudence has recognized an AI system as an author.
Across the Atlantic, the position is now explicit. In Thaler v. Perlmutter, the District of Columbia Court of Appeals confirmed on March 18, 2025, that the Copyright Act of 1976 requires human authorship for a work to be protected. The U.S. Supreme Court declined to hear the appeal on March 2, 2026, thereby permanently establishing the rule.
This requirement directly impacts Anthropic's case. If we consider the company's public statements (between 70% and 90% of the code written by AI), the identifiable human intellectual contribution to Claude Code becomes more tenuous. For code portions where humans merely guided the model through a prompt or validate an output, the question of originality in terms of copyright remains entirely open.
Other available protections: useful, but insufficient
Copyright is not the only legal instrument for protecting computer code. Three other avenues exist, each with its limitations.
Trade secret (Articles L.151-1 et seq. of the Commercial Code, transposing Directive 2016/943/EU). It protects confidential information of economic value that is subject to reasonable protection measures. However, the secret ceases when the code becomes public, which is precisely what happened in the Anthropic case. Once the source map is downloaded, copied, and disseminated, the secret is lost. DMCA notices can force removal, but not restore confidentiality.
Patent, when the code embodies a patentable technical invention. The path is narrow in Europe (Article 52 of the European Patent Convention, which excludes computer programs "as such"). It only covers elements of invention, not line-by-line code.
Contract law. License agreements, Terms of Use, confidentiality agreements, and non-reverse engineering clauses remain effective as long as the contracting party is identified. They are ineffective against a third party who has never signed.
In practice, copyright has until now remained the primary legal mechanism for protecting computer code. The erosion of this mechanism due to the increasing share generated by AI is not, to date, compensated by other provisions.
What software publishers must acknowledge immediately
The Anthropic case is not insignificant: it is the first major public case where the contradiction between an "all-AI" discourse and a copyright claim takes a judicially traceable form. Future French and European decisions will have implications.
For software publishers, three measures are imperative.
1. Document the human contribution to code writing. For each module, each feature, keep a record of what was designed, written, corrected, and restructured by a human: tickets, commits named, code reviews, specification logs, architectural choices. This documentation will make it possible to characterize the intellectual contribution required by the Pachot ruling and Directive 2009/24/EC.
2. Maintain a record of AI usage in the development pipeline. Which tools, on which modules, with what level of human intervention. This mapping will be useful in case of disputes, but also for responding to intellectual property audits during M&A operations or fundraising.
3. Strengthen other layers of protection. Strict trade secret policy (labeling, access, technical measures), targeted contractual clauses (non-reverse engineering, non-disclosure, exclusivity), and where relevant, consideration of patent protection for inventive technical elements.
Recommendation
Copyright on computer code does not disappear, but it becomes conditional on the traceability of human contribution. The more the AI's contribution increases without documentation, the more fragile the protection becomes.
Before the next release, two concrete actions:
- Implement an internal policy for tracing human contribution in code writing (who wrote what, who reviewed what, which architectural choices are human-driven).
- Audit the existing portfolio to identify at-risk modules (high AI contribution, low traceability) and strengthen alternative protections (trade secret, contract, patent).
The Anthropic leak is a warning. Upcoming litigation will settle the matter. It's better to prepare for it beforehand.
Frequently Asked Questions (FAQ)
Can AI-generated code be protected by copyright in France?
Not as such. French copyright law requires an original work, meaning one that bears the intellectual contribution of its human author (article L.112-2, 13° CPI; Pachot ruling, Cass. Ass. Plén., March 7, 1986; directive 2009/24/CE, article 1, paragraph 3). Code produced exclusively by AI, without human creative intervention, does not meet this condition. The smaller the human contribution, the more fragile the protection.
What is the 'intellectual contribution' required for software protection?
The Pachot ruling defined it as a 'personalized effort going beyond the mere implementation of automatic and constraining logic'. Specifically: architectural, structural, naming, and algorithmic choices that are not dictated solely by technical constraints. European law refers to 'the author's own intellectual creation' (directive 2009/24/CE) and 'free and creative choices' (CJEU, Infopaq, C-5/08).
What exactly happened in the Anthropic code leak in March 2026?
On March 30, 2026, Anthropic published version 2.1.88 of its npm package @anthropic-ai/claude-code with a source map a 59.8 MB file mistakenly embedded. This file contained the entire TypeScript source code for Claude Code, approximately 512,000 lines across nearly 1,900 files. The leak was detected the same day by researcher Chaofan Shou. Anthropic then sent thousands of DMCA notices to GitHub, covering approximately 8,100 repositories, before retracting the action on all but one repository, plus 96 forks.
Is trade secret protection sufficient to protect source code?
No, not in all cases. Trade secret protection (Article L.151-1 of the Commercial Code) only covers information that remains confidential. Once the code is made public, as in the Anthropic leak, trade secret protection is lost. DMCA notices can force removal from platforms, but they do not erase prior downloads or restore the confidential nature of the information.
Can Anthropic claim copyright over Claude Code after stating that 90% of the code was written by AI?
The question is open. Anthropic sent DMCA notices based on copyright law . However, its own public statements (Boris Cherny: "practically 100%", spokesperson: 70 to 90% company-wide, approximately 90% for Claude Code) weaken the argument for human intellectual contribution to the entirety of the code. No judge has yet ruled on this contradiction. Future litigation will put it to the test.
How can software publishers secure their code in the era of generative AI?
Three concrete measures: document human contribution at each stage (design, architectural choices, code reviews, commits with named authors); maintain a register of AI tools used in the development pipeline and the level of human intervention; strengthen alternative protections to copyright (trade secrets with technical and organizational measures, targeted contractual clauses, patents on inventive elements when applicable).
Can an AI be recognized as the author of software?
No, not under current law. The French Intellectual Property Code and Directive 2009/24/EC presuppose a human author. In the United States, the District of Columbia Court of Appeals confirmed on March 18, 2025, in Thaler v. Perlmutter, that an AI cannot be recognized as the author of a work under the Copyright Act. The Supreme Court refused to review the appeal on March 2, 2026.
What other legal protections exist for computer code?
Beyond copyright, code can be protected by trade secrets (as long as it remains confidential), by patent law (when the code embodies a patentable technical invention, within the narrow scope of Article 52 EPC), and by contract (licenses, terms of use, non-disclosure agreements, non-reverse engineering clauses). None of these protections alone replaces copyright.