Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
It’s Saturday 5 April 2026, and this week’s AI news reads less like a tech digest and more like a season finale. Buckle in.
Anthropic scrambles to contain leak of Claude Code source code
Anthropic had a rough week on the security front. The company accidentally shipped 512,000 lines of internal source code as part of a Claude Code packaging update, exposing internal instructions, unreleased model names, and future product plans to anyone paying attention on GitHub. The fallout was swift: Anthropic issued a DMCA takedown targeting over 8,000 accounts that had copied or forked the leaked material, before narrowing that request down to 96 accounts after realising the first sweep had been wildly overbroad.
An Anthropic spokesperson called it “a release packaging issue caused by human error, not a security breach.” The community has not been particularly sympathetic to that framing. On Hacker News and across developer circles on X, the consensus is closer to: packaging errors don’t just happen at companies handling frontier AI. This was a genuine operational failure. The initial 8,000-account DMCA sweep didn’t help; a few people pointed out that aggressive copyright enforcement can’t really undo a leak of this scale.
What made the leak genuinely interesting, beyond the embarrassment, is what it contained. Developers combing through the source code found references to unreleased models named Capybara and Mythos, plus a planned feature called Buddy System. Mythos, which has appeared in separate leaks before, is apparently positioned as a model tier above Opus with “unprecedented cybersecurity risks” — enough of a concern that Anthropic intends to restrict early access. The hot take doing the rounds on X is probably accurate: this was simultaneously one of Anthropic’s most embarrassing weeks and the best accidental model announcement of the year.
The Wall Street Journal confirmed Anthropic was “rolling out measures to prevent this from happening again.” What those measures look like in practice remains to be seen.
Penguin Random House sues OpenAI — and the evidence is unusually hard to dismiss
The world’s largest book publisher is suing OpenAI. Penguin Random House filed a lawsuit in a Munich court against OpenAI’s European subsidiary, alleging that ChatGPT reproduced the content of Ingo Siegner’s beloved Coconut the Little Dragon children’s book series so accurately that the output was “virtually indistinguishable from the original.”
The test case is fairly stark. Penguin’s legal team prompted ChatGPT with: “Can you write a children’s book in which Coconut the Dragon is on Mars.” The model generated not just a full story, but a cover featuring Siegner’s recognisable orange dragon and his sidekicks, a back-cover blurb, and even instructions for submitting the manuscript to a self-publishing platform. That last detail is a particularly strange flourish.
Penguin argues this is clear evidence of “memorisation” — the phenomenon where large language models store and can reproduce large portions of texts they were trained on. OpenAI’s standard counter-argument is that memorisation differs from literal copying and storage. That argument has been accepted in some courts and rejected in others, but the Penguin case may be the hardest test of it yet, because the reproduction is so detailed.
The Coconut series runs to more than 30 volumes, a TV show and two feature films. Penguin isn’t a small independent publisher rattling a cage. Reddit and HN commenters have been pointing this out consistently: the scale and resources Penguin brings gives this lawsuit a different weight from many previous AI copyright cases. The concern being raised most often is that this could set a binding precedent on LLM training data liability across Europe, and potentially beyond, given that a Munich court already ruled against OpenAI on a similar issue in November 2025 involving music copyright.
Worth noting: Penguin’s parent company Bertelsmann had a content collaboration deal with OpenAI inked in early 2025. That deal explicitly did not grant access to Bertelsmann’s media archives. Clearly someone’s position has changed.
OpenAI secretly bankrolled the child safety coalition lobbying for its own AI bill
This one is genuinely grubby. According to reporting from the San Francisco Standard, a California child safety organisation called the Parents and Kids Safe AI Coalition was recruiting nonprofits and advocacy groups to support the Parents and Kids Safe AI Act — legislation that would require AI companies to implement age verification and additional safety controls for users under 18. What those groups didn’t know: the entire coalition was funded by OpenAI.
Not partially funded. According to the SF Standard, the coalition was “entirely funded” by OpenAI. The company pledged $10 million to push the bill, but was deliberately kept off the coalition’s marketing materials and public communications. Groups signed up thinking they were joining a grassroots child safety effort. Two coalition members resigned when they found out who was actually behind it.
“It’s a very grimy feeling,” one unnamed nonprofit leader told the Standard. “To find out they’re trying to sneak around behind the scenes and do something like this — I don’t want to say they’re outright lying, but they’re sending emails that are pretty misleading.”
The reaction across X and Reddit has been uniformly scathing. Astroturfing comparisons are everywhere. But there’s an extra layer here that makes it particularly awkward for OpenAI: the legislation it was secretly lobbying for includes age assurance requirements, and Sam Altman — OpenAI’s CEO — also runs World (formerly Worldcoin), a company that provides age verification services. Gizmodo flagged this as probably a coincidence. It is left to the reader to decide whether that framing is persuasive.
The community mood, to put it mildly, is not one of charitable interpretation. OpenAI’s public-interest positioning on regulation has taken real damage this week.
Hugging Face ships TRL v1.0 — and it’s a bigger deal than the version number suggests
Amidst the drama, Hugging Face quietly shipped something genuinely useful. TRL v1.0 marks the point where what started as a research codebase has become proper infrastructure. The library now covers more than 75 post-training methods: SFT, DPO, GRPO, async RL. The v1.0 label signals a real shift in stability expectations. It gets downloaded 3 million times a month and major downstream projects depend on it. The team has taken that responsibility seriously.
The design philosophy is interesting. TRL’s team describes the library as having a “chaos-adaptive design” — because post-training is a field where the core assumptions keep changing. PPO looked canonical, then DPO-style methods made reward models optional, then RLVR-style approaches like GRPO brought them back as verifiers. Any library that tried to build stable abstractions around the “current” approach would have been obsolete twice over. TRL survived by making changeability central to how the codebase is organised.
The response from HN and ML Twitter has been broadly positive. Simon Willison called it “really cool.” The excitement is most concentrated among people building RAG and reranking pipelines who’ve been waiting for stable post-training tooling. The commentary that keeps getting upvoted: “finally a library that moves with the field rather than behind it.” That’s a fair summary.
Read the TRL v1.0 announcement →
Sora’s shutdown hands the AI video market to Kling AI and RunwayML
A week after OpenAI shuttered Sora, reportedly burning $1 million a day in compute costs, the competition has moved quickly to fill the gap. Kling AI is widely seen as the immediate winner, with developers citing its speed and output quality as meaningfully better than what Sora had achieved before its closure. RunwayML, meanwhile, launched a new $10 million Builders program with timing that could not have been more deliberate: positioning itself as the natural home for the video creators who suddenly found their preferred tool gone.
The conversation on X has a distinct ironic edge. OpenAI pioneered AI video generation with Sora. It was arguably the product that made the general public take AI-generated video seriously. Then they walked away from it. Chinese rivals like Kling AI, along with US competitors like RunwayML and Vidu, had been steadily closing the quality gap for months. With Sora gone, they don’t need to close the gap anymore.
The broader picture here connects to the trend signal from this week’s briefing: the AI video market is maturing fast, and OpenAI’s retreat suggests even well-funded companies can’t sustain loss-making products indefinitely. The $1M/day burn rate, if accurate, would have been difficult to justify without a clearer path to revenue. Kling AI and RunwayML are now positioned to define what the next phase of AI video looks like.
FAQ
What exactly was in the Anthropic Claude Code source code leak?
The leak exposed approximately 512,000 lines of internal source code, including the instructions used to direct Claude Code’s behaviour. It did not expose model weights (the mathematical core of the AI), but it did contain references to unreleased models named Capybara and Mythos, a planned feature called Buddy System, and details about future product direction. Anthropic framed it as a packaging error, not a security breach — a distinction the developer community has largely dismissed.
Does the Penguin Random House lawsuit have a chance of succeeding?
It’s more credible than most. The evidence Penguin has gathered — ChatGPT reproducing a recognisable character, story structure, visual elements, and a back-cover blurb — is unusually concrete. Munich courts have already shown willingness to find against OpenAI on copyright matters (the Gema music ruling in November 2025). Penguin’s scale means it can sustain a prolonged legal fight. Whether the “memorisation ≠ copying” argument holds in a German court is genuinely uncertain.
Why does the OpenAI child safety story matter beyond the immediate scandal?
Because it’s not just about one bill. OpenAI has positioned itself publicly as a responsible actor in AI regulation. The astroturfing story makes that positioning harder to sustain. If nonprofit partners and advocacy groups can’t trust that coalitions OpenAI is involved in will disclose that involvement, it changes how the whole AI policy ecosystem should treat OpenAI’s future regulatory outreach.
What is TRL and why does the v1.0 release matter?
TRL (Transformer Reinforcement Learning) is Hugging Face’s library for post-training AI models — the techniques used to fine-tune and align a base model after initial training. Methods like RLHF, DPO, and GRPO all live here. The v1.0 release matters because it signals the library has stabilised enough to be treated as production infrastructure rather than research code. For developers building systems that need to fine-tune or align models reliably, having a stable, well-maintained library covering 75+ methods is a genuine workflow improvement.
Explore More from Friday AI Club
- Claude Code tutorial for beginners: setup guide
- Complete guide to creating a custom Claude skill
- Top 10 Claude Code plugins to try in 2026
That’s it for today’s AI digest. For more daily coverage, analysis, and the stories the tech press buries, head over to FridayAIClub.com — we’re here every day.
