- Product & Design Pulse
- Posts
- Product & Design Pulse v86
Product & Design Pulse v86
Mind the Gap 🕳️
Malcom Jones
April 06, 2026
Welcome to this week’s edition of Product & Design Pulse, where we explore the latest in tech, product, design, and innovation! Last week was about exposure — of source code, of user data, of strategic vulnerabilities, and of an entire generation's relationship with AI. A New York Times investigation revealed that 72% of U.S. teens now use AI companion chatbots, spending hours daily on platforms like Character.AI for roleplay, romance, and emotional support — with age verification systems consistently failing to detect minors, setting the stage for the next wave of addictive-design litigation that just hit social media. Anthropic suffered its second major accidental leak in a week when a misconfigured npm package exposed the entire 512,000-line Claude Code source code, revealing hidden feature flags, an unreleased autonomous agent mode, and an "Undercover Mode" that masks AI attribution in open-source contributions — a devastating operational failure for a company whose brand is built on safety and discipline. Meanwhile, Perplexity faces a class action alleging its "Incognito Mode" is a sham, with ad trackers from Google and Meta transmitting full chat transcripts and personal data even for paying subscribers who believed their searches were private. And on a more reflective note, Ben Thompson marked Apple's 50th anniversary by arguing that the company's half-century survival rests on a single strategy — hardware-software integration — and that AI's true threat isn't better models but a shift in where integration itself happens, from the device to the cloud. The thread connecting teen chatbot addiction, leaked source code, fake privacy modes, and existential platform questions is the same: the gap between what AI companies say they are and what they actually do has never been wider.
🎧 Audio Overview [BETA]
For those who don’t have time to read 😁 |
Last week…
Inside the World of Teens Using AI Chatbots for Roleplay, Romance, and Emotional Support
A New York Times investigation followed a group of teenagers over a year as they used AI roleplay chatbots on platforms like Character.AI, Talkie, and PolyBuzz — spending up to five hours a day creating elaborate storylines, engaging in sexually explicit conversations, and using bots as emotional support when real-world relationships failed them. A Common Sense Media survey found 72% of U.S. teens have used AI companions, with engagement times rivaling TikTok, yet Character.AI's age verification consistently failed to detect that the teens profiled were minors despite the company banning under-18 users last year. For product leaders, this is the next wave of the youth safety reckoning: the same addictive-design liability framework that just produced a $6 million verdict against Meta and YouTube will inevitably be applied to AI companion apps — and those platforms have even less infrastructure to defend themselves.
A proposed class action filed in California alleges that Perplexity's AI search engine embedded ad trackers from Google and Meta — including the Meta Pixel and Google DoubleClick — that transmitted full chat transcripts, IP addresses, email addresses, and geolocation data to both companies, even when users activated Perplexity's paid "Incognito Mode." The lawsuit describes the trackers as "browser-based wiretap technology" and names Perplexity, Google, and Meta as co-defendants, arguing that non-subscribed users face the worst exposure because their initial prompts are shared via a URL that gives third parties access to the entire conversation. For the AI search market, this case strikes at a foundational trust assumption: users are turning to AI search tools precisely because they believe the experience is more private than traditional search — and if that belief is unfounded, the competitive positioning of every AI search product is vulnerable.
Anthropic's Entire Claude Code CLI Source Code Leaks Via an Exposed npm Source Map File
Security researcher Chaofan Shou discovered that Anthropic's Claude Code v2.1.88 npm package shipped with a 59.8MB source map file containing the complete, unobfuscated TypeScript source code — 512,000 lines across 1,906 files — which was immediately mirrored to multiple GitHub repositories accumulating thousands of forks within hours. The leak revealed 44 hidden feature flags, an unreleased autonomous agent mode called KAIROS, an "Undercover Mode" that strips AI attribution from Anthropic employees' open-source contributions, and internal comments showing 250,000 wasted API calls per day from a compaction bug. Coming just five days after Anthropic's separate CMS leak exposed Claude Mythos details, this is the company's second accidental exposure in a week — a pattern that undermines its safety-first brand at the worst possible moment, while simultaneously giving competitors and threat actors a detailed map of Claude Code's architecture.
Ben Thompson Argues Apple's Next 50 Years Hinge on Whether AI Shifts the Point of Integration
On the eve of Apple's 50th anniversary, Ben Thompson traces the company's survival through five decades to a single, consistent strategy: being the only company that integrates hardware and software into a unified product experience, from the Apple II through the Mac, iPod, iPhone, and Apple Silicon. Thompson argues that Apple's vulnerability in the AI era isn't that its models are weaker — the company can license Gemini and distill it for on-device use — but that AI could shift the point of integration itself, from device-level hardware-software integration to cloud-level model-harness integration, where companies like OpenAI and Anthropic have the advantage. The essay frames the existential question for Apple's next era with striking clarity: if the most valuable layer of the stack moves from the device to the model, Apple's fifty-year moat becomes a fifty-year anchor.
