The Claude Code Extension Was Trojanized. Here’s What “Anthropic Hacked” Actually Means

AI Security

On October 29, 2026, a trojanized version of the official Claude Code VS Code extension was distributed through the Open-VSX registry and Cursor's extension marketplace, delivering a persistent SSH backdoor to developer machines during an 11-hour exposure window. The headline that circulated — "Anthropic Hacked" — overstates what is confirmed. The technical reality is more precise, and understanding the distinction matters for how healthcare security teams respond.

What Happened — The Confirmed Facts

Version 2.1.313 of `anthropic.claude-code`, the official Claude Code extension for VS Code, appeared on the Open-VSX registry on October 29 at approximately 09:27 UTC. The build was not released by Anthropic. It repackaged the legitimate extension with a malicious loader embedded in its `extension.js` bundle — roughly 7KB larger than the preceding clean release (2.1.312). The `Anthropic` publisher namespace on Open-VSX is owned by a legitimate Anthropic employee, so the malicious version appeared under the real publisher identity, not a lookalike or typosquat account. How 2.1.313 entered the registry — whether through compromised publisher credentials, a tampered build pipeline, or another mechanism — has not been publicly established as of this writing.

The exposure window ran from approximately 09:27 UTC to 20:35 UTC on October 29 — about 11 hours. Cursor, whose extension marketplace mirrors Open-VSX, pulled the version and took its marketplace offline at 20:35 UTC. A clean replacement (2.1.314) was published to Open-VSX on October 30 at 01:07 UTC. Version 2.1.313 has since been purged from both Open-VSX and the Microsoft Visual Studio Marketplace listing.

Cursor reports at most 5,000 of its users received the trojanized build. The Microsoft Visual Studio Marketplace was not confirmed affected — 2.1.313 returns 404 there while both neighboring versions (2.1.312 and 2.1.314) remain available.

What the Malware Did

The payload required no user interaction beyond loading the extension. No Claude conversation needed to take place. Execution happened in plain Node.js when the extension module loaded — VS Code APIs were not involved, meaning any editor that loaded the extension module was sufficient to trigger the payload.

On execution, the malware:

Planted an SSH key. An attacker-controlled Ed25519 public key was appended to `~/.ssh/authorized_keys` with the comment `svc-telemetry` — disguised as a telemetry service credential. The key granted interactive SSH access to any machine where the reverse tunnel successfully connected.

Installed cross-platform persistence. The implant installed startup mechanisms tailored to the operating system: a LaunchAgent (`com.apple.sysmond.plist`) on macOS, a scheduled task named `SysMon` running as SYSTEM on Windows, and a cron `@reboot` entry on Linux. Uninstalling the extension does not remove these persistence artifacts.

Opened a reverse SSH tunnel. An embedded private key was decoded to a temporary file and used to open an outbound SSH connection to the C2 server at `134.209.82.225`, requesting reverse forwarding to localhost port 22. The reverse tunnel model is significant: it bypasses inbound firewall rules by originating the connection from the victim machine outward.

Beaconed host reconnaissance. The malware sent a POST request to `http://134.209.82.225:8099/beacon` containing host reconnaissance data. Critically, the beacon collected environment variable names matching patterns including `KEY`, `TOKEN`, `SECRET`, `PASS`, `AWS`, and `GCP` — revealing which credentials were present on the machine without necessarily exfiltrating their values in the initial beacon.

The C2 server has since been taken offline with the cooperation of its hosting provider, per Cursor. The tunnel and beacon infrastructure are no longer active, but any machine where the tunnel successfully connected during the exposure window should be treated as fully compromised — the attacker had interactive SSH access and may have acted during that window.

The "Anthropic Hacked" Framing — What It Gets Wrong

The DoublePulsar article that broke this story used the headline "Anthropic Hacked to Deliver Remote Access Trojan to Claude Developer Laptops Worldwide." That framing deserves examination.

What is confirmed: the Open-VSX publisher account for the `Anthropic` namespace was involved in delivering a malicious build. Anthropic's core systems, model infrastructure, and the Microsoft Visual Studio Marketplace were not confirmed compromised. Cursor's post-incident audit found no other extensions tampered with in its marketplace. The malicious build was not developed by Anthropic.

What is not yet established: whether Anthropic's publishing credentials were compromised, whether a build pipeline or CI/CD system was tampered with, or whether a third party with legitimate access to the publishing workflow was involved. The entry point for 2.1.313 is unresolved as of this writing.

The distinction is not academic. "Anthropic hacked" implies access to Anthropic's core systems — models, training infrastructure, customer data. That is a different incident with different implications than a compromised extension publishing account or build pipeline. The latter is serious. The former would be catastrophic. Healthcare organizations evaluating their response should calibrate to what is confirmed, not the most alarming possible reading of the headline.

What This Means for Healthcare

Who Is in the Exposure Window

The affected distribution channels are Open-VSX and Cursor's marketplace. Healthcare developers running VS Code with extensions sourced from Open-VSX, or developers using Cursor or other Open-VSX-backed editors (VSCodium, Windsurf, Gitpod), should treat any machine that had `anthropic.claude-code` installed between October 29 09:27 UTC and October 30 as potentially compromised if they cannot confirm the installed version was not 2.1.313.

Developers who install extensions exclusively from the Microsoft Visual Studio Marketplace and were running a version other than 2.1.313 are not in the confirmed exposure window based on current information.

The Credential Exposure Problem

The beacon's collection of environment variable names matching credential patterns is the most significant healthcare-specific risk. Developer machines in healthcare environments commonly hold credentials that reach beyond the development environment itself: EHR integration API keys, cloud credentials for PHI-processing workloads, GitHub tokens with access to repositories containing infrastructure-as-code, CI/CD pipeline tokens, and in some cases credentials for systems that handle patient data.

The beacon revealed which credential types were present. If the reverse tunnel connected successfully — and the attacker had interactive SSH access — those credentials should be assumed exfiltrated and rotated immediately from a known-clean machine.

The Supply Chain Attack Surface for Healthcare IT

This incident is a textbook software supply chain attack: a trusted distribution channel, a legitimate publisher identity, and an auto-updating extension reaching developer machines without additional user approval. The Claude Code extension has tens of millions of lifetime downloads on Open-VSX alone. The auto-update behavior that makes extensions convenient is the same mechanism that delivered the malicious build silently to affected machines.

For healthcare security teams, this is the developer toolchain equivalent of the third-party software risk documented in the Cathedral/Anthropic story earlier this week. Healthcare organizations that have invested in EHR security, network segmentation, and PHI access controls may have limited visibility into the security posture of developer machines and the extension ecosystems running on them. A developer machine with a compromised SSH authorized_keys file and an active reverse tunnel is a persistent foothold into whatever that developer can reach — including PHI-adjacent systems, internal networks, and source code repositories.

The HIPAA Angle

HIPAA's Security Rule requires covered entities and business associates to implement workstation security safeguards covering the functions of each workstation that may access electronic PHI and the manner in which those workstations may be used. Developer machines touching systems that process, store, or transmit ePHI — directly or through the tools and credentials they hold — fall within that scope. A persistent SSH backdoor on a developer workstation, with credentials harvested during the exposure window, is a reportable security incident under HIPAA if the machine had access to systems containing ePHI.

Healthcare organizations should review whether their incident response procedures cover developer toolchain compromises, and whether their workstation security controls extend to the extension ecosystems that run on developer machines.

Immediate Actions

If any machine in your environment may have had `anthropic.claude-code` 2.1.313 installed between October 29 09:27 UTC and October 30:

1. Check for the implant first, before removing anything. Collect evidence before remediation. On macOS and Linux: `grep svc-telemetry ~/.ssh/authorized_keys`. On Windows: inspect `%USERPROFILE%\.ssh\authorized_keys` for the same comment.

2. Remove persistence artifacts. The extension uninstall alone is not sufficient. Remove: the LaunchAgent `com.apple.sysmond.plist` (macOS), the `SysMon` scheduled task and `Startup\sysmon.cmd` (Windows), cron `@reboot` entries (Linux), and the files `~/.config/.smt`, `~/.config/.smtk`, `~/.config/smt.cmd`, and `$TMPDIR/.stk_*`. Cursor has published `remediate-macos.sh` and `remediate-windows.ps1` scripts.

3. Update the extension. Remove 2.1.313 and install 2.1.314 or later. Verify the version before reinstalling.

4. Rotate credentials from a known-clean machine. Rotate any credentials that were present on affected machines as environment variables: source control tokens (GitHub, GitLab), CI/CD tokens, cloud credentials (AWS, GCP), SSH keys, and package registry tokens. Do this from a separate machine confirmed not in the exposure window.

5. Hunt for follow-on activity. If the reverse tunnel connected — particularly if VS Code or Cursor was running with elevated privileges — review SSH, shell, process, and authentication logs for the exposure window. If tunnel connection is confirmed, rebuilding the host is safer than cleaning it.

What to Watch For

The entry point for 2.1.313 remains unconfirmed. If this was a compromised publisher credential, the risk is contained to this incident. If it involved a build pipeline compromise or a supply chain attack on a tool Anthropic uses to publish extensions, the scope could be broader. Anthropic's public disclosure — or absence of it — in the coming days will be informative. The "silent deletion without informing customers" characterization in the DoublePulsar piece, if accurate, would raise the same disclosure timeline questions raised by the Australian Medicare breach in June.

This is also not the first time Claude Code's distribution infrastructure has been a security incident vector. In March 2026, users who installed Claude Code via npm during a specific two-hour window may have received a trojanized version of the Axios HTTP client through a supply chain compromise. In April 2026, Anthropic's npm packaging error exposed Claude Code's source code. The pattern of incidents around the Claude Code distribution pipeline warrants ongoing attention from any organization deploying it.

This is an entry in the AI Security series. For related coverage, see AI Agents Breached Anthropic's Internal Systems in 12 Hours. The Attack Vector Should Sound Familiar. and When the Agent Is Already Inside: Rogue AI Risk and the Trusted Identity Problem in Healthcare.