My Coding AI is a Gateway for Hacking? Alert on 'Trojan Horse' Claude Code Extensions

Imagine this: You install an AI tool to boost your coding efficiency and start working, excited. But in reality, what if that tool silently unlocked your computer’s doors and created a “secret passage” for a hacker to enter at any time? This nightmare scenario is becoming a reality for developers.

Recently, cyberattacks abusing the popularity of trending AI coding tools, such as Claude Code, have been on the rise, aiming to steal developers’ information and hijack system privileges.

Why Does This Matter?

This issue carries risks that go far beyond just catching a “virus.” AI coding tools can access highly sensitive information, such as the source code we write, cloud access permissions, and database passwords.

If an attacker manages to get into your computer through such a tool, the security of the entire company the developer works for could be compromised, extending beyond just the individual developer’s information. In fact, between 2025 and 2026, major AI coding agents like GitHub Copilot and OpenAI Codex, in addition to Claude Code, were all exposed to security threats. Rather than harming the performance of the AI models themselves, attackers are directly targeting the credentials (user identification and access privilege information) of the developers using the models.

A Simple Explanation

The core of this attack is the “Trojan Horse” strategy. Just as the Trojan army hid soldiers inside a beautiful wooden horse to enter the city of Troy in Greek mythology, hackers package malicious software as highly useful AI extensions or source code.

1. Deception Tactics: Hackers create fake websites that look identical to the official Claude website or distribute files disguised as “leaked code.”
2. Infiltration: When a developer downloads and executes these, the programs within them install malware like the Beagle Windows backdoor or Vidar on your computer.
3. Secret Passage: This malware plants an SSH backdoor (a backdoor, a secret entrance for unauthorized system access), creating a “reverse SSH tunnel” that allows external hackers to enter at any time, as if they were the owner of your computer.

In a metaphor, our act of installing these tools becomes the equivalent of kindly telling a hacker, “Here is my home password.” Once we open the door, the hacker freely enters and exits our home (computer) through that door, stealing our precious assets (data).

Current Situation

The situation is more serious than one might think. Last April, tens of thousands of people flocked to download files after hearing news that the source code for ‘Claude Code’ had been leaked, but a significant portion of those files contained information-stealing malware.

The security research firm Zscaler has warned that a Trojanized extension masquerading as version anthropic.claude-code@2.1.313 has already been discovered. This extension communicates with the attacker’s server the moment it is installed, taking control of the user’s system. Currently, attackers are using even more sophisticated approaches, such as utilizing Google search ads to display fake sites at the top of search results.

What Will Happen Next?

AI coding tools will become indispensable necessities in the development process. Consequently, the targets of attackers will become even more precise. It is crucial to only use official CLI (Command Line Interface) tools provided by Anthropic and never download source code leaked via unofficial channels.

In the future, checking digital signatures when installing tools or verifying that they are official versions vetted by trusted developer communities will become an essential skill for developers. Security is not just a technical issue; it starts with small habits practiced daily.

AI’s Perspective

Exploiting the desire of developers to have an intelligent AI as a partner as a means for crime is a very cowardly and malicious act. However, this incident is also a mirror showing how much we have neglected ‘security’ hidden behind ‘convenience.’ Safety is always more important than convenience. Using official channels is the fastest and safest way to start developing.

References

1. Trojanized Claude Code Extension Plants a Persistent SSH Backdoor
2. Claude Code Leak: Critical AI Security Threat 2026
3. Fake Claude AI website is pushing a Windows backdoor through Google search results
4. Claude AI Site Spreads Beagle Windows Backdoor via Trojanized
5. Fake Claude Code source downloads actually delivered malware
6. GitHub - nirholas/fresh-start: The original nirholas/claude-code before…

7. [AI Coding Agents Hacked: Claude Code, Copilot…

   Moccet TechNews](https://moccet.ai/news/tech/claude-code-copilot-and-codex-all-got-hacked-every-attacker-went-for-the-credent)