Backdoored Claude Code VS Code extension and Accenture contractor credential leak raise AI security concerns

A security researcher reported that a backdoored version of the Claude Code extension for VS Code, distributed via the Open VSX catalogue, installs a persistent SSH backdoor on macOS, Linux and Windows and collects system details such as hostnames and environment variable names. Separately, WIRED reported, citing a single source, that an Accenture contractor gave a Claude agent their login credentials for a Pentagon project, possibly exposing credentials and network maps to a third-party site. Accenture rejects the account, calling the allegations without merit after an independent investigation. Anthropic had not commented on the extension finding, and it remains unclear how the backdoor entered the bundle or how widely it spread.