Anthropic has reportedly been compromised in an attack that used the company as a delivery channel for a remote access trojan aimed at developers running Claude tooling. According to an account published by DoublePulsar, the operation reached developer laptops worldwide, turning a trusted vendor relationship into an infection vector. The report has circulated widely on Hacker News, where readers pressed for details on scope and remediation.
The disclosure arrived alongside a separate warning from security researcher GossiTheDog, who documented backdoors found in what were described as official Claude Code extensions. That post drew 326 points and 84 comments, with developers trading notes on how extension supply chains can be poisoned. Taken together, the two reports suggest a pattern of attacks targeting the tooling layer around AI assistants rather than the models themselves.
Security specialists say the developer laptop is an especially valuable target because it typically holds source code, credentials, and access to production systems. A trojan that survives on such machines can quietly exfiltrate intellectual property or pivot into corporate networks. The fact that the payload was distributed through channels developers already trust makes detection harder and incident response more urgent.
Anthropic has not issued a full public statement in the material reviewed here, and the precise number of affected machines remains unclear. Developers using Claude Code are being advised to audit installed extensions, rotate credentials, and check endpoints for signs of persistence. The episode is a reminder that AI vendors now carry the same supply chain risks as any other software provider, with consequences that extend well beyond their own infrastructure.