Claude Code for VS Code ↗
Claude Code for VS Code is an officially published IDE extension from Anthropic. Anomity scores its risk at 100 out of 100 (critical). It matches 4 dangerous capability combinations.
Analysis summary
Claude Code for VS Code is an officially published IDE extension from Anthropic. Anomity scores its risk at 100 out of 100 (critical). It matches 4 dangerous capability combinations.
Anthropic's extension that runs Claude Code inside VS Code — the same agent as the CLI, surfaced in the editor with inline diffs, a sidebar session, and the editor's own file context feeding the agent.
The capability surface is that of a full coding agent rather than a completion tool: it reads and writes files across the workspace, runs shell commands through its Bash tool, reaches the network for model calls, and holds an API credential. That combination matches Anomity's full-control pattern, which is the honest description of any agent that can edit and execute. Anthropic-published, so it takes the official trust adjustment; the operational controls that matter are its permission prompts and allow-lists, which should not be blanket-approved on repositories that hold production credentials.
Why this entry scored 100 out of 100
This profile starts at the catalog's neutral base of 50. Because the entry is officially published, trust adjusts the score by -40. Declared high-risk capabilities add +30 (capped at +30). It matches 4 dangerous capability combinations, which contribute additional severity weight. The clamped result is 100, placing it in the critical band.
Findings
-
Published by the vendor Trust offset
-
3 high-risk capabilities: filesystem:write, shell:execute, credentials:access Critical
-
Data exfiltration risk (high) HighEvidenceShell execution combined with outbound network access can exfiltrate arbitrary data from the machine.
-
Credential theft risk (high) HighEvidenceFilesystem write combined with credentials access can plant persistent credential stealers.
-
Persistence + execution risk (medium) MediumEvidenceShell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).
-
Full-control risk (critical) CriticalEvidenceShell + filesystem write + network is effectively a remote shell on the employee machine.
Capabilities
Every capability the entry declares, with the security implication of each.
-
filesystem:readFilesystem readCan read files on the host system. Used for context, indexing, or analysis. -
filesystem:writeFilesystem writeCan create, edit, or delete files on the host system. High-impact capability — anything from helpful edits to planting persistence. -
shell:executeShell executionCan run arbitrary shell commands. Combined with network access this becomes effectively a remote shell. -
network:outboundOutbound networkCan make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access. -
credentials:accessCredentials accessReads provider API keys, OAuth tokens, or other secrets from the host keychain or environment.
Dangerous combinations matched
Capability pairings that compound into well-known attack patterns.
-
Data exfiltration risk highShell execution combined with outbound network access can exfiltrate arbitrary data from the machine.shell:execute network:outbound
-
Credential theft risk highFilesystem write combined with credentials access can plant persistent credential stealers.filesystem:write credentials:access
-
Persistence + execution risk mediumShell execution plus filesystem write means the agent can plant persistent backdoors (e.g. modifying startup scripts).shell:execute filesystem:write
-
Full-control risk criticalShell + filesystem write + network is effectively a remote shell on the employee machine.shell:execute filesystem:write network:outbound