Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines. The company said a malicious extension attempted to collect device information and establish remote access, raising questions about security in the AI coding ecosystem.