CLAIM-2026-08-06-03
The specific persistence mechanisms are a SessionStart hook in .claude/settings.json and a runOn: folderOpen task in .vscode/tasks.json, each executing a copy of the dropper.
Why it matters
Names the exact keys an engineer greps for on Monday morning. Without them the advice is unactionable.
Sources
- stepsecurit2026chaindrop
- microsoftse2026chaindrop