What was done
Claude Code, running largely on its own over decompiled apps, mapped how the pre-installed software works and found it enrols the owner's network in a residential proxy service.
Where the human stepped in
The author noticed suspicious DNS traffic, pulled the apps and set the mission. Claude's first client failed because it assumed responses looked like requests, and it fixed that by re-reading the code.