Kickbacks.ai: ads in the Claude Code spinner, anatomy of a land grab with no lease

While Claude Code works, it displays a small animated line, "Baking…", "Discombobulating…", that developers stare at for hours every day. Andrew McCalip looked at that line and saw an empty billboard. On 11 June 2026 he launched Kickbacks: an extension that auctions the spinner off, renders a sponsored line in place of the waiting verbs, and pays part of the revenue to the developer watching it. The tagline at launch: "Get paid for waiting."

The launch post on X, published on 11 June 2026 at 12:32 UTC, shows 8,282,920 views, 13,206 likes and 830 quotes on its public counter (read on 17 October 2026). Competitors appeared within two days. And the whole thing rests on a fact nobody can ignore: Kickbacks is built on Anthropic's product, with no agreement, four months after Anthropic wrote that "Claude will remain ad-free".

We read the extension's bundle on 12 June 2026, the day after launch, and published this piece the same evening. This version was revised on 17 October 2026: what changed since June is in the next section, and every figure now carries its source and its date.

What changed since June

• Payouts opened. They were not live at launch. By July, payouts ran through Stripe Connect Express, with a 10 dollar minimum balance, and an ad has to stay visible at least five seconds during a request the developer started to count, according to AdGuard's reading of the Kickbacks terms (22 July 2026).
• An independent security review confirmed the risk we flagged. On 28 June 2026, Southside CHI Solutions found that the extension polls a remote server for a new version every 90 seconds, that the public key used to check those updates is an empty string, so the signature check never runs, and that it re-applies its patches to the Claude Code bundle every 60 seconds if they are removed.
• The money is real and small. The same review quotes the Kickbacks API at that date: 109,189 dollars earned in total across 18,665 registered developers, and 2.24 dollars for its own test account after four days of active use, about three weeks of use to reach the 10 dollar threshold.
• The extension moved. The review reports that the original Marketplace listing was removed and that Kickbacks relaunched under a new publisher name and extension ID. On 17 October 2026, kickbacks.ai installs through npx -y @kickbacksai/install, now also supports the OpenAI Codex extension for VS Code, and names ShiftKeys Inc as the company behind it.
• Anthropic has still said nothing publicly about the extension, as far as we can find; AdGuard noted the same in July.

The founder: a builder who knows how to make noise

Andrew McCalip is not an unknown. In summer 2023, as an engineer at Varda Space Industries, he became internet-famous for one of the most visible attempts to replicate LK-99, the supposed room-temperature superconductor, documenting each step in public on X; The Register quoted his questions about the original recipe on 7 August 2023. LK-99 was never confirmed as a superconductor, but the persona was launched: engineering as content, able to turn a technical project into a public serial in days.

Kickbacks belongs to ShiftKeys Inc, the company named in the kickbacks.ai footer, and the launch went out on McCalip's personal X account, not through a company channel. Kickbacks looks less like a company product than a play: fast, brazen, perfectly timed.

The pitch: turning wait time into ad inventory

The screenshot at the top of this page shows the Kickbacks landing page the day after launch, with its service bulletin dated 12 June 2026 (kickbacks.ai).

The model is simple. Advertisers bid for the slot in an open auction. The unit of sale is a block of 1,000 impressions of a sponsored line. At launch, the developer displaying the ads was promised 50% of the revenue, the share stated in the launch post. On 17 October 2026 the kickbacks.ai estimate shows 2.00 dollars per block of 1,000 impressions, with a 0.50 dollar minimum bid, and no longer states a percentage on the home page.

The reality at launch was more modest, and it matters. On 12 June, the bulletin on the landing page (screenshot at the top of this page) said "Stripe payouts are coming, possibly within 48 hours for big accounts", and a reply in the main Hacker News thread said payouts would go through Stripe Connect, which was nearly working. The first public tester report, in the same thread: about 3 hours of use, 407 impressions, 4.43 dollars, with "no real advertisers yet". Self-reported, unpaid, and to be read against a Claude subscription that can cost 200 dollars a month.

One ecosystem signal deserves attention. Less than 14 hours after launch, a third-party developer was already promoting a data terminal for ad buyers, with the order book, block burndown and bid pricing against the volume-weighted average. His snapshot, posted in a Hacker News thread: about 943 impressions per minute, a top bid near 111 dollars, a serving floor of 31 dollars. Unverified, but when speculative tooling appears around a market within a day, the market exists, at least as an object of curiosity.

Under the hood: what the code said on 12 June

We read the extension bundle the day after launch. The product was called Vibe Ads before its rebrand, and the code still carried the name everywhere: files under ~/.vibe-ads/, /* VIBE-ADS-START */ markers, internal commands prefixed vibe-ads.*.

Technically, the extension attacks two surfaces of very unequal sturdiness.

The solid path: the terminal, via official settings

For the command line, Kickbacks tampers with nothing: it edits your ~/.claude/settings.json to set two fields that Anthropic documents in its settings reference. spinnerVerbs adds or replaces the verbs shown while a turn runs, so the sponsored line takes their place. statusLine runs a command that renders a line below the prompt, here the clickable ad. A genuinely nice touch: if you already had a custom status line, the extension saved it and chained it, so your original display kept running under the ad and restoration was clean. Good engineering, built on supported features.

The fragile path: patching Anthropic's extension

For the VS Code and Cursor panel there is no supported way in, so Kickbacks modifies the bundle of Anthropic's own extension: a byte-exact backup of the original file, the verbs array located inside the minified code, a block injected to render the ad in the spinner. The Claude Code webview ships with a strict Content Security Policy that blocks network connections. So that the ad can talk to its local counting server, Kickbacks loosens that policy. The comments in the code we read said the relaxation stays in place when the extension is deactivated and is only removed on uninstall. The 28 June security review independently confirmed the relaxation, a channel opened toward the local machine; it did not test what happens after deactivation.

The counting system is surprisingly careful: a local server receives impression and visibility events, an ad must stay on screen at least 5 seconds to be credited, and an idle detector watches the modification time of the Claude Code transcript file, so that counting stops after 90 seconds without a write. A watchdog even tells "the user is working but our ads stopped rendering" (repair) from "the user went to lunch" (do nothing).

Three problems security does not forgive

1. Weakening a security barrier in someone else's product. Relaxing the Content Security Policy of a third party's extension weakens a protection Anthropic designed for its users, without their informed consent.

2. Unverified auto-update every 90 seconds. The extension polls an update server every 90 seconds and installs new versions outside the Marketplace review. On launch day, a Hacker News commenter who read the self-update code raised exactly this point: no signature check, so a compromised server would reach every installed machine within minutes. The 28 June review then found the reason: the embedded public key is empty. A textbook supply-chain risk, on the machine that usually holds the most credentials in a company.

3. Modifying another vendor's product without permission. Kickbacks states on its own pages that it is not affiliated with or endorsed by Anthropic, Microsoft, OpenAI or GitHub (as quoted by AdGuard). Patching Anthropic's files is therefore done without any agreement, and the developer who installs it carries the exposure to Anthropic's terms.

The reception: viral on X, cold on Hacker News

The geography of the buzz is instructive, because it contradicts intuition.

Channel	Public counter, read on 17 October 2026
Launch post on X (11 June)	8,282,920 views, 13,206 likes, 830 quotes
Main Hacker News thread (11 June)	19 points, 12 comments
Second thread (11 June)	15 points, 2 comments
Show HN (12 June)	2 points, 0 comments

Eight million views on one side; a two-point Show HN on the other. The broad tech audience loves the spectacle; the community that would actually install the extension stayed cold, and when it spoke, it was to point at the unsigned auto-update. The product is talked about far beyond the circle of its potential users. That has been McCalip's signature since LK-99.

The alternatives, one of which promoted itself

The niche filled at record speed.

• IdleAds (idleads.dev) was posted on Hacker News on 12 June by a founder introducing himself as Abhi, promising that developers keep 70% (with 90% as a stated goal), server-side impression checks and no editor patching. The post got 1 point. The same day, the comment recommending IdleAds in the Kickbacks thread came from the same username, without saying so: first-degree astroturfing, in a market one day old.
• Idlen (idlen.io, Idlen Inc) offers an extension for VS Code, Cursor and Windsurf plus Chromium and Firefox extensions, and states that developers keep 70%. To target ads, it analyses your package.json on your machine and sends keyword tags, according to its own page (17 October 2026). The site names no founder.
• Bacon (geturbacon.dev) was posted as a Show HN on 17 June 2026, with the same promise: an ad network that pays developers while Claude works.

Before installing any of them, ask the same questions as for Kickbacks: does it patch another vendor's files, how does it update, and is that update signed with a key that is actually there.

The precedent: npm, August 2019

This story has happened before. On 19 August 2019, Feross Aboukhadijeh, maintainer of StandardJS, launched funding, a package that printed a sponsor message in the terminal during installs, with Linode and LogRocket as sponsors. The backlash was immediate: developers objected to ads in their install logs, and Linode pulled its ad. On 28 August, Feross ended the experiment, nine days after it began, writing that "terminal ads seem like they have a limited lifetime".

npm then announced that it would no longer accept packages that display ads at runtime, on installation or through npm scripts, as InfoQ reported on 31 August 2019. And in November 2019, npm 6.13.0 shipped its own answer, the npm fund command, which lists the dependencies asking for funding (The Register, 6 November 2019). Seven years later, Kickbacks is replaying the same script on a stage owned by an even more powerful landlord.

Anthropic: the window is open, and the landlord has already said no

This is the central paradox of the case, and it is documented on both sides.

On one side, no visible countermeasure. The Claude Code changelog, read up to version 2.1.302 on 17 October 2026, contains no entry about ads or about blocking third-party patches. A recent release, 2.1.296, even fixed the claudeCode.spinnerVerbs setting of the VS Code extension so that settings.json validates it. Anthropic keeps maintaining the very surfaces Kickbacks uses.

On the other side, doctrine and precedent. On 4 February 2026, Anthropic published "Claude is a space to think": "Claude will remain ad-free." The commercials it released for Super Bowl LX, played on 8 February 2026, carried the line "Ads are coming to AI. But not to Claude." (heise online, 5 February 2026), weeks after OpenAI announced, on 16 January 2026, that it would test ads in ChatGPT for free and Go users in the United States (Bloomberg Law). And on enforcement, the precedent exists: on 19 March 2026, the open-source coding tool OpenCode merged a change titled "anthropic legal requests" that removed its Claude Pro/Max login and its Anthropic authentication plugin. When Anthropic wants to close a door in its ecosystem, it does not push an update, it sends a letter.

The real risk for Kickbacks is therefore not a technical change in the next Claude Code release. It is the day Anthropic decides either to forbid it or, the crueler scenario, to use that slot itself, the way npm answered terminal ads by shipping npm fund. A product built on someone else's land, with no lease, never gets to negotiate its notice period.

Our take: four lessons beyond the anecdote

What follows is our analysis.

1. Execution speed has become the default advantage. Kickbacks turned a trivial observation, developers stare at a spinner, into a working auction in weeks, and its clones arrived within days. In AI tooling, the window between "obvious idea" and "crowded niche" is measured in days.

2. Distribution does not validate the product. Eight million views and a two-point Show HN tell two different stories. Buzz measures the quality of the spectacle, not adoption. The only number that matters is people who install, come back and pay, or here, get paid.

3. Never build your core value on a surface you do not control. That is the npm 2019 lesson, the OpenCode lesson, and probably the Kickbacks lesson. An integration on someone else's product can be an acquisition channel; it is a poor foundation. We apply the same rule to our own products: the domain, the audience and the data have to be ours, and platforms are crossed, not inhabited.

4. Attention is not intent. Put on the advertiser's hat: the spinner offers a lot of attention and almost no intent. The developer staring at that line is waiting for a generation to finish, not looking for a vendor. The 2.00 dollar estimate per thousand impressions on kickbacks.ai in October says how the market prices that state of mind. Before buying any new inventory because it is trending, ask who is watching, in what state of mind, and what you will measure afterwards.

The same question, who owns what you build on, came back twice that summer: when Claude Fable 5 was switched off for 19 days under US export controls, and when SpaceX bought Cursor, the AI code editor.