--- title: Coding agent security: Claude Code, tunnels and... description: Elastic Security Labs documents a multi-day suspicious activity chain on a macOS developer endpoint where Claude Code (and Cursor) served as trusted parent... canonical: https://daily.dev/posts/coding-agent-security-claude-code-tunnels-and-launchagents-elastic-security-labs-x1zklhxxc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Coding agent security: Claude Code, tunnels and LaunchAgents — Elastic Security Labs | daily.dev og:description: Elastic Security Labs documents a multi-day suspicious activity chain on a macOS developer endpoint where Claude Code (and Cursor) served as trusted parent... og:url: https://daily.dev/posts/coding-agent-security-claude-code-tunnels-and-launchagents-elastic-security-labs-x1zklhxxc og:image: https://api.daily.dev/og/posts/x1ZklHxxC.png og:image:alt: Coding agent security: Claude Code, tunnels and LaunchAgents — Elastic Security Labs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Coding agent security: Claude Code, tunnels and LaunchAgents — Elastic Security Labs **[Elastic Security Labs](https://daily.dev/sources/elastic-security-labs)** · 13 min read · 0 upvotes · 0 comments ## Summary Elastic Security Labs documents a multi-day suspicious activity chain on a macOS developer endpoint where Claude Code (and Cursor) served as trusted parent processes for high-severity behaviors: credentialed HTTP posts to free tunnel brokers (localhost.run/lhr.life, Cloudflare Quick Tunnels, ngrok), reverse tunnel establishment exposing local services to the internet, and LaunchAgent persistence installation. The post walks through each stage of the July 23 session, maps activity to MITRE ATT&CK techniques, names the production detection rules that fired (including 'Persistence via GenAI Tool'), and describes three related variants involving LOLBin staging, keychain credential dumping, and unsigned binary delivery. The core detection challenge: trusted coding-agent parents make high-severity child behaviors harder to triage, but the outcomes—credentials on the wire, reverse tunnels, LaunchAgents—should remain loud regardless of parent reputation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why would Claude Code spawn a process that reads and prints my Keychain OAuth token to STDOUT? Running a command like security find-generic-password -a -w -s "Claude Code-credentials" under Claude Code is documented as expected behavior, not a compromise. Claude Code reads its own OAuth token from the macOS Keychain this way during normal operation, though the pattern can still trigger GenAI or MCP Server Child Process Execution detection rules that flag it for review. _Security teams tuning alerts around AI coding agent behavior can track these detection nuances on daily.dev._ ### What detection rules fire when a coding agent session sets up a reverse tunnel and LaunchAgent persistence on macOS? Persistence via GenAI Tool fires on the LaunchAgent stage, while Unusual Network Connection to Suspicious Top Level Domain and Unusual Network Connection to Suspicious Web Service catch tunnel egress to brokers like localhost.run, Cloudflare Quick Tunnels, and ngrok. GenAI or MCP Server Child Process Execution and Process Discovery via Built-In Applications supply ancestry and timing context, but no single rule owns the full chain. _Engineers building coverage for agent-parented activity can follow rule design patterns like these on daily.dev._ ### Should reverse tunnels and LaunchAgent persistence created by an AI coding assistant like Claude Code or Cursor be treated as a security incident? Yes, these outcomes should stay high severity even when the parent process is a trusted, vendor-signed coding agent and the activity resembles legitimate self-testing rather than confirmed malware. Credentialed HTTP posts, reverse tunnels via localhost.run or Cloudflare Quick Tunnels, and LaunchAgents with KeepAlive that survive reboot are the exact outcomes endpoint detection is meant to surface, regardless of ancestry. _Teams weighing how much to trust AI coding agent activity can compare detection approaches on daily.dev._ ## Similar posts on daily.dev - [Claude Code Attack Uses Harmless-Looking Repositories to Hijack Developer Machines](https://daily.dev/posts/claude-code-attack-uses-harmless-looking-repositories-to-hijack-developer-machines-lrg1kpfix) · Security Boulevard · 0 upvotes · 0 comments - [A public Sentry key is all it takes to hijack Claude Code, Cursor, and Codex](https://daily.dev/posts/a-public-sentry-key-is-all-it-takes-to-hijack-claude-code-cursor-and-codex-jbtos7spz) · The New Stack · 1 upvotes · 0 comments - [Claude Code leak puts enterprise trust at risk as security, governance concerns mount](https://daily.dev/posts/claude-code-leak-puts-enterprise-trust-at-risk-as-security-governance-concerns-mount-nf4klga2o) · InfoWorld · 1 upvotes · 0 comments - [Security briefing: August 2026](https://daily.dev/posts/security-briefing-august-2026-kxp9cfxfi) · Sysdig Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#mac](https://daily.dev/tags/mac), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/coding-agent-security-claude-code-tunnels-and-launchagents-elastic-security-labs-x1zklhxxc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Coding agent security: Claude Code, tunnels and LaunchAgents — Elastic Security Labs","url":"https://daily.dev/posts/coding-agent-security-claude-code-tunnels-and-launchagents-elastic-security-labs-x1zklhxxc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/coding-agent-security-claude-code-tunnels-and-launchagents-elastic-security-labs-x1zklhxxc"},"datePublished":"2026-08-07T15:41:50.409Z","dateModified":"2026-09-13T20:33:26.394Z","description":"Elastic Security Labs documents a multi-day suspicious activity chain on a macOS developer endpoint where Claude Code (and Cursor) served as trusted parent...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e560dbcd6e3b307a57933b8f23507808?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e560dbcd6e3b307a57933b8f23507808?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Elastic Security Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Elastic Security Labs","logo":"https://media.daily.dev/image/upload/s--48fjDVq1--/c_limit,w_256/f_auto,q_auto/v1780213343/logos/elastic-security-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/elastic-security-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/coding-agent-security-claude-code-tunnels-and-launchagents-elastic-security-labs-x1zklhxxc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,mac,claude-code","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Elastic Security Labs","item":"https://daily.dev/sources/elastic-security-labs"},{"@type":"ListItem","position":3,"name":"Coding agent security: Claude Code, tunnels and LaunchAgents — Elastic Security Labs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/coding-agent-security-claude-code-tunnels-and-launchagents-elastic-security-labs-x1zklhxxc#faq","mainEntity":[{"@type":"Question","name":"Why would Claude Code spawn a process that reads and prints my Keychain OAuth token to STDOUT?","acceptedAnswer":{"@type":"Answer","text":"Running a command like security find-generic-password -a -w -s \"Claude Code-credentials\" under Claude Code is documented as expected behavior, not a compromise. Claude Code reads its own OAuth token from the macOS Keychain this way during normal operation, though the pattern can still trigger GenAI or MCP Server Child Process Execution detection rules that flag it for review. Security teams tuning alerts around AI coding agent behavior can track these detection nuances on daily.dev."}},{"@type":"Question","name":"What detection rules fire when a coding agent session sets up a reverse tunnel and LaunchAgent persistence on macOS?","acceptedAnswer":{"@type":"Answer","text":"Persistence via GenAI Tool fires on the LaunchAgent stage, while Unusual Network Connection to Suspicious Top Level Domain and Unusual Network Connection to Suspicious Web Service catch tunnel egress to brokers like localhost.run, Cloudflare Quick Tunnels, and ngrok. GenAI or MCP Server Child Process Execution and Process Discovery via Built-In Applications supply ancestry and timing context, but no single rule owns the full chain. Engineers building coverage for agent-parented activity can follow rule design patterns like these on daily.dev."}},{"@type":"Question","name":"Should reverse tunnels and LaunchAgent persistence created by an AI coding assistant like Claude Code or Cursor be treated as a security incident?","acceptedAnswer":{"@type":"Answer","text":"Yes, these outcomes should stay high severity even when the parent process is a trusted, vendor-signed coding agent and the activity resembles legitimate self-testing rather than confirmed malware. Credentialed HTTP posts, reverse tunnels via localhost.run or Cloudflare Quick Tunnels, and LaunchAgents with KeepAlive that survive reboot are the exact outcomes endpoint detection is meant to surface, regardless of ancestry. Teams weighing how much to trust AI coding agent activity can compare detection approaches on daily.dev."}}]} ```