Elastic Security Labs documents a multi-day suspicious activity chain on a macOS developer endpoint where Claude Code (and Cursor) served as trusted parent processes for high-severity behaviors: credentialed HTTP posts to free tunnel brokers (localhost.run/lhr.life, Cloudflare Quick Tunnels, ngrok), reverse tunnel establishment exposing local services to the internet, and LaunchAgent persistence installation. The post walks through each stage of the July 23 session, maps activity to MITRE ATT&CK techniques, names the production detection rules that fired (including 'Persistence via GenAI Tool'), and describes three related variants involving LOLBin staging, keychain credential dumping, and unsigned binary delivery. The core detection challenge: trusted coding-agent parents make high-severity child behaviors harder to triage, but the outcomes—credentials on the wire, reverse tunnels, LaunchAgents—should remain loud regardless of parent reputation.
Table of contents
Coding agent activity analysisObserved activity flowDetecting coding-agent parented chainsConclusionReferencesQuestions this post answers
What is the 'Persistence via GenAI Tool' detection rule in Elastic Security and when does it fire?
The 'Persistence via GenAI Tool' production rule fires when a coding agent such as Claude Code parents the installation of LaunchAgent persistence material. In the documented case, it triggered when PlistBuddy and launchctl were used under Claude Code ancestry to write and load watchdog and tunnel-keeper LaunchAgents (e.g., com.<vendor>.<app>.watchdog.plist) with KeepAlive and 60-second polling intervals. Developers running Claude Code in production environments track detections like this on daily.dev as agent-parented persistence becomes a growing blind spot.
How do free tunnel brokers like localhost.run, Cloudflare Quick Tunnels, and ngrok get abused in coding agent attack chains?
Free tunnel brokers are used to expose local services to the internet without opening inbound firewall ports. In documented agent-parented chains, cloudflared contacts api.trycloudflare.com as a control plane, localhost.run publishes subdomains under lhr.life via SSH, and ngrok binaries are dropped into project trees. Credentials are then POSTed to the public tunnel URL, and LaunchAgents keep the tunnels alive across reboots. Security teams investigating AI coding tool risks find the latest research on these attack patterns on daily.dev.
Does Claude Code reading its own OAuth token from the macOS Keychain count as malicious behavior?
No — Claude Code reading its own OAuth token from the macOS Keychain via 'security find-generic-password -a <user> -w -s "Claude Code-credentials"' is documented expected behavior by Anthropic. The command prints the token to STDOUT and is tracked by the 'GenAI or MCP Server Child Process Execution' building-block rule as an ancestry signal, not a confirmed malicious event. Endpoint teams distinguishing expected agent behavior from actual threats follow coding-agent security research on daily.dev.