Recent investigations have uncovered that sessions initiated by Claude Code on macOS systems are establishing reverse tunnels and creating persistent LaunchAgent entries, raising significant security concerns. This activity blurs the line between legitimate automation and potential security vulnerabilities.
Unveiling the Suspicious Activity
Elastic’s research team identified this behavior while analyzing endpoint telemetry from July 2026. The sessions in question utilized trusted coding-agent processes to launch shells and auxiliary tools, which then exposed local applications to the internet and verified their accessibility. Notably, these actions did not resemble typical malware behavior but involved legitimate processes performing potentially risky operations.
The sequence of events began with the Claude Code session employing permission-bypass options to minimize approval prompts. Subsequently, child shells connected to temporary addresses provided by free tunneling services. This pattern included repeated login attempts and retrieval of application metrics. One shell initiated ‘cloudflared’ to publish a local service via a Cloudflare Quick Tunnel, effectively making a locally hosted application accessible externally without traditional firewall configurations.
Persistent Access Through LaunchAgents
Further analysis revealed that the same session created and loaded macOS LaunchAgent configurations, including a watchdog setup with a 60-second interval. LaunchAgents are designed to automatically start programs for a user, enabling the maintenance of a tunnel or its associated application even after the original shell has terminated. This persistence mechanism differentiates transient testing from sustained access.
The activity also encompassed process checks for related workloads and liveness checks against the published address. Elastic’s detection rule, “Persistence via GenAI Tool,” was triggered during this phase, underscoring the need for thorough investigation into such behaviors.
Implications and Recommendations
For organizations, the ramifications extend beyond a single host. Exposed dashboards can reveal sensitive operational data, and persistent tunneling may provide unauthorized users with a pathway into development environments. Security teams are advised to treat agent-initiated credential postings and reverse tunnels as high-severity incidents, even if they appear to be part of legitimate development activities.
Investigators should promptly document the nature of the destination, reconstruct the entire session, and verify whether the exposed service was intentional and adequately secured. Preserving process ancestry, command-line arguments, modified plist files, and network records is crucial to determine the legitimacy of each component.
This incident highlights the evolving security challenges posed by AI-driven development tools like Claude Code. While these tools offer significant productivity benefits, they also introduce new vectors for potential exploitation. Organizations must implement robust monitoring and control mechanisms to balance the advantages of automation with the imperative of maintaining a secure development environment.
