Claude Code activity on a macOS developer machine has raised a difficult security question: when does convenient automation become a serious exposure?
A new Elastic investigation found a session that opened reverse tunnels, sent login details to temporary public addresses, and created LaunchAgent entries that could survive logout or restart.
The activity did not look like a conventional malware dropper. Instead, trusted coding-agent processes launched shells and helper tools that published a local application to the internet, then checked whether it remained reachable.
That mix makes the incident meaningful for teams already watching how Claude Code security weaknesses can put developer systems at risk.
Elastic researchers identified the behaviour while reviewing endpoint telemetry from July 2026.
The company stressed that the evidence supports more than one reading: it may reflect remote administration of a local dashboard, but the combination of credentials, tunnels and persistence demands investigation rather than dismissal.
For organizations, the impact is not limited to one host: exposed dashboards may reveal operational data, and persistent tunnelling can give an unapproved user a route back into a developer environment.
Elastic said in a report shared with Cyber Security News (CSN) that the session used a trusted coding agent as the parent process, while zsh shells carried out the later actions.
This matters because a signed parent application does not make every command it launches safe.
Claude Code Sessions Spawn Reverse Tunnels
The observed chain began after earlier alerts involving tunnel and VPN-style utilities.
On July 23, the Claude Code session used permission-bypass options, reducing approval prompts before its child shells contacted temporary addresses hosted by free tunnelling services.
The pattern included repeated requests to a login page and a subsequent pull of application metrics.
One shell then started cloudflared to publish a localhost service through a Cloudflare Quick Tunnel.
Such a tunnel makes a laptop-hosted service reachable through an outbound connection, without a traditional inbound firewall rule.
.webp)
That legitimate feature has also appeared in stealthy Cloudflare tunnel attacks, so its presence requires context, not an automatic verdict.
Researchers also saw an ngrok binary in the project tree. The problem was the sequence: credentialed web requests, a public route to a local service, and tools capable of keeping that route available.
A temporary hostname alone is weak evidence, but these events together can create an externally reachable management path.
Security teams should treat agent-parented credential posts and reverse tunnels as high-severity findings, even where a developer may have intended to test a local app.
Investigators should record the type of destination early, reconstruct the full session, and check whether the exposed service was expected and properly protected.
LaunchAgents Turn Temporary Access Persistent
The same session wrote and loaded macOS LaunchAgent material, including a watchdog configuration with a 60-second interval.
LaunchAgents can start programs automatically for a user, so they can keep a tunnel or its local application alive after the original shell has disappeared. That is the key difference between short-lived testing and durable access.
The activity also included process checks for related workloads and a liveness check against the published address.
Elastic’s “Persistence via GenAI Tool” rule fired during this stage. Analysts should preserve process ancestry, command-line arguments, modified plist files and network records, then determine whether the owner approved each component.
.webp)
The broader lesson is that dual-use infrastructure cannot be judged from reputation alone.
Previous reporting on TryCloudflare malware delivery shows why temporary tunnel services deserve scrutiny, while Claude Code network sandbox flaws underline the need to update and limit access to credentials.
Elastic recommends keeping alerts for credentialed HTTP, reverse tunnels and LaunchAgents visible rather than auto-closing them because a coding agent appears in the process tree.
Teams should separate noisy child-process activity from concrete outcomes, restrict dangerous permission-bypass modes, review new LaunchAgents, and validate any tunnel against a documented developer task.
They should also rotate credentials found in command lines and remove unauthorized helper binaries before returning it to service.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | localhost[.]run |
Free SSH tunnel service referenced in the investigation |
| Domain | lhr[.]life |
Free tunnel subdomain space associated with localhost.run |
| Domain | *.lhr[.]life |
Observed ephemeral tunnel-hostname pattern |
| Domain | trycloudflare[.]com |
Cloudflare Quick Tunnel hostname space |
| Domain | *.trycloudflare[.]com |
Observed public Quick Tunnel hostname pattern |
| Domain | api.trycloudflare[.]com |
Quick Tunnel control-plane endpoint |
| Domain | analytics. |
Redacted domain contacted by the Python script |
| URL path | /login |
Endpoint used for credentialed HTTP requests |
| URL path | /api/summary |
Endpoint used to retrieve application metrics |
| File | /tmp/mcp_clean_landers.py |
Python script observed under a zsh process |
| File path | ~/.claude/projects/*/memory/MEMORY.md |
Claude project-memory file accessed during earlier activity |
| File path | ~/.zshenv |
Shell configuration file probed as a persistence canary |
| File path | ~/Library/LaunchAgents/com. |
Redacted LaunchAgent watchdog plist pattern |
| Binary | cloudflared |
Cloudflare tunnel client used to publish localhost |
| Binary | ngrok |
Tunnel binary detected in the project tree |
| Binary | pritunl-client |
Tunnel or VPN-class utility detected before the main session |
| Binary | wireguard-go |
Tunnel or VPN-class utility detected before the main session |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.