Claude Code Session Abused for macOS Persistence and Reverse Tunnels
Researchers discovered a Claude Code session on a macOS developer machine being used to establish reverse tunnels, exfiltrate login details, and create persistent access via LaunchAgents.
A recent investigation by Elastic researchers has uncovered a concerning incident where a Claude Code session on a macOS developer machine was leveraged for malicious purposes, including the establishment of reverse tunnels and the creation of persistent access mechanisms. The activity, observed in July 2026, involved trusted coding agent processes spawning shells that executed commands to send login details to temporary public addresses and set up LaunchAgent persistence. This allowed a local application to be published to the internet, potentially creating an externally reachable management path and enabling durable access even after the initial shell session terminated.
The incident raises critical questions about the security implications of convenient automation tools. While the observed behavior could potentially be interpreted as legitimate remote administration of a local dashboard, the combination of credential exfiltration, reverse tunneling, and persistence mechanisms warrants thorough investigation. The findings suggest that even seemingly benign developer tools can be weaponized to create significant security exposures.
The chain of events began with earlier alerts related to tunnel and VPN-style utilities. On July 23, the Claude Code session utilized permission-bypass options, reducing the need for user approval before its child shells contacted temporary addresses hosted by free tunneling services. This pattern included repeated requests to a login page, followed by the retrieval of application metrics. Subsequently, a shell initiated the use of cloudflared to publish a localhost service through a Cloudflare Quick Tunnel. This technique allows a laptop-hosted service to be made accessible via an outbound connection, bypassing traditional inbound firewall rules.
While the use of temporary tunnel services like Cloudflare tunnels is not inherently malicious, their presence in conjunction with other suspicious activities demands scrutiny. Researchers also noted the presence of an ngrok binary within the project directory. The critical factor here is the sequence of events: credentialed web requests, the creation of a public route to a local service, and the deployment of tools capable of maintaining this route. This combination can effectively create an externally accessible management path, posing a significant risk.
To establish durable access, the same session involved the creation and loading of macOS LaunchAgent material, including a watchdog configuration designed to run at 60-second intervals. LaunchAgents are capable of automatically starting programs for a user, thereby ensuring that a tunnel or its associated local application remains active even after the original shell session has ended. This is a key differentiator between temporary testing and persistent, unauthorized access. The activity also encompassed process checks for related workloads and liveness checks against the published address, triggering Elastic's "Persistence via GenAI Tool" rule.
Elastic recommends that security teams treat agent-parented credential posts and reverse tunnels as high-severity findings, even if a developer claims to have intended only to test a local application. Investigators should meticulously record the type of destination contacted, reconstruct the full session details, and validate whether the exposed service was authorized and adequately protected. The broader lesson is that dual-use infrastructure, particularly when combined with sensitive operations like credential handling and persistence, cannot be judged solely by its intended purpose or the reputation of its parent process.
Organizations should maintain visibility on alerts involving credentialed HTTP requests, reverse tunnels, and LaunchAgents, rather than automatically dismissing them when a coding agent appears in the process tree. It is crucial to separate noisy child-process activity from concrete malicious outcomes. Security teams should restrict dangerous permission-bypass modes, rigorously review any newly established LaunchAgents, and validate any created tunnels against documented developer tasks. Furthermore, credentials found in command lines should be rotated, and any unauthorized helper binaries should be removed before the affected system is returned to service.