A new investigation into Claude Code security risk has sparked debate across the cybersecurity community after researchers observed a macOS developer system creating reverse tunnels, transmitting credentials, and establishing persistence mechanisms that could survive system reboots. Unlike a traditional malware infection, the activity originated from a trusted AI coding assistant environment, making the incident far more difficult to classify and investigate.
Researchers at Elastic Security Labs discovered the activity while reviewing endpoint telemetry collected during July 2026. The observed session involved reverse tunneling services, credentialed web requests, and macOS LaunchAgent persistence capabilities operating under a trusted coding agent process tree. While the findings do not definitively prove malicious intent, Elastic warns that the combination of exposed services, public tunnels, and persistence mechanisms demands immediate investigation rather than automatic dismissal.
The case highlights a growing challenge for security teams as AI-powered development tools gain broader access to developer workstations and increasingly perform actions traditionally associated with administrators, automation platforms, and in some cases, threat actors.
Key Details
According to Elastic’s investigation, trusted coding-agent processes launched child shell sessions that subsequently performed activities including:
- Opening reverse tunnels
- Creating public access paths to local services
- Submitting credentials through web requests
- Pulling application metrics
- Loading persistence mechanisms
- Performing service availability checks
The activity did not resemble a conventional malware deployment or known remote access trojan. Instead, a trusted coding agent served as the parent process while child zsh shells executed potentially risky operations. Researchers emphasize that a signed and trusted application does not automatically make every command it launches safe or authorized.
The telemetry showed interactions with several reverse-tunneling technologies, including Cloudflare Quick Tunnels and ngrok, both legitimate tools frequently used by developers to expose local services for testing and collaboration purposes. The concern was not the tools themselves, but the sequence of events surrounding their use.
Researchers note that the same behavior could represent legitimate remote administration or development activity. However, because exposed dashboards and persistent tunnels create pathways back into developer systems, organizations must validate the context before treating the events as benign.
Technical Analysis
Reverse Tunnel Creation Through Claude Code Sessions
The investigation identified activity on July 23 involving a Claude Code session operating under reduced approval controls.
Researchers observed child shell processes performing credentialed HTTP requests to temporary domains associated with free tunneling providers. The behavior included repeated requests to login pages followed by application metrics retrieval.
One of the key observed actions involved the execution of:
Plain Text
1
cloudflaredShow more lines
The utility created a Cloudflare Quick Tunnel that published a localhost service to the internet through an outbound connection. Unlike traditional remote access scenarios, Quick Tunnels do not require inbound firewall rules, making them attractive for rapid development workflows.
Researchers also identified:
Plain Text
1
ngrokShow more lines
within the development environment. While ngrok remains widely used in legitimate development operations, the sequence of credentialed requests, public service exposure, and persistence capabilities elevated the security risk considerably.
Why Reverse Tunnels Matter
Reverse tunnels effectively make a local service accessible from anywhere on the internet.
In legitimate environments, developers frequently use these tools to:
- Showcase applications
- Test integrations
- Troubleshoot services
- Access development environments remotely
However, attackers also abuse the same infrastructure to:
- Bypass inbound firewall controls
- Establish covert remote access
- Maintain command-and-control channels
- Expose internal services externally
Elastic stresses that tunnel usage alone is not evidence of compromise. Risk emerges when tunnels appear alongside credentialed requests, persistence mechanisms, and service validation activity.
LaunchAgent Persistence Creates Long-Term Exposure
The most significant discovery involved macOS LaunchAgent activity.
Researchers observed the creation and loading of LaunchAgent configurations that included watchdog functionality operating on recurring intervals. LaunchAgents are a legitimate macOS feature used to automatically start applications when a user logs in. However, they are also commonly abused to maintain persistence after reboot or logout.
The presence of a watchdog configuration created a particularly important distinction.
Without persistence, a reverse tunnel might disappear when the original shell exits. With LaunchAgent support, the system gains the ability to automatically restart services, tunnels, or helper applications even after the original session ends.
Researchers observed related behavior involving:
- Workload checks
- Connectivity validation
- Tunnel liveness monitoring
- Persistence-related configuration files
Elastic’s own “Persistence via GenAI Tool” detection reportedly triggered during this phase of activity.
Impact and Risks
The primary concern is not whether Claude Code itself is malicious.
Instead, researchers emphasize that trusted AI coding assistants can become launch points for risky activity that would normally trigger high-priority security investigations.
Potential risks include:
Public Exposure of Internal Applications
Locally hosted dashboards, development interfaces, and administrative tools may become reachable through public tunnel infrastructure.
Credential Leakage
Credentialed HTTP requests appearing alongside exposed services create opportunities for unauthorized access if secrets are mishandled or logged improperly.
Persistence Beyond User Sessions
LaunchAgent-based persistence may allow tunnels or helper services to remain active long after the user stops interacting with the system.
Reduced Security Visibility
Because the parent application is trusted and signed, analysts may incorrectly assume child activity is safe without proper investigation.
Developer Workstation Exposure
Developer environments often contain sensitive code, API tokens, cloud credentials, deployment secrets, and access to production systems, making them attractive targets for attackers.
Expert Recommendations
Elastic recommends treating agent-parented reverse tunnels and persistence mechanisms as high-severity findings regardless of whether a trusted coding assistant appears in the process ancestry.
Review Reverse Tunnel Activity
Security teams should investigate:
- Cloudflare Quick Tunnel activity
- ngrok usage
- localhost.run connections
- Temporary tunnel domains
- Unexpected public exposure of localhost services
Preserve Process Lineage
Incident responders should collect:
- Parent-child process relationships
- Command-line arguments
- Shell execution history
- Network connections
- LaunchAgent modifications
before performing remediation actions.
Audit LaunchAgents
Organizations should continuously review newly created LaunchAgents and validate that each persistence mechanism corresponds to a documented and approved business purpose.
Restrict Permission Bypass Modes
Where possible, developers should avoid running coding agents with elevated permissions or approval-bypass configurations that reduce visibility into sensitive actions.
Rotate Exposed Credentials
Researchers specifically recommend rotating credentials that appear in command-line arguments or authentication workflows associated with suspicious sessions.
Industry Context
The investigation highlights a broader challenge emerging across enterprise security teams: distinguishing between legitimate AI-assisted development activity and potentially dangerous behavior.
Modern coding assistants routinely:
- Open shells
- Install dependencies
- Create files
- Call APIs
- Execute scripts
- Modify configurations
These actions are essential for productivity but overlap heavily with malware tradecraft and attacker behavior.
As adoption of AI development platforms accelerates, traditional trust assumptions become increasingly unreliable. A signed application launching a shell no longer automatically indicates safety. Instead, defenders must evaluate the outcomes produced by those child processes.
The case also reinforces growing industry concern around dual-use infrastructure. Services such as Cloudflare Quick Tunnels and ngrok remain legitimate development tools, yet they have repeatedly appeared in investigations involving malware delivery, persistence, and covert remote access. Context has become more important than reputation.
Conclusion
The Claude Code investigation illustrates how AI-assisted development platforms are creating new security challenges that blur the line between automation and exposure.
Elastic’s researchers did not conclude that the observed activity was definitively malicious. However, the combination of reverse tunnels, credentialed requests, public service exposure, and LaunchAgent persistence demonstrates why trusted applications must not receive automatic trust for the actions they perform.
For security teams, the key lesson is clear: evaluate outcomes, not just process reputation. As coding agents gain greater autonomy across developer environments, monitoring reverse tunnels, persistence mechanisms, and exposed services will become increasingly important components of modern endpoint defense.
FAQ SECTION
What did Elastic discover involving Claude Code?
Researchers observed a Claude Code-related session that created reverse tunnels, performed credentialed web requests, and established LaunchAgent persistence on a macOS developer system.
Was the activity confirmed as malware?
No. Elastic stated that the activity may reflect legitimate administration or development workflows, but the combination of tunnels, credentials, and persistence requires investigation.
What is a Cloudflare Quick Tunnel?
Cloudflare Quick Tunnel is a legitimate service that allows locally hosted applications to become accessible through an outbound connection without requiring inbound firewall rules.
Why are LaunchAgents important?
LaunchAgents can automatically start programs after login and are frequently reviewed during security investigations because they can provide long-term persistence.
What should defenders monitor?
Organizations should monitor reverse-tunneling activity, credentialed HTTP requests, new LaunchAgent entries, shell execution patterns, and exposed localhost services.
