Critical Vulnerabilities in Claude macOS App Allow Reverse Tunnels and Persistence

Key Takeaways

• Elastic Security researchers uncovered suspicious activity on a macOS developer machine involving a trusted coding agent.
• The activity included the creation of reverse tunnels, transmission of login credentials to temporary public addresses, and establishment of macOS LaunchAgent persistence.
• While potentially intended for legitimate local application testing, the combination of these actions raises significant security concerns due to the potential for unauthorized access and data exposure.
• The observed behavior highlights the risks associated with dual-use tools and the need for rigorous monitoring of even trusted processes.
• Organizations should implement enhanced monitoring for credentialed HTTP requests, reverse tunnel activations, and new LaunchAgent creations, especially when initiated by AI coding assistants.

A recent investigation by Elastic Security Labs has brought to light a critical security dilemma on macOS developer systems: when does the convenience offered by automated coding agents cross into the realm of dangerous exposure? The research identified a series of events where a trusted coding agent facilitated the opening of reverse tunnels, dispatched sensitive login information to ephemeral public IP addresses, and established persistent access mechanisms via LaunchAgent entries.

This activity deviated from typical malware behavior. Instead, legitimate coding agent processes were observed initiating shell commands and helper utilities that published local applications to the internet, subsequently verifying their external accessibility. This raises significant concerns for development teams, particularly those already grappling with the security implications of AI-powered coding tools.

Elastic researchers initially identified this unusual behavior during a review of endpoint telemetry from July 2026. While acknowledging that the evidence could suggest remote administration of a local dashboard, the confluence of credential transmission, reverse tunneling, and persistence mechanisms necessitates thorough investigation rather than outright dismissal. For enterprises, the ramifications extend beyond individual hosts; exposed dashboards could reveal critical operational data, and persistent tunnels could provide unauthorized users with a backdoor into sensitive developer environments.

Elastic said in a report that the observed session leveraged a trusted coding agent as the parent process, with subsequent actions executed by zsh shells. This detail is crucial, as the trustworthiness of a parent application does not automatically guarantee the safety of every command it spawns.

Claude Code Sessions Spawn Reverse Tunnels

The sequence of events documented by Elastic began with earlier alerts related to tunnel and VPN-like utilities. On July 23, the Claude Code session exploited permission-bypass options, minimizing user approval prompts before its child shells initiated connections to temporary addresses hosted by free tunneling services. This pattern included repeated requests to a login page, followed by the retrieval of application metrics.

Subsequently, one of the shells launched cloudflared to expose a localhost service through a Cloudflare Quick Tunnel. This functionality allows a service running on a local machine to be accessed externally via an outbound connection, bypassing traditional inbound firewall rules. While a legitimate feature, Cloudflare tunnels have also been implicated in stealthy attacks, underscoring the need for careful contextual analysis rather than an automatic benign verdict.

Researchers also discovered an ngrok binary within the project tree. The critical aspect was the observed sequence: authenticated web requests, the establishment of a public route to a local service, and the use of tools capable of maintaining this route. While a temporary hostname alone provides weak evidence, the combination of these events can collectively forge an externally accessible management pathway.

Security teams are advised to categorize agent-parented credential posts and reverse tunnels as high-severity incidents, even if a developer’s intention was merely to test a local application. Investigators should promptly record the destination type, meticulously reconstruct the entire session, and ascertain whether the exposed service was anticipated and adequately secured.

LaunchAgents Turn Temporary Access Persistent

The same session was observed writing and loading macOS LaunchAgent configurations, including a watchdog setup with a 60-second interval. LaunchAgents are capable of automatically launching programs for a user, thereby enabling a tunnel or its associated local application to persist even after the original shell process has terminated. This capability is the fundamental distinction between transient testing and durable, persistent access.

The activity further encompassed process checks for related workloads and a liveness check against the publicly exposed address. Elastic’s “Persistence via GenAI Tool” rule was triggered during this phase. Analysts are urged to preserve process ancestry, command-line arguments, modified .plist files, and network records, then verify whether each component was explicitly approved by the system owner.

The overarching lesson from this incident is that dual-use infrastructure cannot be assessed solely on its reputation. Previous reports detailing TryCloudflare’s use in malware delivery highlight why temporary tunnel services demand rigorous scrutiny, while known Claude Code network sandbox vulnerabilities emphasize the necessity of updating systems and restricting access to sensitive credentials.

What You Should Do

• Maintain high visibility for alerts concerning credentialed HTTP requests, reverse tunnels, and new LaunchAgent creations, rather than automatically closing them simply because a coding agent is present in the process tree.
• Differentiate between benign, noisy child-process activity and actions that lead to concrete security outcomes.
• Restrict dangerous permission-bypass modes within developer tools and environments.
• Thoroughly review all newly created LaunchAgents to ensure their legitimacy and necessity.
• Validate any detected tunnel against a documented and approved developer task.
• Immediately rotate any credentials discovered in command lines or configuration files.
• Remove any unauthorized helper binaries found on developer systems before returning them to service.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.