Elastic Security analyzed a macOS developer endpoint where Claude Code and related coding-agent activity parented credentialed HTTP requests, reverse tunnels, and LaunchAgent persistence across free tunnel services like localhost[.]run, Cloudflare Quick Tunnels, and ngrok. The article highlights how these dual-use behaviors can resemble legitimate local admin access while still producing high-severity outcomes that are difficult to triage. #ClaudeCode #Cursor #CloudflareQuickTunnels #ngrok #localhostrun
Keypoints
- Elastic investigated a macOS developer workstation where Claude Code and related agent activity generated suspicious endpoint telemetry.
- The observed chain included credentialed HTTP requests to tunnel-published URLs, reverse tunnels, and LaunchAgent persistence.
- Free tunnel providers such as localhost[.]run / lhr[.]life, Cloudflare Quick Tunnels, and ngrok appeared in the same session.
- Immediate child processes were often shells like zsh and helper utilities rather than Claude Code directly executing every action.
- The activity looked like a local admin dashboard being exposed and accessed remotely, which complicates triage because the parent process is trusted.
- Production detections fired for suspicious network connections, persistence via GenAI tooling, process discovery, and GenAI child-process behavior.
- The article stresses that high-severity outcomes should remain visible even when the parent is a vendor-signed coding agent.
MITRE Techniques
- [T1090 ] Proxy: External Proxy – Used to expose a local service through reverse tunnels and free tunnel brokers, making the endpoint reachable from the internet (‘publish localhost’, ‘reverse tunnel’, ‘Cloudflare Quick Tunnel’, ‘ngrok’).
- [T1133 ] External Remote Services – The session authenticated to tunnel-published URLs and accessed exposed services over the internet (‘authenticate over HTTP(S) to a tunnel-published URL’).
- [T1053.007 ] Scheduled Task/Job: Launchd – Persistence was established with LaunchAgents and reloaded with launchctl to keep access alive (‘LaunchAgent material was written and loaded’, ‘launchctl bootstrap’).
- [T1059.004 ] Command and Scripting Interpreter: Unix Shell – Shells such as zsh executed the follow-on commands under the coding-agent parent (‘immediate children were usually shells (zsh) under Claude Code’).
- [T1105 ] Ingress Tool Transfer – A binary was pulled over HTTP and used on the endpoint, including tunnel tooling and an unsigned binary in related cases (‘pulled an unsigned binary over plaintext HTTP’, ‘ngrok binary’).
- [T1555.001 ] Credentials from Password Stores: Keychain – A related Cursor case attempted to dump keychain material for OAuth data (‘tried a decrypted keychain dump’, ‘Credential read’).
- [T1082 ] System Information Discovery – Process checks and discovery-oriented actions were used to verify related workloads and activity (‘check related processes’, ‘pgrep patterns’).
Indicators of Compromise
- [Domains / tunnel hosts ] credentialed access and reverse-tunnel activity – lhr[.]life, trycloudflare[.]com, api.trycloudflare[.]com
- [File names ] helper, script, and persistence artifacts – /tmp/mcp_clean_landers.py, MEMORY.md
- [File paths ] agent memory and LaunchAgent locations – ~/.claude/projects/*/memory/MEMORY.md, ~/Library/LaunchAgents/com…watchdog.plist
- [Process / command examples ] suspicious agent-parented activity – curl -X POST to /login, curl to /api/summary, cloudflared tunnel –url http://localhost:
- [Application / tool names ] dual-use tunnel and agent tooling – Claude Code, Cursor, cloudflared, ngrok, PlistBuddy, launchctl
Read more: https://www.elastic.co/security-labs/coding-agent-launchagent-tunnel-detection