{"id":75462,"date":"2026-08-10T03:44:48","date_gmt":"2026-08-10T07:44:48","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=75462"},"modified":"2026-08-10T03:44:48","modified_gmt":"2026-08-10T07:44:48","slug":"claude-code-reverse-tunnel-exposure","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/claude-code-reverse-tunnel-exposure\/","title":{"rendered":"Claude Code Sessions Expose macOS via Reverse Tunnels"},"content":{"rendered":"

The boundary between developer productivity and security exposure has never been thinner than it is in the age of AI-assisted coding. A new investigation by Elastic Security Labs has drawn attention to a macOS session involving Claude Code<\/a> that raises a difficult question for every organization deploying generative AI tooling on developer workstations: when does convenient automation become a serious exposure?<\/p>\n

The findings, drawn from endpoint telemetry collected in July 2026, document a chain of activity that includes reverse tunnels, credentialed HTTP requests to temporary public addresses, and macOS LaunchAgent entries designed to ensure persistence across logout and restart. What makes the case particularly challenging for security teams is that the activity did not originate from a conventional malware dropper. Instead, trusted processes associated with the Claude Code coding agent launched shells and helper tools that published a local application to the internet and then verified that it remained reachable.<\/p>\n

This mix of legitimate tooling and potentially risky behavior makes the incident meaningful for teams already tracking Claude Code security weaknesses<\/a> and wondering how AI-assisted development platforms can put developer systems at risk without triggering traditional detection mechanisms.<\/p>\n

A Signed Parent Does Not Make Every Child Safe<\/h2>\n

Elastic researchers identified the behavior while reviewing endpoint telemetry from a macOS developer machine. The company stressed in its report<\/a> that the evidence supports more than one interpretation. It could reflect legitimate remote administration of a local dashboard, but the combination of credentials, tunnels, and persistence mechanisms demands investigation rather than dismissal.<\/p>\n

The session used a trusted coding agent as the parent process, while zsh shells carried out the later actions. This distinction matters because a signed parent application does not make every command it launches safe. In environments where AI coding agents have broad permissions to execute shell commands, read files, and install software, the authentication of the parent process provides little reassurance about the intent or safety of what it spawns.<\/p>\n

For organizations, the impact is not limited to a single host. Exposed dashboards may reveal operational data, API keys, or internal architecture details. Persistent tunnelling can give an unapproved user a route back into a developer environment that bypasses traditional perimeter controls. And because the activity uses infrastructure that is widely considered legitimate, it can evade network detection tools that rely on reputation-based blocking.<\/p>\n

How the Attack Chain Unfolded: Reverse Tunnels and Credentialed Requests<\/h2>\n

The observed chain began after earlier alerts involving tunnel and VPN-style utilities on the same machine. On July 23, the Claude Code session used permission-bypass options that reduced approval prompts before its child shells contacted temporary addresses hosted by free tunnelling services.<\/p>\n

The pattern included repeated credentialed requests to a login page and a subsequent pull of application metrics. One shell then started cloudflared<\/code>code, Cloudflare’s tunnel client, to publish a localhost service through a Cloudflare Quick Tunnel. Such a tunnel makes a laptop-hosted service reachable through an outbound connection, without requiring a traditional inbound firewall rule. The technique is widely used by developers for testing, but it has also appeared in stealthy Cloudflare tunnel attacks<\/a>, so its presence requires context, not an automatic verdict.<\/p>\n

Researchers also observed an ngrok<\/code>code binary in the project tree, further indicating that the machine had multiple tunnelling tools available. The critical combination was credentialed web requests, a public route to a local service, and helper tools capable of keeping that route available even after the originating shell exited.<\/p>\n

A temporary hostname alone is weak evidence of malicious intent. But these events together create an externally reachable management path that could be exploited if discovered by an adversary scanning for exposed services.<\/p>\n

What Is a Reverse Tunnel and Why Does It Matter for Developer Security?<\/h3>\n

A reverse tunnel establishes a connection from a local machine to a public server, then routes traffic back through that connection to a service running on the local machine. Services like Cloudflare Quick Tunnel, localhost.run, and ngrok provide this capability as a convenience for developers who need to share a local application with colleagues or test webhooks against a local server.<\/p>\n

The security risk arises because the tunnel makes a machine that is behind a firewall or NAT reachable from the internet. If the exposed service requires authentication, that authentication becomes a single point of failure. If the service exposes sensitive data or administrative interfaces, an attacker who discovers the tunnel URL gains access without needing to compromise the network perimeter. In the context of AI coding agents, the risk is compounded because the agent may be authorized to install tools, modify configurations, and execute commands that a human developer would not typically automate.<\/p>\n

LaunchAgents Convert Temporary Access Into Persistent Access<\/h2>\n

The same session that created reverse tunnels also wrote and loaded macOS LaunchAgent material, including a watchdog configuration with a 60-second interval. LaunchAgents can start programs automatically for a logged-in user, and they survive logout and restart. This is the key difference between short-lived testing and durable access.<\/p>\n

The activity included process checks for related workloads and a liveness check against the published address. Elastic’s “Persistence via GenAI Tool” rule fired during this stage, indicating that the combination of an AI coding agent, LaunchAgent creation, and network tunnelling crossed a threshold worth alerting on.<\/p>\n

Analysts investigating similar activity should preserve process ancestry, command-line arguments, modified plist files, and network records. They must then determine whether the owner approved each component of the activity. A developer who manually starts a tunnel to test an application is acting differently from a process that writes a LaunchAgent plist, schedules a watchdog, and verifies that the published service remains reachable.<\/p>\n

What Are macOS LaunchAgents and How Can They Be Abused?<\/h3>\n

LaunchAgents are property list files stored in ~\/Library\/LaunchAgents<\/code>code that define programs to be started automatically when a user logs in. They are a standard macOS mechanism for background services, timers, and watchdog processes. Unlike LaunchDaemons, which run at the system level, LaunchAgents run in the user context and do not require root privileges to install.<\/p>\n

Abuse occurs when an attacker or untrusted process writes a LaunchAgent that starts a reverse tunnel, a backdoor, or a data exfiltration tool at login. Because the LaunchAgent runs under the user’s account, it has access to the same files, credentials, and network permissions as the user. Detection is challenging because LaunchAgents are a legitimate and commonly used feature, and many developers configure them for legitimate purposes.<\/p>\n

Dual-Use Infrastructure and the Reputation Blind Spot<\/h2>\n

The broader lesson from this investigation is that dual-use infrastructure cannot be judged from reputation alone. Cloudflare Quick Tunnels, ngrok, and localhost.run are all legitimate services used by developers worldwide. They appear on few if any threat intelligence blocklists. Yet they have all been observed in malicious campaigns, including TryCloudflare malware delivery<\/a> and credential harvesting operations.<\/p>\n

The same applies to AI coding agents. Claude Code, GitHub Copilot, and similar tools are trusted by developers and often granted broad permissions to read files, execute commands, and install packages. When these tools are used to automate development workflows, their actions inherit the trust placed in the parent application. That trust is not always warranted when the agent is operating on instructions from a prompt that may contain ambiguous, malicious, or poorly scoped requests.<\/p>\n

Previous reporting on Claude Code network sandbox flaws<\/a> has underlined the need to update and limit access to credentials. The current investigation reinforces that message: if an AI coding agent can read credentials from environment variables, configuration files, or password managers, it can pass those credentials to a child process that publishes them to a public tunnel.<\/p>\n

Practical Recommendations for Security Teams<\/h2>\n

Elastic recommends that security teams keep alerts for credentialed HTTP, reverse tunnels, and LaunchAgents visible rather than auto-closing them simply because a coding agent appears in the process tree. The presence of a trusted parent process should not automatically downgrade the severity of child-process activity.<\/p>\n

Teams should separate noisy child-process activity from concrete outcomes. A coding agent that spawns many shell commands is normal. A coding agent that spawns a shell that installs a tunnel client, creates a LaunchAgent, and verifies that a public URL is reachable is not normal and requires investigation.<\/p>\n

Specific actions that security teams can take include:<\/p>\n

    \n
  • Restricting dangerous permission-bypass modes in AI coding agents. Many agents offer options to suppress approval prompts for file access, command execution, or network operations. These should be disabled in production developer environments.<\/li>\n
  • Reviewing new LaunchAgents as part of endpoint detection workflows. Any LaunchAgent written outside of a known software installer should trigger an alert, particularly if it references tunnelling tools, network services, or credential files.<\/li>\n
  • Validating any tunnel against a documented developer task. If a developer cannot explain why a tunnel was needed and who authorized it, the tunnel should be treated as unauthorized.<\/li>\n
  • Rotating credentials that appear in command-line arguments or environment variables captured in telemetry. Even if the exposure was temporary, credentials sent to a public tunnel URL should be considered compromised.<\/li>\n
  • Removing unauthorized helper binaries before returning the machine to service. Tunnel clients like cloudflared<\/code>code and ngrok<\/code>code should be removed or restricted if they are not part of an approved toolchain.<\/li>\n<\/ul>\n

    Indicators of Compromise From the Investigation<\/h2>\n

    The following indicators were observed during the Elastic investigation and can be used by security teams to search for similar activity in their own environments. These are provided in defanged format to prevent accidental resolution.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
    Domain<\/td>\nlocalhost[.]run<\/td>\nFree SSH tunnel service referenced in the investigation<\/td>\n<\/tr>\n
    Domain<\/td>\nlhr[.]life<\/td>\nFree tunnel subdomain space associated with localhost.run<\/td>\n<\/tr>\n
    Domain<\/td>\n*.lhr[.]life<\/td>\nObserved ephemeral tunnel-hostname pattern<\/td>\n<\/tr>\n
    Domain<\/td>\ntrycloudflare[.]com<\/td>\nCloudflare Quick Tunnel hostname space<\/td>\n<\/tr>\n
    Domain<\/td>\n*.trycloudflare[.]com<\/td>\nObserved public Quick Tunnel hostname pattern<\/td>\n<\/tr>\n
    Domain<\/td>\napi.trycloudflare[.]com<\/td>\nQuick Tunnel control-plane endpoint<\/td>\n<\/tr>\n
    URL path<\/td>\n\/login<\/td>\nEndpoint used for credentialed HTTP requests<\/td>\n<\/tr>\n
    URL path<\/td>\n\/api\/summary<\/td>\nEndpoint used to retrieve application metrics<\/td>\n<\/tr>\n
    File<\/td>\n\/tmp\/mcp_clean_landers.py<\/td>\nPython script observed under a zsh process<\/td>\n<\/tr>\n
    File path<\/td>\n~\/.claude\/projects\/*\/memory\/MEMORY.md<\/td>\nClaude project-memory file accessed during earlier activity<\/td>\n<\/tr>\n
    File path<\/td>\n~\/.zshenv<\/td>\nShell configuration file probed as a persistence canary<\/td>\n<\/tr>\n
    Binary<\/td>\ncloudflared<\/td>\nCloudflare tunnel client used to publish localhost<\/td>\n<\/tr>\n
    Binary<\/td>\nngrok<\/td>\nTunnel binary detected in the project tree<\/td>\n<\/tr>\n
    Binary<\/td>\npritunl-client<\/td>\nTunnel or VPN-class utility detected before the main session<\/td>\n<\/tr>\n
    Binary<\/td>\nwireguard-go<\/td>\nTunnel or VPN-class utility detected before the main session<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Organizations should ingest these indicators into their SIEM, threat intelligence platform, or endpoint detection and response tooling, and search for historical matches that may indicate undiscovered exposure.<\/p>\n

    The Deeper Challenge: Trusting AI Agents With Developer Privileges<\/h2>\n

    This investigation surfaces a tension that will only become more acute as AI coding agents become more capable and more deeply integrated into development workflows. These agents need broad permissions to be useful: they must read code, execute tests, install dependencies, and often modify system configuration. But every permission granted to an AI agent is a permission that can be exercised in ways the developer did not anticipate.<\/p>\n

    The risk is not that the agent is malicious. The risk is that the agent follows instructions too literally, or that it is prompted to perform an action by a compromised dependency, a poisoned repository, or a social engineering attack. In the Elastic investigation, the activity could plausibly be explained as a developer testing a local dashboard using standard tools. But it could also represent an adversary who has compromised the developer’s environment and is using the trusted agent process to evade detection.<\/p>\n

    Security teams that treat AI coding agents as trusted processes because they are signed by a reputable vendor are missing the point. The trust should be placed in the human who reviews and approves each action, not in the binary that initiates it. Until agents are designed with granular permission models that distinguish between reading a file and publishing it to the internet, organizations must enforce those distinctions through monitoring, alerting, and policy.<\/p>\n

    The Claude Code session exposed in this investigation is a reminder that the most dangerous threats often look like normal activity. A reverse tunnel is not inherently malicious. A LaunchAgent is not inherently suspicious. But the combination of credentials, persistence, and public exposure is a pattern that security teams cannot afford to dismiss. The question is not whether the developer intended to publish their dashboard. The question is whether anyone else noticed it was there.<\/p>\n","protected":false},"excerpt":{"rendered":"

    The boundary between developer productivity and security exposure has never been thinner than it is in the age of AI-assisted coding. A new investigation by Elastic Security Labs has drawn attention to a macOS session involving Claude Code that raises a difficult question for every organization deploying generative AI tooling on developer workstations: when does […]<\/p>\n","protected":false},"author":7,"featured_media":75465,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/raw.githubusercontent.com\/medeiroslima\/overcentral-images\/main\/images\/ocie_1786348227819.jpg","fifu_image_alt":"Claude Code Sessions Expose macOS via Reverse Tunnels","footnotes":""},"categories":[40668],"tags":[],"class_list":["post-75462","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security"],"fifu_image_url":"https:\/\/raw.githubusercontent.com\/medeiroslima\/overcentral-images\/main\/images\/ocie_1786348227819.jpg","fifu_image_alt":"Claude Code Sessions Expose macOS via Reverse Tunnels","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/75462","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=75462"}],"version-history":[{"count":0,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/75462\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/75465"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=75462"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=75462"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=75462"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}