Elastic Traces Coding-Agent-Parented Tunnels and LaunchAgent Persistence on macOS
Summary
Elastic analyzed macOS telemetry showing Claude Code-parented credentialed requests to tunnel-hosted URLs, Cloudflare tunneling, and LaunchAgent persistence. The activity may have exposed a local admin app; the evidence did not establish an intrusion.
Key points
- On a macOS developer endpoint, Claude Code-parented shells made credentialed HTTP requests to tunnel-hosted URLs and pulled application metrics.
- The activity included localhost[.]run and Cloudflare Quick Tunnel hosts, followed by a tunnel exposing a local service.
- LaunchAgents were written and loaded with launchctl to keep a watchdog or tunnel-related path alive across sessions.
- Related telemetry from July 20 onward included tunnel/VPN-class binaries and rising GenAI or MCP child-process activity.
- Production detections fired for suspicious network connections, persistence via GenAI tooling, process discovery, and GenAI child-process behavior.
- Elastic says the activity could reflect remote administration of a local dashboard or something more serious; the evidence did not resolve that ambiguity.
- The article recommends keeping high-severity outcomes visible and correlating session context rather than relying on tunnel-provider reputation alone.
Article Details
- Attack Vectors
- Under Claude Code ancestry, zsh shells used curl to POST credentials to tunnel-published URLs and retrieve application metrics; the article says this could be self-testing a local app or credentialed access to an exposed service.
- cloudflared established a Cloudflare Quick Tunnel to publish a localhost service through an outbound control channel, making it reachable without inbound firewall changes.
- LaunchAgent material was written and loaded with launchctl, with KeepAlive and a liveness loop described as keeping the tunnel or local application available across sessions.
- In a separate Claude Code case, an unsigned binary was downloaded over plaintext HTTP, followed by attempted quarantine stripping and ad-hoc re-signing.
- In a separate Cursor case, a decrypted Keychain dump targeting OAuth material was attempted but blocked by endpoint controls.
- The observed session used pgrep patterns to check for related processes.
- Defensive Notes
- Do not automatically close high-severity alerts for credentialized HTTP, reverse tunnels, or LaunchAgent persistence just because a trusted coding-agent process is in the ancestry.
- Record that localhost.run, Cloudflare Quick Tunnels, and ngrok are dual-use destinations; reputation labels or broker apex pages alone do not establish malicious activity.
- Correlate process ancestry and session activity, including publish-localhost behavior, requests to /login and /api/summary, and LaunchAgent liveness checks.
- Treat GenAI child-process alerts as ancestry and timing context until supported by outcomes such as secrets exposure, tunnels, or persistence.
- The article recommends documenting both the local-dashboard administration interpretation and the more serious possibility when evidence supports neither conclusively.
- Endpoint controls blocked the attempted decrypted Keychain dump in the reviewed Cursor case.
MITRE ATT&CK
T1053.007 · Container Orchestration JobLaunchAgent material was written and loaded, with launchctl bootstrap used to establish persistence.T1057 · Process DiscoveryThe session used pgrep patterns to check for related processes.T1059.004 · Unix ShellShells, including zsh, ran follow-on commands under the coding-agent process ancestry.T1090 · ProxyThe session used reverse tunnels and free tunnel brokers to expose a local service to internet access.T1105 · Ingress Tool TransferIn a separate Claude Code case, an unsigned binary was pulled over plaintext HTTP.T1133 · External Remote ServicesThe session authenticated to tunnel-published URLs and accessed the exposed service over HTTP(S).T1555.001 · KeychainA separate Cursor case attempted a decrypted Keychain dump for OAuth material; endpoint controls blocked it.
Vendors
Cloudflarereverse tunnels, and LaunchAgent persistence across free tunnel services like localhost[.]run, Cloudflare Quick Tunnels, and ngrok.ElasticElastic Security analyzed a macOS developer endpoint where Claude Code and related coding-agent activity parented credentialed HTTP requests, reverse tunnels, and LaunchAgent persistence across free tunnel services likeNgrokLaunchAgent persistence across free tunnel services like localhost[.]run, Cloudflare Quick Tunnels, and ngrok.
Products
Claude CodeElastic Security analyzed a macOS developer endpoint where Claude Code and related coding-agent activity parented credentialed HTTP requests, reverse tunnels, and LaunchAgent persistence across free tunnel services likeCursor#ClaudeCodeElastic DefendThat was not the first Elastic Defend signal on the host.