Claude Code Activity Triggers Tunnel and Persistence Alerts
Elastic Security Labs reported that telemetry from a macOS developer endpoint on July 23 showed shells under Claude Code creating reverse tunnels and installing LaunchAgent persistence. The investigation found credentialed requests to temporary tunnel hosts, Cloudflare Quick Tunnels, and an ngrok binary, although Elastic said the activity alone did not establish malware. The case illustrates why agent-parented processes require outcome-based investigation.
Elastic Security Labs reported that a July 23 investigation on a macOS developer endpoint found shell processes under Claude Code creating reverse tunnels, making credentialed requests to temporary public hosts, and installing LaunchAgent persistence. Elastic did not classify the observed activity as malware, but described the combination of exposed local services, credentials on the wire, and persistence as high-severity outcomes requiring investigation.
The case is an examination of endpoint telemetry, not a disclosed vulnerability in Claude Code. Elastic wrote that coding agents such as Claude Code and Cursor are vendor-signed tools commonly used to open shells, edit files, call APIs, and install helpers. That trusted parent process can complicate triage when child processes exhibit behaviors normally associated with remote administration or command-and-control activity.
What Elastic observed
According to Elastic, two hunt paths converged on the same host and July 23 activity window. One began with a domain-reputation signal involving a tunnel-related destination, while the other used correlated endpoint detections involving persistence connected to a GenAI tool.
Elastic reported that the host had generated prior alerts involving tunnel activity, suspicious Python execution, and an increased volume of coding-agent child processes. During the July 23 window, telemetry showed:
- •Credentialed HTTP requests to lhr[.]life and trycloudflare[.]com hosts.
- •A shell in the coding-agent process lineage polling a tunnel-published /login endpoint until it returned HTTP 200.
- •A subsequent authentication step and a request to an /api/summary endpoint for metrics including spend or advertising data.
- •cloudflared, an ngrok binary, and newly created LaunchAgent files on the endpoint.
Elastic stated that the immediate children in this activity were generally zsh shells and utilities rather than Claude Code directly executing each binary. This distinction matters for process-tree analysis: an approved developer tool can be the ancestor of actions that, viewed independently, resemble a persistence mechanism or an externally reachable remote-control channel.
Why the traffic is difficult to classify
The repeated readiness check, public tunnel hostname, and automated data retrieval can resemble an implant beaconing to a command-and-control server, CyberPress reported in its summary of the Elastic research. But the same sequence can also arise when a developer uses a tunnel to make a local application or administrative dashboard reachable from the public internet.
Elastic identified localhost[.]run, lhr[.]life, Cloudflare Quick Tunnels, and ngrok as dual-use tunnel services relevant to the case. Its reporting also described a local loopback application pattern and ordinary SaaS API use alongside the tunnel and persistence events. Those overlapping indicators prevent a simple classification based solely on a destination domain or the presence of a known tunneling utility.
A macOS LaunchAgent is a user-level mechanism that can start a process at login or under other configured conditions. In this case, Elastic emphasized that LaunchAgents combined with a reverse tunnel can expose a local administrative application beyond the endpoint, including after logout or restart if persistence remains active.
Detection implications
Elastic advised analysts to evaluate unusual GenAI-related network destinations together with process arguments, configuration changes, downloaded files, and related endpoint events. That approach is more defensible than treating either a trusted agent parent or a dual-use tunnel domain as conclusive evidence.
For security teams, the reported event reinforces a broader detection pattern: developer automation can create process ancestry and network behavior that overlap with attacker tradecraft. Comparable incidents are best assessed through the resulting access path, credential handling, persistence artifacts, and service exposure, rather than by assuming that vendor-signed agent software makes downstream activity benign.
Key Points
- 1Elastic observed Claude Code-descended shell activity creating tunnels and LaunchAgents, combining externally reachable services with persistence artifacts on macOS.
- 2The event was not proven malware, but credentialed tunnel traffic, readiness loops, and persistence resemble behaviors commonly investigated as command-and-control.
- 3Security teams evaluating coding-agent alerts benefit from correlating process ancestry, arguments, network destinations, file changes, and exposed local services.
Scoring Rationale
The report offers a concrete endpoint-detection case involving a widely used AI coding agent, reverse tunnels, and macOS persistence. It is not a confirmed Claude Code vulnerability or malware incident, but it provides actionable telemetry patterns for security engineers supporting agent-enabled development environments.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
