Claude Code Keychain Design Exposes OAuth Credentials
On June 25, Silverfort reported that Claude Code CLI's macOS Keychain implementation can allow processes running as the logged-in user to silently retrieve its OAuth credential bundle. The finding requires prior code execution in the user's session, but the retrieved access and refresh tokens may be replayed from another machine and can include credentials for connected MCP services, according to Silverfort.
Silverfort reported that Anthropic's Claude Code CLI stores macOS credentials in a Keychain item that any process running under the same logged-in user can read without a password, Touch ID prompt, or privilege escalation. The security firm disclosed the issue to Anthropic through HackerOne on June 25.
According to Silverfort, the exposed bundle can contain Claude Code OAuth access and refresh tokens plus credentials for connected Model Context Protocol (MCP) services. A malicious actor would first need code execution in the victim's user session, but could then read the bundle and replay the refresh token from another device to act as that user.
Keychain access-control difference
Silverfort attributes the behavior to Claude Code CLI's use of Apple's /usr/bin/security utility to create and retrieve the Keychain item, rather than binding access to Claude Code's code signature through native Keychain Services APIs. It contrasts this implementation with Claude Desktop, which Silverfort reports prompts users to re-authenticate when another process requests the stored credential.
The firm characterizes the behavior as a design weakness rather than a standalone vulnerability. Its report applies to the macOS CLI implementation, not Claude Desktop. Silverfort also states that Windows and Linux Claude Code CLI installations use file-based credential storage.
GBHackers reports that Elastic Security Labs observed Claude Code spawning commands resembling security find-generic-password during normal OAuth-material retrieval. That command pattern is therefore not, by itself, evidence of malicious activity. The report identifies untrusted shells, malicious MCP integrations, compromised project hooks, and suspicious child processes outside the expected Claude Code execution chain as contexts requiring closer investigation.
Implications for developer endpoint security
Anthropic told Silverfort it was tracking tighter Keychain-item access controls as a defense-in-depth hardening improvement, according to Silverfort's disclosure account.
For security teams, the case illustrates a recurring endpoint-security problem with coding agents: legitimate agent processes may invoke trusted system utilities to obtain credentials, while malicious code executing in the same user context can resemble that activity. Detection logic for security commands therefore benefits from process-tree context, parent-child relationships, MCP connector inventories, and correlation with unexpected shell execution or project-hook activity.
Key Points
- 1Silverfort reported that same-user macOS processes can silently read Claude Code's stored OAuth bundle without re-authentication or privilege escalation.
- 2The reported exposure requires prior user-session code execution, but refresh-token replay could extend compromise beyond the original developer endpoint.
- 3Coding-agent telemetry needs process-tree context because normal credential retrieval can resemble malicious use of trusted macOS utilities.
Scoring Rationale
The report concerns credential handling in an AI coding CLI and potentially extends to connected MCP services. Exploitation requires prior execution as the affected macOS user, which limits its severity relative to a remote or privilege-escalation flaw, but it creates meaningful endpoint detection and token-security concerns.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
