Harish Kumar 
A macOS incident that exposes a growing blind spot in enterprise defense: attacks, or at least attack-shaped activity, hiding in plain sight beneath trusted, vendor-signed AI coding agents like Claude Code and Cursor.
The case centers on a developer laptop where Claude Code, already installed and actively used, spawned shell sessions (zsh) that scripted logins to ephemeral tunnel hostnames, pulled application metrics, stood up a Cloudflare Quick Tunnel, and installed LaunchAgent persistence.
Because Claude Code itself is signed and routinely opens shells, calls APIs, and edits files, the malicious-looking children inherited a layer of trust the parent process never earned through verification, only through vendor reputation.
macOS Tunnels and LaunchAgent Persistence Exposed
Elastic’s hunt reconstructed the chain from two separate starting points: a VirusTotal reputation flag on a contacted domain, and correlated endpoint alerts, including the production rule “Persistence via GenAI Tool.” Both paths converged on the same host and the same July 23, 2026 window.
The sequence unfolded predictably once mapped: a Claude Code session authenticated over HTTP(S) to a tunnel-published URL and pulled metrics like spend and ad data; a Cloudflare Quick Tunnel (cloudflared) published a localhost service to the internet without touching the firewall.
LaunchAgents configured via PlistBuddy and reloaded with launchctl bootstrap kept that access alive across reboots. An ngrok binary, flagged by VirusTotal as an adware/hacktool, appeared the same day as a second tunnel front.
Crucially, credentials appeared in plaintext HTTP POST requests to *.lhr[.]life (localhost.run) and *.trycloudflare[.]com, sitting alongside “check” status strings and readiness loops that poll /login until HTTP 200, a pattern that mimics command-and-control check-in behavior almost exactly.
The report’s core finding isn’t a new malware family; it’s a validation crisis. Free tunnel brokers like localhost.run, Cloudflare Quick Tunnels, and ngrok are legitimately dual-use, and an unbound broker’s “no tunnel here” landing page proves nothing either way.
Meanwhile, the technical outcomes credentialed HTTP exfiltration risk, reverse tunnels, and LaunchAgent persistence are exactly what endpoint detection is built to escalate, regardless of what spawned them.
Elastic mapped the activity across seven MITRE ATT&CK tactics, from Execution and Persistence to Command and Control, and flagged related variants: Claude Code sessions dropping JavaScript via Apple-signed Python and osascript, a Cursor agent attempting a keychain dump targeting OAuth material (blocked by endpoint controls), and permission-bypassed agent sessions pulling unsigned binaries over plaintext HTTP.
Elastic’s guidance is measured rather than alarmist: keep credentialed HTTP, reverse tunnels, and LaunchAgent installs loud even when a coding agent sits in the process tree; name the destination class (tunnel broker vs. genuine C2) early; and prioritize session-level context readiness loops, publish-then-authenticate patterns over single-event reputation scores.
As coding agents increasingly occupy the “trusted parent” position that developers once reserved for shells and terminals, this case is a preview of a much larger detection-engineering challenge: distinguishing vibe-coded automation from genuine compromise, even when telemetry looks identical in either case.
About the Author
Kiran 
