Coding agents like Claude Code and Cursor are trusted, vendor-signed tools that developers use for opening shells, editing files, calling APIs, and installing project helpers. This trust introduces a challenging detection problem: activity below an approved coding agent can still mimic high-severity command-and-control (C2) behavior. Shells running under Claude Code performed credentialed HTTP requests to temporary tunnel domains, fetched application metrics, created a Cloudflare Quick Tunnel, and installed LaunchAgent persistence.
The activity did not conclusively demonstrate malware, but it yielded findings that defenders should scrutinize: credentials found in command lines, reverse tunnels revealing local services, and persistence mechanisms designed to endure logouts or reboots.
Elastic's recommendations also suggest analysts look into unusual network destinations from Generative AI alongside process arguments, configuration changes, downloaded files, and related endpoint events. The host had already flagged alerts in the previous days related to tunnel and VPN-style binaries, suspicious Python execution, and increasing volumes of coding-agent child processes. Such behavior can mimic an implant beacon.
It features repeated readiness loops, credentialed POST requests, public hostname tunnels, and automated data retrieval, all of which are similar to C2 servers checking in remotely. This model enables endpoints to establish outbound connections via the tunnel provider, issuing a public URL for remote users to access the local application without needing an inbound firewall rule or traditional port forwarding.
