Coding agents such as Claude Code and Cursor are trusted, vendor-signed tools that developers use to open shells, edit files, call APIs, and install project helpers.
That trust creates a difficult detection problem: activity launched below an approved coding agent can still resemble high-severity command-and-control (C2) behavior.
Elastic Security telemetry from a macOS developer endpoint showed this risk clearly.
Shells running under Claude Code performed credentialed HTTP requests to temporary tunnel domains, pulled application metrics, created a Cloudflare Quick Tunnel, and installed LaunchAgent persistence.
The immediate process children were usually zsh shells and utilities, rather than Claude Code directly launching every binary.
The activity did not prove malware by itself. However, it produced outcomes defenders should investigate: credentials appearing in command lines, reverse tunnels exposing local services, and persistence designed to survive logout or reboot.
Elastic’s guidance similarly advises analysts to examine unusual GenAI network destinations alongside process arguments, configuration changes, downloaded files, and related endpoint events.
Agent Tunnels Mimic C2
Two investigation paths identified the same July 23 activity window. One began with domain-reputation signals involving a tunnel-related destination.
The other started with correlated endpoint detections, including persistence activity connected to a GenAI tool.
The host had already generated alerts in the preceding days for tunnel and VPN-style binaries, suspicious Python execution, and rising volumes of coding-agent child processes.
On July 23, the signals converged: credentialed requests to lhr[.]life and trycloudflare[.]com hosts appeared alongside cloudflared, an ngrok binary, and new LaunchAgent files.
The first notable pattern was a shell under the coding-agent lineage using curl to poll a tunnel-published /login endpoint until it returned HTTP 200.
It then authenticated and requested an /api/summary path for metrics such as spend or advertising data.
That behavior can resemble a beacon. The repeated readiness loop, credentialed POST request, public tunnel hostname, and automated data retrieval all look similar to a C2 implant checking in with a remote server.
![VirusTotal domain view for lhr[.]life. Multiple engines mark malicious or phishing, and community tags include potential C2 (Source: elastic)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjQowzlQJFtxQ7idghjBzNWpyz9ETN7caHklAcO5TMbbOjMRdiJyLYcQ3EAQz45JNHC-Q77hXf1FchkdG-v_5E6sDe4EgEtxan28Xboqv1QxmUyCYfdjzz_06fCyjqSoUvvodErOlBlWVDLIy19V6iDsqr8Us7dGc17cK6QIwWlgyo14KabZWU8oLYhizNp/s1024/image3-1.webp)
Yet the same sequence may simply test a local dashboard that a developer published through a temporary tunnel.
The session later launched cloudflared to publish a localhost service through Cloudflare’s Quick Tunnel infrastructure. In this model, the endpoint creates an outbound connection to the tunnel provider, which issues a public URL.
Remote users can then reach the local application without an inbound firewall rule or traditional port forwarding, Elastic said.
A simplified command often looks like this:
bashcloudflared tunnel --url http://localhost:<port>
This is useful for testing and demos, but it becomes more concerning when paired with credentialed access and persistence. The telemetry also showed LaunchAgent material created with tools such as PlistBuddy and loaded through launchctl.
A watchdog-style LaunchAgent can periodically test the public URL and restart a tunnel if it stops working.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
