Living off the coding agent: Two tales of tunnels and LaunchAgents

Living off the coding agent: where threat tradecraft and GenAI noise collide

Coding agents such as Claude Code and Cursor are vendor-signed, used all day on developer laptops, and routinely open shells, call APIs, edit files, and install helpers. That makes GenAI-adjacent alerts challenging to investigate. The parent looks trusted, while the children can still look a lot like classic high-severity activity.

This Elastic Security Labs case study walks a macOS endpoint window where Claude Code ancestry, free tunnel brokers (localhost.run / lhr.life, Cloudflare Quick Tunnels, ngrok), credentialed HTTP, and LaunchAgent persistence land in the same alert pile - and why detection engineers have to triage the difference between intrusion and vibe-coded ops.

Key takeaways:

Agent-parented reverse tunnels and LaunchAgents can expose a local admin app to the internet - treat that as high severity even when it looks like ops, not confirmed malware
Known free tunnel brokers show up next to credentialed HTTP and LaunchAgents in the same session
The hard part is validation: trusted coding-agent parents, dual-use destinations, and high-severity outcomes can all arrive together

Check out the original blog post at Elastic Security Labs.