Claude Code Child Process Can Read Its Own OAuth Token From macOS Keychain

A macOS Keychain implementation weakness in Anthropic’s Claude Code CLI could allow any process running as the logged-in user including a Claude Code-spawned child process to retrieve the tool’s OAuth credential bundle silently.

The issue underscores how trusted AI coding-agent ancestry can mask high-impact credential access and persistence activity on developer endpoints.

However, the CLI reportedly creates that item through Apple’s /usr/bin/security utility rather than binding access to Claude Code’s own code signature through native Keychain Services APIs.

As a result, another user-context process can invoke the same trusted Apple-signed utility and obtain the stored credential bundle without a password, Touch ID request, or privilege escalation.

The practical concern is not a remote attacker reading the token directly. An attacker must first achieve code execution in the victim’s user session.

Once there, however, a standard Keychain read can expose a long-lived refresh token that may be replayed from another device to impersonate the victim and potentially reach connected MCP services.

Silverfort characterized the behavior as a design weakness rather than a standalone vulnerability, while Anthropic reportedly considers tighter Keychain access controls a defense-in-depth hardening measure.

This behavior also explains why endpoint detections can be difficult to interpret. Elastic Security Labs observed that Claude Code may spawn a command resembling security find-generic-password to retrieve its own stored OAuth material.

Immediate children were usually shells (zsh) under Claude Code, not Claude executing every binary itself. The raw alert shape still looks like living-off-the-agent activity. 

Elastic security researchers found that Claude Code stores its OAuth access and refresh tokens, along with credentials for connected Model Context Protocol (MCP) services, in a macOS Keychain item.

macOS Keychain Access

In isolation, this should not be treated as proof of malicious activity: it is documented Claude Code behavior and can be generated during normal authentication workflows.

But the same command is dangerous when initiated by an untrusted shell, a malicious MCP integration, a compromised project hook, or a suspicious child process operating outside the expected Claude Code execution chain.

The distinction is especially important because coding agents routinely launch shells, editors, package managers, interpreters, API clients, and helper binaries.

A trusted vendor-signed parent can therefore appear above activity that still resembles classic post-exploitation: credential access, network discovery, reverse tunnels, script staging, and persistence.

Detection teams should evaluate the full process tree, command-line arguments, code-signing metadata, terminal session origin, and subsequent network behavior rather than automatically suppressing events merely because claude appears in the ancestry.

The sequence authenticates to a tunnel-published app URL and pulls metrics such as spend and ads. Credentials in process command lines under coding-agent ancestry still matter for Endpoint and for anyone opening the alert.

Elastic documented a related macOS investigation in which shells under Claude Code authenticated to ephemeral lhr[.]life tunnel hosts, queried application metrics, established a Cloudflare Quick Tunnel, and installed LaunchAgent-based persistence.

The researchers emphasized that reverse tunnels and LaunchAgents can expose local administrative services to the internet, regardless of whether the activity originated as “vibe-coded” operations or confirmed malware.

For defenders, Keychain reads for Claude Code-credentials should be baselined, not blindly blocked.

High-confidence escalation signals include reads from unsigned or unfamiliar binaries, scripts launched from writable locations such as /tmp, unexpected osascript or Python ancestry, access followed by external token replay, and concurrent modifications to LaunchAgents, shell profiles, or Claude project configuration.

Organizations should also monitor MCP authorization scope, restrict dangerous agent permission modes, and isolate coding-agent workloads from production credentials where possible.

The disclosure follows earlier Claude Code security fixes, including CVE-2026-27487, an OS command injection risk in the macOS credential-refresh path fixed in version 2026.2.14.

The broader lesson is straightforward: AI coding agents are not merely developer tools. They are high-privilege automation environments whose child processes, local secrets, and persistence behaviors require the same scrutiny applied to traditional endpoint administration tooling.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide