Claude Code Flaw Lets Local Processes Quietly Grab OAuth Tokens

Security researchers at Silverfort found that Anthropic's Claude Code command-line tool stores OAuth tokens in the macOS Keychain in a way that allows any process running under the same user account to extract them without authentication, because it uses Apple's /usr/bin/security utility instead of binding access to its own code signature. Elastic Security Labs separately documented that Claude Code's normal operation spawns commands resembling 'security find-generic-password' through a shell, making detection of malicious access difficult. The exposed tokens include long-lived OAuth refresh tokens and credentials for connected Model Context Protocol (MCP) services, which could be replayed from another device to impersonate the user.

A newly documented weakness in how Claude Code https://www.kobaran.com/tag/Claude-Code stores authentication data on macOS is raising fresh questions about credential security in AI coding agents. Security researchers say the command-line tool’s method of saving its OAuth token bundle in the macOS Keychain can be exploited by any process running under the same logged-in user account, including child processes spawned by Claude Code itself. The finding does not describe a remote attack. Instead, it highlights a more subtle risk: once someone or something already has code execution on a developer’s machine, they may not need a password prompt, a Touch ID request, or elevated privileges to pull sensitive Claude Code credentials straight out of storage. For an industry racing to fold AI coding agents into daily developer workflows, the disclosure is a reminder that these tools carry the same security weight as any other privileged automation software. As Claude Code adoption grows among engineering teams, understanding exactly how it handles secrets on disk has become a practical necessity rather than a theoretical concern. What Researchers Found The Core Weakness According to research shared by identity security firm Silverfort, the issue traces back to how Claude Code creates its Keychain entry. Rather than binding access to its own application code signature through Apple’s native Keychain Services APIs, the CLI reportedly relies on Apple’s built-in /usr/bin/security command-line utility to write the credential item. Because that utility is Apple-signed and trusted, any other process operating in the same user session can invoke it too. That means a separate application, script, or even a Claude Code-launched subprocess can independently query the same Keychain entry and extract the stored token bundle without triggering the authentication checks users typically expect from macOS Keychain access. Silverfort described the issue as a design weakness in how the credential item is provisioned, rather than a traditional software vulnerability with a single patchable flaw. Anthropic reportedly views stricter Keychain access controls as a defense-in-depth hardening step rather than a critical fix, since exploitation still requires an attacker to already have a foothold on the victim’s machine. Why a Stolen Token Matters The credential bundle at risk includes long-lived OAuth refresh tokens and, in some configurations, credentials tied to connected Model Context Protocol MCP services. Because refresh tokens are designed to remain valid over extended periods, a copy pulled from Keychain could theoretically be replayed from a different device to impersonate the original user and reach any MCP-connected services tied to that account. That combination, a locally accessible secret with long-term validity, is what elevates this from a minor implementation quirk to a genuine credential-persistence concern for security teams managing developer fleets. How the Behavior Shows Up on Endpoints Normal Activity Can Look Like an Attack Threat researchers at Elastic Security Labs separately documented how this Keychain behavior complicates detection work. Their analysis found that Claude Code will, as part of its own normal operation, spawn commands resembling security find-generic-password to retrieve its own stored OAuth material. In the environments Elastic studied, these commands typically ran through an intermediate shell process, most often zsh, rather than being executed directly by the Claude binary. Analysts noted that this process chain, Claude Code launching a shell that then touches Keychain, is expected behavior and should not by itself be treated as evidence of compromise. The complication arises because the exact same command sequence looks identical whether it is triggered by routine authentication or by an attacker’s script running under a compromised session. Elastic emphasized that a vendor-signed parent process in the ancestry chain is not a reliable signal of safety on its own. A Documented Real-World Case Elastic’s research team detailed one investigation in which shells running underneath Claude Code authenticated to short-lived, tunnel-published application URLs on the lhr . life domain and pulled application metrics, including spend and advertising figures. The activity progressed to establishing a Cloudflare Quick Tunnel and installing persistence through a macOS LaunchAgent. Researchers noted that reverse tunnels and LaunchAgent-based persistence can expose local administrative services to the broader internet, a risk that holds regardless of whether the underlying activity originated from legitimate experimental automation or from confirmed malicious tooling. Table: Key Signals for Security Teams | Signal Type | Example Behavior | Risk Level | |---|---|---| | Expected Keychain access | Claude Code spawning a shell that runs security find-generic-password for its own token | Low, baseline behavior | | Unsigned or unfamiliar binary reading Keychain | A non-Apple, non-Claude process querying the same credential item | High | | Script execution from writable paths | Commands launched from locations such as /tmp | High | | Unexpected scripting ancestry | osascript or Python processes appearing unexpectedly in the chain | Elevated | | Token replay from a new device | Same OAuth token used to authenticate from an unfamiliar endpoint | High | | Concurrent persistence changes | Simultaneous edits to LaunchAgents, shell profiles, or Claude project configuration files | High | Guidance for Security and Development Teams Baseline, Don’t Blindly Block Elastic’s guidance to defenders centers on context rather than outright suppression. Because Keychain reads tied to Claude Code credentials happen routinely during normal use, teams are advised to baseline this behavior across their fleet instead of treating every instance as an alert-worthy event. Investigators are encouraged to evaluate the complete process tree, command-line arguments, code-signing metadata, terminal session origin, and any follow-on network activity before deciding whether a given Keychain access event reflects normal operation or something that warrants escalation. Additional Hardening Recommendations Security researchers recommend that organizations running Claude Code at scale also monitor the authorization scope granted to connected MCP services, restrict higher-risk agent permission modes, and keep coding-agent workloads isolated from production credentials wherever feasible. Part of a Broader Pattern This disclosure follows an earlier Claude Code security fix, tracked as CVE-2026-27487, which addressed an OS command injection risk in the tool’s macOS credential-refresh path. That issue was resolved in version 2026.2.14. Taken together, researchers say the pattern points to a broader lesson for the AI tooling industry: coding agents function as high-privilege automation environments, and their child processes, stored secrets, and persistence behaviors deserve the same operational scrutiny that security teams already apply to traditional endpoint administration software. Anthropic has not been reported to have issued a mandatory patch tied to this specific Keychain storage design, and the behavior remains present in current releases as of this reporting. Organizations using Claude Code in shared or high-value developer environments are advised to review their endpoint detection rules in light of these findings and consider the hardening steps outlined by researchers.