Silverfort has published research detailing a design weakness in Anthropic’s Claude Code CLI credential storage on macOS that allows any process running under the user’s own permissions to silently extract stored credentials. The issue was reported to Anthropic via HackerOne on June 25, 2026 under coordinated disclosure. Anthropic confirmed it is tracking a tightening of the Keychain item’s access control as a hardening improvement and did not object to publication.
What is this weakness for those who don’t know? Claude Code CLI stores OAuth access and refresh tokens (plus any connected MCP server credentials) in the macOS Keychain. However, the way the Keychain item is created leaves it readable by any user-mode process without requiring a password, Touch ID, or other re-authentication prompt. This stands in contrast to Claude Desktop, which correctly protects the same class of secrets.
The practical impact is significant. A single silent command can return the full credential JSON. An attacker who can run code as the user — through an infostealer, malicious dependency, or hostile IDE extension — can steal the long-lived refresh token and replay the session from another machine. Because the refresh token provides standing account access, the attacker can also reach any MCP servers the user has connected, potentially influencing company codebases, knowledge bases, or other sensitive systems those servers control.
The research emphasizes that this is a same-user, local exposure rather than a privilege-escalation or remote vulnerability. Nonetheless, same-user is precisely the context in which many real-world endpoint compromises already operate. Until Anthropic hardens the Keychain ACL, defenders are advised to monitor for anomalous Keychain access and, more importantly, for the same token appearing across different machines — a strong indicator of theft.
Key Findings
Silverfort researchers discovered that Anthropic’s Claude Code CLI on macOS stores OAuth credentials in the Keychain in a way that allows any process running under the user’s own permissions to silently read the full credential bundle without requiring a password, Touch ID, or other re-authentication prompt.
The weakness stems from how the CLI creates the Keychain item: it shells out to /usr/bin/security add-generic-password without access-control arguments, so the item inherits a default ACL that trusts the security tool itself, which any user-mode process can invoke.
A single silent command — security find-generic-password -s "Claude Code-credentials" -a "$USER" -w — returns the complete credential JSON, including the short-lived access token, the long-lived refresh token, and any connected MCP server or plugin secrets.
Claude Desktop, which runs on the same operating system and protects the same class of secrets, implements Keychain protection correctly by binding the item to its own application signature and requiring user re-authentication, demonstrating that the weakness is an implementation choice rather than a macOS limitation.
The design flaw is classified as a security weakness (CWE-732: incorrect permission assignment for a critical resource, and CWE-522: insufficiently protected credentials) rather than a traditional vulnerability requiring privilege escalation.
Exploiting the weakness requires only the ability to run code as the user — a common outcome of infostealers, malicious package post-install scripts, or hostile IDE extensions — and does not require elevated privileges or sophisticated techniques.
Because the stolen material includes a long-lived refresh token, an attacker can replay the session from another machine and obtain standing access to the user’s Anthropic account and any MCP servers the user has connected.
Connected MCP servers may control sensitive enterprise resources such as company codebases in GitHub, knowledge bases in Atlassian, or other systems, turning a local credential theft into a potential lateral movement path.
On Linux and Windows, credentials are stored in plaintext JSON files that defenders can already monitor with file-integrity, permission-drift, and content-signature controls; the macOS Keychain approach removes that visibility while failing to deliver the expected re-authentication protection.
Anthropic was notified under coordinated disclosure on June 25, 2026 via HackerOne, promptly responded, and confirmed it is tracking a tightening of the Keychain item’s access control as a defense-in-depth hardening improvement.
Until remediation, the most reliable detection signals are anomalous process access to the specific Keychain entry and, more importantly, the same OAuth token appearing from multiple machines — a strong indicator of credential theft and replay.
The research underscores that AI coding agents now hold high-value, standing credentials, making correct secret storage and identity-aware detection critical controls for any organization deploying them on developer endpoints.
What the Report Covers (368 words)
Silverfort’s research post, Skipping the lock: A Claude Code CLI weakness lets any macOS process read stored credentials, provides a detailed technical examination of a design weakness in how Anthropic’s Claude Code CLI stores credentials on macOS. The document functions as both a disclosure of the finding and a practical defensive guide for security teams.
The report covers several core areas:
Executive Summary — Outlines the nature of the weakness, its practical impact, the coordinated disclosure timeline, and high-level guidance for defenders until remediation.
Background on AI Agent Credentials — Explains that modern AI coding agents such as Claude Code CLI hold real OAuth credentials (access tokens and long-lived refresh tokens) plus any connected MCP server secrets, turning local credential stores into high-value targets.
Platform-by-Platform Credential Storage — Contrasts the plaintext JSON file approach used on Linux and Windows with the macOS Keychain approach, noting that file-based storage, while weaker in theory, is more visible to existing AV/EDR and file-integrity controls.
Root Cause Analysis of the macOS Weakness — Details how the CLI creates its Keychain item by calling /usr/bin/security without proper access-control arguments, resulting in an ACL that effectively allows any user-mode process to read the secret silently.
Comparison with Claude Desktop — Shows that Anthropic already implements correct Keychain protection in Claude Desktop (binding the item to the application signature and requiring re-authentication), proving the CLI weakness is an implementation choice rather than a platform limitation.
Exploitation and Session Replay — Describes how an attacker can extract the credential bundle and reconstruct a working session on another machine with minimal footprint.
Defensive Guidance — Provides concrete recommendations including monitoring for anomalous Keychain access, detecting the same token used across multiple machines, and leveraging identity security platforms that can control and flag static or temporary credential reuse.
Disclosure Timeline and Vendor Response — Documents the June 25, 2026 HackerOne report, Anthropic’s prompt acknowledgment, and the company’s commitment to track a Keychain ACL hardening as a defense-in-depth improvement.
Overall, the research combines technical root-cause analysis with actionable detection and response guidance, highlighting that AI coding agents now require the same rigorous secret-handling and identity-aware monitoring practices applied to other high-value credentials.
Our Take
AI Security Take
Silverfort’s research into the Claude Code CLI credential-storage weakness on macOS delivers a clear warning for organizations deploying AI coding agents: the credentials these tools hold are high-value standing access, and incorrect secret handling can turn a local compromise into account takeover and potential lateral movement through connected MCP servers.
The finding is not a remote vulnerability or privilege-escalation bug. It is a design weakness that allows any process running as the user to silently extract the full OAuth token bundle and associated MCP secrets. Because Claude Desktop already implements the correct Keychain pattern on the same operating system, the issue is an implementation choice rather than a platform limitation. That makes the lesson broader than one product: AI agent tooling must treat credential storage with the same rigor applied to other long-lived secrets, and defenders cannot assume that “Keychain” automatically equals strong protection.
For security teams, the practical takeaways are immediate. Until Anthropic hardens the ACL, organizations running Claude Code CLI on macOS should prioritize two detection layers. First, monitor for anomalous process access to the specific Keychain entry. Second — and more importantly — watch for the same token appearing from multiple machines, a strong indicator of theft and replay. Identity security platforms that can control static or temporary credential use and flag cross-host reuse provide a more resilient control than endpoint visibility alone.
The research also reinforces a larger shift in the AI security landscape. AI coding agents and MCP-connected tools now sit at the intersection of developer productivity and high-value access. Weaknesses in how they store and protect credentials create new pathways for credential theft that traditional AV/EDR heuristics may miss, especially when the storage mechanism is an OS keystore rather than a file. Organizations that treat these agents as privileged non-human identities — with continuous monitoring, least-privilege access, and strong secret hygiene — will be better positioned to adopt them safely.
In short, the Claude Code CLI case is a concrete example of why AI agent security must extend beyond model safety and prompt filtering into the identity and secret-management layer. Correct implementation of basic credential protection remains foundational, even — and especially — when the tool is an AI agent.
