Security firm Silverfort has published research arguing that Claude Code CLI stores its credentials on macOS where any local process can read them silently. Anthropic maintains the behavior is not a vulnerability.
The issue centers on the CLI’s OAuth bundle, which includes a long-lived refresh token that can be exchanged for fresh access tokens until it is revoked. On macOS the CLI places that bundle in the system Keychain, but according to Silverfort it creates the Keychain item through the standard /usr/bin/security tool without setting any access controls.
The item’s only trusted reader is therefore that tool, which any process can invoke. Silverfort said a single command returns the full bundle, with no Touch ID or password prompt, along with tokens for any connected Model Context Protocol (MCP) servers.
Claude Desktop, by contrast, binds its Keychain item to the signed application, so a read from anything else prompts for the login password.
An Unresolved Disagreement
Silverfort did not call the issue a vulnerability, describing it as an implementation design flaw and noting that exploiting it still requires an attacker already running code as the user. Anthropic went further, closing the June 25 report as informative within 19 minutes. No CVE has been assigned.
The disagreement is about where the security boundary sits. Silverfort’s argument is less that same-user trust is wrong, than that Anthropic is inconsistent: Claude Desktop already enforces a re-authentication prompt for the same kind of secret on the same operating system, so the CLI omitting it looks like an oversight.
The case is strongest against the most common form of credential theft, the one-shot infostealer or malicious install script that runs once and grabs what it can, which a Keychain prompt would stop.
Anthropic drew the boundary at the edge of the user account. In Silverfort’s published account of the disclosure, Anthropic ruled that processes running as the user are already fully trusted, so a per-process lock on the Keychain item adds nothing: code running as the user could simply wait for the token to be used or capture the password typed into any prompt. By that logic the only boundary that mattered was keeping hostile code out of the account to begin with.
One detail complicates Anthropic’s own case, however. If the lock genuinely added nothing, there would be no reason to touch it, yet the company said it is tracking a tightening of the item’s access control as a defense-in-depth improvement worth making, even while maintaining the behavior is not a vulnerability.
Guidance for Defenders
Silverfort also found the Claude apps gateway does not resolve the issue, since a stolen refresh credential keeps working against it until the account is disabled.
Because the macOS case leaves no file to monitor, Silverfort’s guidance is to watch process behavior instead, alerting on calls to the security tool that request the Claude Code credential and flagging the same token appearing on more than one machine.
Expert Insights has contacted Anthropic for comment and will update this article with any response.
The finding extends a run of research into the security of AI-based developer tools, including an earlier Claude Desktop flaw that let a single link run code.
