Anthropic has opened Claude Code cloud sessions to general users — no research preview signup required — and is sweetening the deal with up to $250 in free usage credits. From a product standpoint, this is smart growth strategy. From a defender's standpoint, this is a predictable mass-adoption event for an agentic AI coding tool that can read repositories, write files, execute shell commands, and transmit code to cloud infrastructure — all with developer-level privilege on endpoints that hold production credentials, SSH keys, and proprietary source.
Free credits remove the last friction point. Developers who were previously blocked by procurement or cost approval now have zero barrier to pointing an autonomous coding agent at your crown-jewel repositories. Every security team should treat this announcement the way we treated the early days of Dropbox and personal GitHub accounts: a convenience tool that will be adopted with or without approval, and one that creates a new data egress and supply-chain surface. The window to get governance in place before entrenched usage is measured in weeks, not quarters.
Technical Analysis
What Claude Code Cloud Sessions Actually Do
Claude Code is Anthropic's agentic coding assistant. In its local incarnation, it runs as a CLI (typically installed via npm as @anthropic-ai/claude-code) on a developer workstation, where it can read and write files, run shell commands, and interact with git. The cloud session model shifts execution to Anthropic-managed infrastructure: users initiate sessions through the browser at claude.ai, connect repositories (notably GitHub), and the agent executes tasks in a hosted sandbox environment rather than on the local machine.
Key characteristics defenders need to understand:
- Broad code access by design. Cloud sessions typically require OAuth authorization to GitHub or equivalent source control, granting the session read (and often write) access to repositories. A misconfigured or overly broad OAuth grant can expose entire organizations' worth of private repos, not just the one the developer intended.
- Credential residency shifts to the cloud sandbox. Cloud sessions commonly need secrets to be useful — API tokens, deployment keys, environment variables. Those secrets now live in a third-party execution environment, outside your endpoint controls, DLP, and EDR visibility.
- Local installs persist alongside cloud use. The free-credit push applies to cloud sessions, but the onboarding path frequently leads developers to install the local CLI as well — which stores configuration under
~/.claude/and authenticates with API keys or OAuth tokens that may sit in plaintext config files. - Agentic execution is inherently prompt-injectable. Claude Code executes instructions derived from context — including repository contents. Malicious instructions embedded in a README, issue comment, or dependency can steer the agent. This is the well-documented indirect prompt injection problem, and agentic tools with shell and git write access amplify the blast radius dramatically.
- MCP (Model Context Protocol) integrations expand the surface. Claude Code supports MCP servers for tool integration. Each MCP server is third-party code the agent can invoke — a supply-chain and confused-deputy risk vector in its own right.
Threat Model: What Actually Goes Wrong
There is no CVE here and no exploitation campaign — this is a governance and exposure story. The realistic loss scenarios:
- Source code egress without authorization. A developer connects a private monorepo to a cloud session. Code now resides on third-party infrastructure, potentially violating customer contracts, export controls, or regulatory obligations (HIPAA, PCI-DSS scoping).
- Credential leakage into cloud sandboxes. Developers paste API keys or export environment variables into sessions to make builds work. Those secrets are outside your secrets-management perimeter.
- Indirect prompt injection via repository content. An attacker who can commit to any repo a session touches (including via a compromised dependency or a malicious pull request) can attempt to steer the agent into exfiltrating files, modifying code, or pushing malicious commits.
- OAuth over-permissioning. A single consent grant gives the integration access to all repos a user can reach, including other organizations' repos in the case of contractors.
- Shadow AI sprawl. $250 in free credits means adoption will not come through procurement. You will find it in proxy logs, not in purchase orders.
Exploitation Status
No vulnerability is being exploited — this is an exposure-driven risk. However, the threat research community has repeatedly demonstrated indirect prompt injection against agentic coding tools throughout 2025, and security researchers have shown malicious MCP servers exfiltrating data via agent tool calls. Treat these attack patterns as proven techniques, not theoretical ones.
Detection & Response
You cannot govern what you cannot see. The detection content below targets three observable behaviors: installation/execution of the Claude Code CLI on endpoints, network egress to Anthropic infrastructure from non-browser processes, and the creation of local credential/configuration artifacts. These are high-signal hunts — legitimate in environments that have sanctioned Claude Code, but exactly what you need to build an inventory and enforce policy.
Sigma Rules
---
title: Claude Code CLI Installation or Execution on Endpoint
id: 8f3a2b41-7c9d-4e5a-b6f1-2a8c4d9e0f35
status: experimental
description: Detects installation or execution of the Anthropic Claude Code CLI (npm package @anthropic-ai/claude-code) on Windows endpoints. Useful for building a shadow-AI inventory and enforcing AI tooling policy.
references:
- https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-rolls-out-up-to-250-in-free-claude-code-credits-but-only-for-cloud-sessions/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/20
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_cli:
CommandLine|contains:
- '@anthropic-ai/claude-code'
- 'claude-code'
- '\.claude\'
selection_install:
CommandLine|contains:
- 'npm install'
- 'npm i '
- 'npm exec'
- 'npx '
CommandLine|contains:
- 'claude'
condition: selection_cli or selection_install
falsepositives:
- Sanctioned developer use of Claude Code in approved environments
level: low
---
title: Non-Browser Network Connection to Anthropic API Endpoints
id: 2c7e9d14-5a8b-4f3c-9d6e-1b7a0c4f8e29
status: experimental
description: Detects non-browser processes establishing connections to Anthropic API and Claude service domains. Browser traffic to claude.ai is expected for cloud sessions; API traffic from node, python, or other executables indicates local agent or script usage that may bypass web proxy DLP controls.
references:
- https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-rolls-out-up-to-250-in-free-claude-code-credits-but-only-for-cloud-sessions/
- https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/02/20
tags:
- attack.command_and_control
- attack.t1071.001
- attack.exfiltration
- attack.t1041
logsource:
category: network_connection
product: windows
detection:
selection_domain:
DestinationHostname|contains:
- 'api.anthropic.com'
- 'claude.ai'
- 'statsig.anthropic.com'
filter_browsers:
Image|endswith:
- '\chrome.exe'
- '\msedge.exe'
- '\firefox.exe'
- '\brave.exe'
- '\Arc.exe'
condition: selection_domain and not filter_browsers
falsepositives:
- Sanctioned Claude Code or Anthropic SDK usage by developers
- Approved internal tooling integrating the Anthropic API
level: medium
---
title: Claude Code Local Configuration and Credential Artifacts Created
id: 5b1d8e62-3f4a-4c7d-a2e9-8d6f0b3c7a51
status: experimental
description: Detects creation of Claude Code configuration and credential files under user profiles. Presence of these artifacts indicates local CLI usage and potential storage of API keys or OAuth tokens on endpoint — a collection and exfiltration target for infostealers.
references:
- https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-rolls-out-up-to-250-in-free-claude-code-credits-but-only-for-cloud-sessions/
- https://attack.mitre.org/techniques/T1552.001/
author: Security Arsenal
date: 2026/02/20
tags:
- attack.credential_access
- attack.t1552.001
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\.claude\'
- '\.claude.json'
- 'claude-code'
TargetFilename|endswith:
- '.json'
- '.md'
- '.toml'
falsepositives:
- Sanctioned Claude Code installations
level: low
KQL (Microsoft Sentinel / Defender)
This hunt combines endpoint telemetry with network egress to build a complete shadow-AI adoption picture across your fleet. Run it over 30 days to establish an inventory baseline, then convert the network portion into an analytics rule scoped to unmanaged or non-developer devices.
// Claude Code adoption hunt: local CLI execution, npm installs, and non-browser egress to Anthropic
let AnthropicDomains = dynamic(["api.anthropic.com", "claude.ai", "statsig.anthropic.com"]);
let BrowserProcesses = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "Arc.exe"]);
let ProcEvents =
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("@anthropic-ai/claude-code", "claude-code", "claude.ai")
or (ProcessCommandLine has_any ("npm install", "npm i ", "npx", "npm exec") and ProcessCommandLine has "claude")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let NetEvents =
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (AnthropicDomains)
| where not(InitiatingProcessFileName in~ (BrowserProcesses))
| summarize ConnectionCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
by DeviceName, InitiatingProcessFileName, RemoteUrl;
ProcEvents
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ExecutionCount=count(),
SampleCommand=any(ProcessCommandLine)
by DeviceName, AccountName, FileName
| join kind=leftouter NetEvents on DeviceName
| sort by LastSeen desc
For organizations ingesting proxy or firewall logs via CEF/Syslog, complement this with a query against CommonSecurityLog for destination hostnames matching api.anthropic.com — that catches egress from macOS and Linux developer workstations that lack Defender onboarding.
Velociraptor VQL
Use this artifact during triage or fleet-wide hunts to enumerate Claude Code installations, active processes, and on-disk configuration that may contain API keys or OAuth tokens. The credential file locations are prime infostealer targets, so their presence should feed your secrets-rotation decision-making.
-- Hunt: Claude Code installation, processes, and credential artifacts
-- Deploy as a fleet hunt; results identify unmanaged AI tooling adoption
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'claude-code|@anthropic-ai|claude\.ai'
OR Name =~ '(?i)claude'
LET configs = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
'C:/Users/*/.claude/**/*',
'C:/Users/*/.claude.json',
'/home/*/.claude/**/*',
'/home/*/.claude.json',
'/Users/*/.claude/**/*',
'/Users/*/.claude.json',
'/home/*/.npm/_cacache/**/*claude-code*',
'/Users/*/.npm/_cacache/**/*claude-code*'
])
LET npm_global = SELECT FullPath, Mtime
FROM glob(globs=[
'C:/Users/*/AppData/Roaming/npm/node_modules/@anthropic-ai/**/*',
'/usr/local/lib/node_modules/@anthropic-ai/**/*',
'/opt/homebrew/lib/node_modules/@anthropic-ai/**/*'
])
SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, 'CONFIG_ARTIFACT' AS Name, FullPath AS CommandLine,
NULL AS Exe, NULL AS Username, Mtime AS CreateTime FROM configs
UNION ALL
SELECT NULL AS Pid, 'NPM_GLOBAL_INSTALL' AS Name, FullPath AS CommandLine,
NULL AS Exe, NULL AS Username, Mtime AS CreateTime FROM npm_global
Audit Script
Run this on developer workstations (or deploy via your RCM/MDM) to inventory Claude Code adoption, locate potentially exposed credentials, and identify OAuth grants that need review. It is read-only — it reports rather than removes, because yanking tooling from developers without a policy conversation creates shadow IT, not less of it.
#!/usr/bin/env bash
# Security Arsenal - Claude Code / Shadow AI Adoption Audit
# Read-only inventory: installations, config artifacts, exposed credentials, egress checks
# Run as the target user or via MDM across developer fleets
REPORT="claude_code_audit_$(hostname)_$(date +%Y%m%d).txt"
{
echo "=== Claude Code Adoption Audit: $(hostname) - $(date) ==="
echo -e "\n[1] NPM global installations of Claude Code"
npm ls -g --depth=0 2>/dev/null | grep -i "claude" || echo " None found via npm -g"
echo -e "\n[2] Claude configuration directories and credential files"
for dir in "$HOME/.claude" "$HOME/.claude.json"; do
if [ -e "$dir" ]; then
echo " FOUND: $dir"
ls -la "$dir" 2>/dev/null | head -20
fi
done
echo -e "\n[3] API keys or tokens referencing Anthropic in shell profiles"
grep -rl "ANTHROPIC_API_KEY\|sk-ant-" \
"$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.bash_profile" \
"$HOME/.profile" "$HOME/.zshenv" "$HOME/.config/fish" 2>/dev/null \
| sed 's/^/ EXPOSED IN: /' || echo " None found in common profiles"
echo -e "\n[4] .env files in user directories containing Anthropic keys"
find "$HOME" -maxdepth 4 -name ".env*" -type f 2>/dev/null \
-exec grep -l "sk-ant-\|ANTHROPIC" {} \; 2>/dev/null \
| sed 's/^/ KEY MATERIAL: /' || echo " None found"
echo -e "\n[5] Running Claude Code processes"
ps aux | grep -i "[c]laude" | sed 's/^/ /' || echo " None running"
echo -e "\n[6] Recent egress to Anthropic endpoints (if audit logs present)"
if command -v lsof >/dev/null 2>&1; then
lsof -i -nP 2>/dev/null | grep -i "anthropic\|claude" | sed 's/^/ /' \
|| echo " No active connections"
fi
echo -e "\n=== Audit complete. Review findings against AI tooling policy. ==="
} | tee "$REPORT"
echo "Report written to $REPORT"
echo "ACTION: Rotate any ANTHROPIC_API_KEY found in plaintext; review GitHub OAuth grants at https://github.com/settings/applications"
Remediation
There is no patch to apply — remediation here is governance architecture. Do it now, while free credits are driving adoption but before habits are entrenched.
1. Publish an AI coding tool policy this week. Define which agentic tools are approved, which repositories they may touch (never crown-jewel or regulated-data repos without a risk acceptance), and what classes of data may enter cloud sessions. A two-page policy beats a perfect policy that ships in Q3.
2. Inventory before you block. Run the KQL hunt and VQL artifact across your fleet. You will find usage you didn't know about. Approach it as discovery, not enforcement — developers using Claude Code are usually your most security-cooperative engineers if you give them a sanctioned path.
3. Constrain OAuth grants to source control. Audit GitHub OAuth app authorizations (https://github.com/settings/applications at the user level; organization-level third-party application restrictions in GitHub org settings). Enable GitHub's OAuth app access restrictions so new integrations require admin approval. Scope any approved Anthropic integration to specific repositories, never "all repositories."
4. Stand up an enterprise API path. If developers need Claude Code, route them to a sanctioned enterprise arrangement (Anthropic commercial terms, or API access through your cloud provider's AI gateway with your logging, DLP, and spend controls attached). Managed beats prohibited — prohibited just moves usage to personal accounts and credits.
5. Protect the credential layer. Claude Code config directories and sk-ant- API keys in plaintext are infostealer fuel. Extend your secrets-scanning (e.g., trufflehog, gitleaks) to sweep developer endpoints and repositories for Anthropic key patterns. Add .claude/ and .claude.json to your EDR's credential-theft watchlist alongside .aws/, .ssh/, and browser credential stores.
6. Address prompt injection in agentic workflows. For any sanctioned agentic coding usage: require human review of all agent-generated commits (branch protection, required reviews), prohibit agent write access to production branches, and treat MCP servers as third-party software requiring vetting — pin versions, review source, and monitor for updates.
7. Update DLP and egress controls. Decide deliberately whether claude.ai and api.anthropic.com are allowed, proxied, or blocked per user group. An undecided posture is a shadow posture. If you proxy, ensure TLS inspection covers these destinations for your developer population so code egress is logged.
8. Contract and compliance review. If any code touching customer data, PHI, or cardholder data flows into cloud sessions, your HIPAA BAAs, PCI-DSS scoping, and customer DPAs are implicated. Legal and compliance need a seat at this table before the first $250 credit is consumed, not after.
Executive Takeaways
- Free credits = uncontrolled adoption spike. Treat Anthropic's promotion as a leading indicator: your developers are likely already using Claude Code cloud sessions. Discover, don't assume.
- The risk is data egress and credential residency, not malware. Source code and secrets leaving your perimeter through OAuth grants and sandbox environments is the primary loss scenario.
- Shadow AI is the new shadow IT. Apply the same playbook: inventory, sanctioned alternatives, policy, then enforcement.
- Prompt injection is a proven technique against agentic tools. Human review of agent commits and branch protections are non-negotiable controls.
- Credential artifacts multiply attack surface. Local config files and plaintext API keys are infostealer targets; scan and rotate accordingly.
- Move to managed, not prohibited. An enterprise AI coding path with logging and DLP attached converts an ungoverned risk into a productivity control.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.