Coding Agent Session Enumerating Tunnel Processes via pgrep

Duo Tech@duotech

•updated Aug 10, 2026•4•0•10

Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.