Keychain Dump of Claude Code OAuth Credentials via security CLI

Duo Tech@duotech

•updated Aug 10, 2026•7•0•12

Detects the macOS security CLI dumping the Claude Code OAuth credential item from Keychain (find-generic-password -w targeting 'Claude Code-credentials') by a process other than Claude Code itself, indicating credential theft targeting the coding agent's stored token.