🌩 When Background AI Agents Become a Security Boundary Problem

Claude Code's background sessions, supervisor process, CLAUDE_CONFIG_DIR override, scheduled tasks, and Markdown-based agent definitions can be chained post-foothold to deploy a persistent, nearly invisible C2 agent evading standard EDR binary-focused detection.

https://www.originhq.com/research/background-c2-agent

#ClaudeCode