Cryptocurrency mining miner rig with gpu cards

A coding assistant became an unlikely security monitor when Claude Code uncovered a cryptocurrency miner hammering a developer’s Mac. The discovery came while Reddit user UntilHEX was building a temperature-monitoring app with the agent—an effort prompted by suspiciously high sensor readings. As first reported by Tom’s Hardware, Claude identified xmrig consuming roughly 1,175% CPU, or about 12 cores, while the processor reached 112 degrees Celsius.

The numbers explain why the machine felt unusually sluggish. On macOS, CPU percentages can exceed 100% when activity is spread across multiple cores, so a reading near 1,175% indicates sustained, extreme load rather than a brief performance spike. The available report does not establish how many cores the Mac has overall, but Claude’s estimate suggested the miner was using a substantial portion of its available processing power.

The software appears to have been configured to launch automatically, with a screenshot reportedly pointing to August 29 as the likely date it was added to the Mac’s startup setup. Claude did not immediately delete files or disable services on its own. Instead, it explained what it had found and asked permission to stop the miner, disable its startup entry, and move related files into quarantine—a cautious approach for an agent operating on a user’s computer.

XMRig is not inherently malware. It is a legitimate, open-source cryptocurrency-mining program that has repeatedly been repurposed by attackers or bundled into unwanted software. Malwarebytes has documented Mac threats that use XMRig alongside persistence mechanisms such as launch agents, including a campaign that placed files in a shared directory and used a .plist file to keep the miner running. Malwarebytes’ analysis illustrates why spotting the process alone is not enough to determine how it arrived on a system.

UntilHEX later told commenters that Claude handled most of the cleanup, although one file had to be removed manually because of an access problem. The developer then ran a Malwarebytes scan to check the result. That follow-up matters: an AI agent can investigate processes, explain likely persistence, and suggest remediation, but its findings still need to be checked with conventional security tools—and users should be wary of granting automated software unrestricted permission to delete system files.

The episode is a useful demonstration of both the promise and the limits of agentic coding tools. Claude was not being used as a dedicated antivirus product; it encountered the miner while helping write a hardware-monitoring application. In this case, an overheating Mac exposed the unwanted workload, and the diagnostic software helped connect the symptoms to their cause. But the incident also reinforces a basic security lesson: a familiar process name does not guarantee benign behavior, and any unexpected startup item deserves investigation before it quietly consumes hardware, electricity, and potentially sensitive system access.

Image Credits

In-Article Image Credits

Cryptocurrency mining miner rig with gpu cards via Wikimedia Commons by Alexandr Gromov with usage type - Creative Commons License. By Alexandr Gromov - Own work, CC BY-SA 4.0, https://commons.wikimedia.org/w/index.php?curid=45711337