Claude Code AI agent caught a crypto miner hiding on a developer’s overheating Mac

A developer using Claude Code to help build a temperature monitor app got a friendly warning from the coding agent. “Your Mac is running a crypto miner that I didn’t put there,” flagged the helpful agent. “I saw xmrig using about 1175% CPU, roughly 12 cores,” it informed its human master. Perhaps developer and Redditor UntilHEX should have sensed the crypto miner’s presence without AI help, as they admitted the malware’s presence “explains why my Mac has been running like s**t.”

Ironically, the cryptomining malware’s nefarious CPU cycle hogging activity is what may have led to its discovery and demise. Pondering over a screenshot of the Claude Code window, we see that this malware was probably added to the Mac’s startup roster on August 29. It looks like UntilHEX was inspired to develop a Mac temperature monitor app after this infection to track and diagnose why the computer was running so hot.

Claude stepped in after the Redditor was concerned about a dump of the Mac’s raw temperature sensor readings. “They seemed far too high,” commented UntilHEX in the social media post. Indeed, the well-known coding agent pointed out that the CPU was peaking at a very toasty 112 degrees Celsius. It explained this was due to a sustained heavy load, specifically “xmrig using about 1175% CPU, roughly 12 cores.” We don’t know how many cores the Mac being used had, but maybe 12 were all of them.

Claude Code went on to describe how the crypto miner software had hidden itself on the Apple computer and ran at startup. It cautiously decided not to kill or remove anything from the Mac, but offered to clean up the CPU-hogging crypto miner, which was sucking all the power from the Apple Silicon computer. “Can I clean it up now?” Claude inquired. “I’d stop the startup item and the miner, and move the files into a quarantine folder.”

Later in the comments, UntilHEX informed the social media throng that Claude was indeed tasked with cleaning up the unwanted crypto miner software. “I only had to delete 1 file manually because Claude had an access issue, but it was very effective,” the Redditor said. After that, a Malwarebytes scan was run to check to see if the AI coding agent-driven clean had really been successful.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.