Claude Code AI Agent Detects Hidden Crypto Miner on Developer’s Mac

An artificial intelligence coding assistant named Claude Code detected a hidden cryptocurrency miner running on a developer’s Mac computer. The agent flagged the unauthorized software while the user was building a temperature monitoring application, revealing that the malware was consuming excessive processing power.

According to Tom's Hardware, the developer, known online as UntilHEX, was using Claude Code to help construct an app designed to track thermal readings. The AI agent interrupted the workflow with a warning that a crypto miner was present on the system. It specified that the process, identified as xmrig, was utilizing approximately 1175% of the CPU capacity, which corresponded to roughly 12 cores.

Context and Discovery

The discovery occurred after the developer noticed unusually high temperature sensor readings on the Mac. The user expressed concern that the raw data seemed far too high, prompting the AI to analyze the system load. Claude Code determined that the CPU was peaking at 112 degrees Celsius due to sustained heavy usage by the mining software.

The developer admitted that the malware’s presence explained why the computer had been performing poorly. The cryptominer had likely been added to the Mac’s startup roster on August 29. The excessive heat generated by the CPU cycle hogging activity may have directly led to the decision to build the temperature monitor app in the first place.

Cleanup and Verification

Claude Code described how the crypto miner had hidden itself on the Apple computer and was configured to run at startup. The agent cautiously decided not to automatically kill or remove any files but instead offered to clean up the CPU-hogging process. It proposed stopping the startup item and the miner, then moving the associated files into a quarantine folder.

The user accepted the offer and tasked Claude with removing the unwanted software. According to the developer, the AI was very effective in the cleanup process. However, one file had to be deleted manually because Claude encountered an access issue. Afterward, the user ran a Malwarebytes scan to verify that the AI-driven cleaning had been successful and that the threat was fully removed.

What should you do?

Security professionals should monitor for unusual CPU usage spikes that do not correlate with known legitimate processes. High thermal readings on workstations can be an indicator of unauthorized background tasks. Users should regularly review startup items and scheduled tasks for unknown executables. Automated tools should be used with caution, as AI agents may lack the necessary permissions to fully remediate deeply embedded threats without manual intervention.

What to do and how to stay safe: Claude Code

• Monitor system resource usage for abnormal CPU spikes that indicate unauthorized mining activity.
• Review startup items and scheduled tasks to identify and remove unknown executables.
• Use established antivirus or anti-malware scanners to verify system integrity after manual cleanup.
• Keep operating system permissions tight to limit the ability of malware to persist at startup.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific malware was detected by Claude Code?

The AI agent identified xmrig, a cryptocurrency miner, which was using approximately 1175% CPU on the affected Mac.

How did the malware affect the computer's performance?

The malware caused the CPU to peak at 112 degrees Celsius and significantly degraded the computer's overall performance.

Was the cleanup fully automated by the AI?

No, the user had to manually delete one file because Claude Code encountered an access issue during the removal process.