Claude Code AI Agent Flags Hidden XMRig Cryptominer on Developer Mac

The AI coding assistant Claude Code identified a hidden cryptocurrency miner on a developer’s Mac while constructing a temperature monitoring application. According to a report by Cyber Security News, the assistant investigated unusual hardware sensor readings and discovered the unauthorized mining software running in the background.

During the development session, the AI noted that the Mac’s CPU had reached 112 degrees Celsius. It traced the excessive heat to the XMRig process, which was consuming approximately 1,175 percent of the processor’s capacity. This load corresponded to roughly twelve cores of processing power, indicating a significant and unauthorized resource drain on the system.

Context and Background

The discovery occurred after Claude Code reviewed raw sensor data and decided to check the running processes on the machine. The assistant explicitly warned the user that a cryptominer was operating on the device without its involvement. The developer, posting under the username u/UntilHEX on Reddit, shared a screenshot of the interaction to document the unexpected security finding.

The screenshot indicated that the miner was executing from the /tmp/rigupdater directory. It was sending hashing power to the pool.hashvault.sh destination. These details provide specific indicators of compromise for this incident, though they do not reveal how the software initially entered the system or if other devices are affected.

Who Is Affected

This report originates from a single user submission and has not been validated through independent hardware logs or a formal forensic investigation. The account remains a user report supported by visual evidence rather than a published security advisory. Consequently, the scope of the infection is limited to the specific device described in the Reddit post.

XMRig is legitimate mining software with official builds for macOS, including support for Apple Silicon. The security issue arises from its use without the owner’s consent. Finding the program alone does not prove malware unless its installation method and configuration are examined for unauthorized behavior.

What should you do?

The AI also identified a suspicious property list file located in the ~/Library/LaunchAgents/ directory. This randomly named startup entry, dated August 29, ran a large encoded script through bash with KeepAlive enabled. The assistant stated this entry existed before its development work began, suggesting the persistence mechanism was already active.

Apple’s documentation notes that LaunchAgents run within a user’s session and can keep jobs active. Disabling the process without removing the launcher may allow the miner to restart. The screenshot also highlighted potential risks to credentials stored on the Mac, including GitHub login details.

As Threat Times reported on October 19, 2026, a similar AI coding assistant identified a hidden cryptominer on a developer’s overheating Mac, demonstrating the growing role of AI in detecting resource anomalies.

What to do and how to stay safe

• Monitor system performance metrics for unusual spikes in CPU usage or temperature that do not align with active workloads.
• Review the LaunchAgents directory for unfamiliar property list files or scripts that run with persistence settings like KeepAlive.
• Verify that all installed software, including development tools

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.