Claude Code AI agent caught a crypto miner hiding on a developer’s overheating Mac — XMRig task was hogging ‘about 1175% CPU, roughly 12 cores’ pushing temps to 112 degrees
'Explains why my Mac has been running like s**t,' said the afflicted Redditor.
A developer using Claude Code to help build a temperature monitor app got a friendly warning from the coding agent. “Your Mac is running a crypto miner that I didn’t put there,” flagged the helpful agent. “I saw xmrig using about 1175% CPU, roughly 12 cores,” it informed its human master. Perhaps developer and Redditor UntilHEX should have sensed the crypto miner’s presence without AI help, as they admitted the malware’s presence “explains why my Mac has been running like s**t.”
Claude caught a cryptominer on my Mac whilst building me a temperature monitor appfrom r/claude
Ironically, the cryptomining malware’s nefarious CPU cycle hogging activity is what may have led to its discovery and demise. Pondering over a screenshot of the Claude Code window, we see that this malware was probably added to the Mac’s startup roster on August 29. It looks like UntilHEX was inspired to develop a Mac temperature monitor app after this infection to track and diagnose why the computer was running so hot.
Claude stepped in after the Redditor was concerned about a dump of the Mac’s raw temperature sensor readings. “They seemed far too high,” commented UntilHEX in the social media post. Indeed, the well-known coding agent pointed out that the CPU was peaking at a very toasty 112 degrees Celsius. It explained this was due to a sustained heavy load, specifically “xmrig using about 1175% CPU, roughly 12 cores.” We don’t know how many cores the Mac being used had, but maybe 12 were all of them.
Claude Code went on to describe how the crypto miner software had hidden itself on the Apple computer and ran at startup. It cautiously decided not to kill or remove anything from the Mac, but offered to clean up the CPU-hogging crypto miner, which was sucking all the power from the Apple Silicon computer. “Can I clean it up now?” Claude inquired. “I’d stop the startup item and the miner, and move the files into a quarantine folder.”
Later in the comments, UntilHEX informed the social media throng that Claude was indeed tasked with cleaning up the unwanted crypto miner software. “I only had to delete 1 file manually because Claude had an access issue, but it was very effective,” the Redditor said. After that, a Malwarebytes scan was run to check to see if the AI coding agent-driven clean had really been successful.
Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Mark Tyson is a news editor at Tom's Hardware. He enjoys covering the full breadth of PC tech; from business and semiconductor design to products approaching the edge of reason.
-
ezst036 This answers a question I had been having for a while now.Reply
When you run an AI such as this, is that AI sandboxed and "specialized" into the task you are seeking to task it with?
The answer to that question is clearly a big fat no. The AI could be doing anything that is not related to your task at hand.
In this particular instance, it appears as if Sauron's roving eye found a crypto miner hey great for you.
Are these AI gimmicks logging your key strokes? (one way or the other)How do you know? Are these AI gimmicks turning the cameras on and watching you? Are they listening? How do you know? Can you confirm? When you open your bank account on screen, can it see that information? Your medical information? Retirement information? How do you know? How do you confirm?
Why do they call it Claude Code if it is doing way more than just coding?
Is this actually Claude Recall? As in Microsoft Recall? How do you know? How do you confirm?
If you uninstall Claude, does it still leave a part of itself on your computer to data mine you? -
COLGeek Reply
No. Honest answer.Lieutenant Barclay said:Does Anthropic pay TomsHardware to run these stories? Honest question. -
M0rtis "Your MAC is running a crypto miner THAT I DIDNT PUT THERE"Reply
"It is using 1175% of your CPU" -
rgd1101 Reply
no. but they do get their news story from reddit.Lieutenant Barclay said:Does Anthropic pay TomsHardware to run these stories? Honest question. -
JamesJones44 Do you really need Cluade to open Activity Monitor and see that some process is using 1175% of your CPU when the machine is running like crap? It's great it found it, but it's not like this was a difficult thing to find without LLM support.Reply -
psyconz Reply
That's what I was trying to figure out. What kind of "Dev" can't figure that out themselves? It's not exactly a taxing technical problem, is it 😅 As for glorifying an AI for doing it, that's just pathetic.JamesJones44 said:Do you really need Cluade to open Activity Monitor and see that some process is using 1175% of your CPU when the machine is running like crap? It's great it found it, but it's not like this was a difficult thing to find without LLM support. -
USAFRet And now, for something completely different...Reply
I've been told by many people, in no uncertain terms, that macs can't get malware. They are specifically designed against it. /s -
psyconz Reply
Hahaha, that's an old meme. And yeah, I bet there is a significant number of people who still believe it!USAFRet said:And now, for something completely different...
I've been told by many people, in no uncertain terms, that macs can't get malware. They are specifically designed against it. /s -
cyrusfox agents such as claude code operate with a very wide perview. Not surprising it found this.Reply
More interested in how he got compromised int he first place to run a crypto coin miner unwittingly. I am sure this is mining someones pool, so there is some recourse he could have, find out who is the pool operator and escalate from there.