GoKawiilAnthropic's Claude Code spots hidden xmrig crypto miner on developer's Mac
A Reddit user building a Mac temperature-monitoring app with Claude Code was alerted by the AI agent that xmrig, a crypto-mining program, was running unauthorized on their machine using roughly 1175% CPU across about 12 cores. Claude identified the malware had been added to startup around August 29 and offered to quarantine the files rather than deleting them outright.
GoKawiil's interpretation of the reporting above, not reported fact.
The episode suggests AI coding assistants can double as informal security tools, surfacing malware that a user might otherwise only notice through vague symptoms like an overheating laptop. It also hints at a cautious design choice by Claude Code—asking permission before removing files—which could reflect a broader approach to limiting AI agents' autonomous actions on a user's system.
- Claude Code flagged an xmrig cryptominer consuming about 1175% CPU on a user's Mac.
- The malware had reportedly been installed as a startup item around August 29.
- Claude offered to quarantine rather than delete the malicious files, asking for user confirmation first.
Malwarebytes Premium for Mac — If a crypto miner can silently hijack your Mac's CPU and send temps soaring, it's worth having dedicated malware protection rather than relying on noticing your fans screaming. Malwarebytes Premium actively scans for and removes hidden threats like xmrig-style miners before they cook your hardware. It's a simple, proactive layer of defense that complements good coding habits and monitoring tools.
See Malwarebytes Premium for Mac on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Mark Tyson, 2026-10-19
Published there as: “Claude Code AI agent caught a crypto miner hiding on a developer’s overheating Mac”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.