Claude Code AI Assistant Detects Hidden Cryptominer on a Mac

While helping a developer build an app that monitors temperature, “Claude Code” found a hidden cryptominer on the developer’s “Mac.” The AI told the user that it had not installed the program itself. It turned out that this program was causing the computer to overheat and run very slowly. The user had sent the temperature readings to the agent to investigate the problem.

By investigating why the temperature was much higher than normal, the agent found the root cause. The processor’s temperature had risen to 112 degrees Celsius. A process called “xmrig” was using 1175% of the processor’s capacity, meaning it was fully loading approximately 12 cores. According to the information in the screenshot, the cryptominer was added on August 29 to the list of programs that launch as soon as the computer starts.

“Claude Code” determined that the cryptominer was hidden on an “Apple Silicon”-based computer and started automatically on every boot. The agent did not stop the process or delete the files without the user’s permission. Instead, it recommended disabling the program’s automatic startup, stopping the miner, and moving the related files to a quarantine folder. The user later approved the cleanup.

According to the user, “Claude Code” successfully removed most of the malware. Only 1 file had to be deleted manually because of an access permission issue. The system was then scanned with “Malwarebytes” to verify the results of the cleanup. How the cryptominer got onto the computer and the final result of the scan were not disclosed.