Key points
- Claude Code identified XMRig while validating temperature sensor data.
- The miner used a LaunchAgent to maintain persistence across logins.
- No independent forensic verification of the incident has occurred yet.
A macOS user reported that Anthropic’s Claude Code discovered an unauthorized XMRig cryptominer on their machine, according to GBHackers. The discovery occurred while the assistant helped the developer validate a temperature-monitoring application. The user shared the account on Reddit under the handle u/UntilHEX.
The AI assistant noticed unusually high temperature readings and investigated running processes to find the cause. It identified XMRig as the source of the excessive resource usage. The process reportedly consumed approximately 1,175% CPU, which corresponds to nearly twelve fully utilized processor cores. This high usage explained the machine’s sluggish performance during development work.
Technical Context and Persistence
The reported CPU percentage does not indicate a physical capacity error. macOS aggregates process utilization across multiple cores, allowing multithreaded applications to show values well above one hundred percent. This metric reflects sustained parallel computation rather than a measurement anomaly. The miner executed from a temporary directory and connected to the pool.hashvault.sh mining pool.
A macOS LaunchAgent maintained persistence through an encoded script, ensuring the mining process ran automatically upon user login. The KeepAlive configuration in the agent would restart the process if terminated. Simply stopping the visible mining activity would not remove the underlying persistence mechanism. The user approved cleanup actions after the assistant identified the threat.
Affected Environments and Verification
The incident remains a user-reported finding and has not undergone independent forensic verification. The available account does not clarify how the miner first infiltrated the Mac. XMRig is an open-source, cross-platform mining application with official macOS binaries. The security issue stems from cryptojacking, which involves deploying mining software on another person’s computer without authorization.
Next steps
Security teams should treat this report as an unverified user account. No patch or fix has been confirmed for this specific infiltration vector. Organizations should monitor for similar high-CPU anomalies that correlate with unexpected thermal output. Developers using AI coding assistants should remain aware of the tools’ ability to inspect system processes during routine validation tasks.
Signals worth monitoring
Teams usually detect cryptojacking by monitoring for sustained high CPU utilization on idle workstations. Check whether temporary directories contain executable binaries that persist across reboots. Look for new LaunchAgents or scheduled tasks that reference encoded scripts or external mining pools. Verify that AI coding assistants are not inadvertently masking process activity during debugging sessions.
Background: Cryptojacking
Cryptojacking begins with a browser script or installed binary that hijacks your CPU or GPU to solve cryptographic puzzles. It operates silently, consuming resources while sending proceeds to the attacker. You can stop it by monitoring process behavior, blocking known mining pools, and restricting script execution on untrusted sites.
Read the full guide: How Cryptojacking Works: The Step-by-Step Lifecycle of Silent Theft
What to do and how to stay safe: XMRig
- Review system logs for new LaunchAgents or cron jobs that execute from temporary directories.
- Monitor CPU usage patterns for sustained multi-core consumption that does not match known workload profiles.
- Inspect active network connections for traffic directed to known cryptocurrency mining pool domains.
- Validate that AI development tools have appropriate sandboxing to prevent unintended process inspection.
Step-by-step guide: Phishing Defined: Anatomy of the Attack and Risk Reduction
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did Claude Code find the cryptominer on the Mac?
The assistant investigated high temperature readings and identified XMRig as the source of excessive CPU consumption.
Is XMRig inherently malicious software?
No, XMRig is open-source mining software; the issue is unauthorized deployment, known as cryptojacking.
Has this incident been independently verified?
No, the account remains a user report and has not undergone independent forensic verification.
