Claude Code reportedly finds XMRig using 1175% CPU on a Mac
Original title: Claude Code Detects Hidden XMRig Cryptominer Consuming 1175% CPU on Mac
A Reddit user says a LaunchAgent and pool.hashvault.sh kept the miner alive; the report is unverified.
A Mac user said Anthropic’s Claude Code found an unauthorized XMRig process while checking temperature readings for a development app. The process reportedly used about 1,175% CPU, ran from a temporary directory, and connected to pool.hashvault.sh. A LaunchAgent with KeepAlive and an encoded script was said to restart it at login, and the user approved cleanup. How the miner was installed is unknown.
Unconfirmed: This is one Reddit report without independent forensics, and a cracked-plugin infection theory is unconfirmed.
- macOS can show over 100% CPU when one process uses several cores.
- XMRig is legitimate mining software; the issue is use without permission.
- Killing the visible process would not remove the reported LaunchAgent.
- The case does not show Claude Code replacing endpoint detection.
Impact: Unauthorized cryptomining consuming most of one Mac’s CPU
- 1.Remove the reported LaunchAgent and encoded login script, not only the XMRig process.
- Vendors
- Anthropic
- Products
- Claude Code
- Malware
- XMRig
From the original article
2 min read at gbhackers.com
A Mac user reported that Anthropic’s Claude Code found an unauthorized XMRig cryptocurrency miner while helping develop a temperature-monitoring application. The mining process reportedly consumed approximately 1,175% CPU, equivalent to nearly 12 fully utilized processor cores, which explained the machine’s sluggish performance.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.