Claude Code reportedly finds hidden XMRig miner on a Mac
Original title: Claude AI Detects Hidden Crypto Miner While Building Temperature Monitor App on Mac
A Reddit user says the assistant saw about 1,175% CPU use and a LaunchAgent dated August 29; the report is unverified.
While building a temperature-monitor app, Claude Code reportedly investigated high sensor readings on a developer’s Mac and identified XMRig. A shared screenshot named /tmp/rigupdater, the pool pool.hashvault.sh, and a KeepAlive LaunchAgent that ran an encoded bash script. The user later said Claude cleaned most files and a Malwarebytes scan followed. How the software arrived, and whether credentials were stolen, is not established.
Unconfirmed: The account is a Reddit report with a screenshot; infection route, installer, and any theft are unconfirmed.
- The screenshot put peak CPU temperature at 112°C.
- Claude said the LaunchAgent predated its development work.
- GitHub login exposure was flagged as possible, not confirmed stolen.
- Prior fake-CAPTCHA and CrashStealer cases are not linked to this Mac.
Impact: Unauthorized cryptomining; credential theft not confirmed
| Product | Affected |
|---|---|
| Apple macOS | — |
- 1.Review LaunchAgents and unexplained sustained CPU load or heat.
- 2.Disable the startup item before stopping the miner so it cannot restart.
- 3.Isolate a suspected Mac and change passwords from a clean device.
- Vendors
- Apple
- Products
- macOSClaude Code
- Malware
- XMRigCrashStealer
- Organizations
- Malwarebytes
- AI models
- Claude
From the original article
3 min read at cybersecuritynews.com
An ordinary coding task led to an unexpected security discovery when Claude Code reportedly found a hidden cryptocurrency miner on a developer’s Mac. The AI assistant was building a temperature monitoring app when unusually high sensor readings prompted it to investigate CPU activity. It identified XMRig consuming about 1,175% CPU, described as roughly 12 cores […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.