Skip to content
NewA calmer, faster ZeroHour
StoryMalwaremedium

Claude Code reportedly finds unauthorized XMRig miner on a Mac

2 sources · 2 articlesFirst reported Updated ()
What's new

October 20: Outlets add unverified details—an August 29 LaunchAgent, pool.hashvault.sh, a 112°C peak, partial cleanup, and a later Malwarebytes scan.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

An unverified Reddit account says Claude Code found an XMRig miner using about 1,175% CPU on a Mac.

A Reddit user says Anthropic’s Claude Code found an unauthorized XMRig process while checking high temperature readings during work on a temperature-monitor app. A shared screenshot named /tmp/rigupdater, the pool pool.hashvault.sh, and a KeepAlive LaunchAgent that ran an encoded bash script and was dated August 29. Peak CPU temperature was shown as 112°C. The user later said Claude cleaned most files and a Malwarebytes scan followed. How the software arrived, and whether GitHub credentials were stolen, is not established.

Key facts
  • The report is an unverified Reddit account, not a confirmed incident.
  • The miner reportedly used about 1,175% CPU, consistent with multi-core use.
  • A KeepAlive LaunchAgent dated August 29 was said to restart it at login.
  • Screenshot details include /tmp/rigupdater and pool.hashvault.sh.
  • GitHub login exposure was flagged as possible, not confirmed stolen.
  • Claude reportedly said the LaunchAgent predated its development work.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Cyber Security NewsScreenshot path, 112°C peak, possible GitHub exposure, and Malwarebytes follow-up.
  • GBHackersExplains multi-core CPU readings and that killing the process leaves the LaunchAgent.
Vendors
AppleAnthropic
Products
macOSClaude Code
Malware
XMRigCrashStealer
Organizations
Malwarebytes
AI models
Claude

Coverage

oldest first · one row per article · UTC
  1. · 5d ago Cyber Security NewsFirst report

    Claude Code reportedly finds hidden XMRig miner on a Mac

    A Reddit user says the assistant saw about 1,175% CPU use and a LaunchAgent dated August 29; the report is unverified.

  2. · 5d ago GBHackers

    Claude Code reportedly finds XMRig using 1175% CPU on a Mac

    A Reddit user says a LaunchAgent and pool.hashvault.sh kept the miner alive; the report is unverified.