A Claude Code hidden crypto miner discovery has revealed how an ordinary programming task can expose a serious security problem. While building a temperature-monitoring application for a Mac, Anthropic’s AI coding assistant reportedly identified an XMRig cryptocurrency miner consuming approximately 1,175% CPU.
The developer had not requested a malware investigation. Claude was checking raw temperature sensor readings when the unusually high numbers led it to examine running processes.
That investigation uncovered what the device owner described as an unauthorized mining operation, alongside a suspicious macOS startup component that appeared capable of restoring the process.
The incident was shared on Reddit on October 18, 2026, by a developer using the name UntilHEX. The account includes a screenshot of Claude’s investigation, but the findings have not been independently validated through a published forensic report.
The case also illustrates an increasingly relevant question for developers and security teams: how should AI coding assistants respond when routine technical work uncovers evidence of a possible compromise?
For broader context on the opportunities and security risks surrounding increasingly autonomous assistants, see our AI Cyber Threats and Agentic Security Guide.
Key Technical Findings
- Initial task: Claude Code was building a macOS temperature-monitoring application.
- Detection trigger: Unexpected sensor readings prompted the assistant to investigate CPU utilization.
- Suspicious process: Claude reportedly identified an XMRig cryptocurrency miner.
- CPU consumption: The process was reported to be using approximately 1,175% CPU, equivalent to nearly 12 fully utilized logical processors under per-core accounting.
- Reported temperature: The screenshot included a peak sensor reading of 112°C, which has not been independently verified.
- Executable path: The reported mining process was associated with
/tmp/rigupdater. - Possible persistence: A suspicious entry under
~/Library/LaunchAgents/reportedly used an encoded shell command and aKeepAlivesetting. - Remediation: The developer said Claude helped with cleanup, while one file required manual removal. A Malwarebytes scan reportedly followed.
How Claude Code Discovered the Hidden Crypto Miner
The investigation began with a task that had no obvious connection to cybersecurity.
The Mac owner wanted a simple application that could display temperature measurements. Claude Code was working with raw sensor readings to confirm whether the values shown by the application were reasonable.
Those readings did not look right.
Instead of assuming the application was functioning correctly, Claude reportedly checked which processes were consuming CPU resources.
That additional troubleshooting step exposed a process identified as xmrig, with CPU usage around 1,175%.
On macOS, process utilization can exceed 100% when software uses multiple CPU cores. A reported value of 1,175% therefore represents the equivalent of approximately 11.75 logical processors at full utilization. It does not mean the computer has somehow exceeded its total CPU capacity by more than eleven times.
Sustained mining activity can generate significant heat, consume energy, affect battery life and leave fewer processing resources available for legitimate applications.
For the developer, the discovery offered a plausible explanation for why the Mac had been performing poorly.
What makes the incident unusual is the route to discovery. Claude was not conducting a scheduled malware scan or responding to a security alert. The suspected threat emerged while the assistant was validating the output of its own coding task.
What Is XMRig and Why Was It Running on the Mac?
XMRig is an open-source cryptocurrency mining application with support for several mining algorithms and operating systems, including macOS.
According to the project’s official documentation, it supports CPU-based mining and other computing backends.
The software itself is not automatically malicious. Some users deliberately install XMRig to mine cryptocurrency using their own hardware.
The security concern in this case is the owner’s statement that the mining software was not intentionally installed or authorized.
When an attacker secretly deploys mining software on another person’s computer, the activity is commonly described as cryptojacking.
Rather than directly stealing documents or encrypting files, cryptojacking primarily abuses computing resources to generate cryptocurrency for an unauthorized operator.
That does not mean a mining infection is harmless.
An attacker who can execute software and establish persistence on a device may also have created opportunities for other malicious activity. Whether any additional capabilities existed on this Mac remains unknown.
XMRig Malware on Mac: Suspicious Files and Mining Activity
The screenshot associated with the report identified several artifacts that deserve attention.
The mining process was reportedly running from /tmp/rigupdater, while its configuration referenced pool.hashvault.sh as a mining destination.
The temporary-directory path is noteworthy because it is not the normal location most users would expect for a deliberately installed desktop application.
However, a file’s location alone does not prove malicious intent. Investigators need to examine its contents, signature, execution history and relationship to other processes.
The reported mining pool address is also an investigative clue, not evidence that the mining-pool operator knowingly participated in an attack.
Cryptocurrency mining pools are shared infrastructure used by many participants, including legitimate miners.
The specific configuration, worker identity, wallet information and network behavior would be needed to establish more about the unauthorized operation.
No verified cryptocurrency earnings, attacker-controlled wallet or wider campaign infrastructure has been publicly established from this incident.
Suspicious macOS LaunchAgent May Have Kept the Miner Running
A more concerning discovery involved a startup configuration inside the user’s macOS LaunchAgents directory.
According to the shared screenshot, Claude found a suspicious property list file with a randomized-looking name, an encoded shell command and a KeepAlive configuration.
The entry was reportedly dated August 29, preceding the developer’s Claude Code session.
macOS uses a service manager called launchd to execute and supervise background tasks. LaunchAgents are one of the normal mechanisms applications use to run software within a logged-in user’s session.
Apple’s official documentation explains that the KeepAlive option can instruct launchd to maintain a running process.
For legitimate applications, this capability supports useful background services.
For unwanted software, the same mechanism can become a persistence technique.
If a miner is terminated without addressing the component responsible for starting it, the process may return when its supervising job launches again.
That is why the reported LaunchAgent deserved investigation alongside the mining executable.
Nevertheless, LaunchAgents are not inherently suspicious. The presence of a property list file, encoded command or unusual name is not enough by itself to establish a malware infection.
Investigators should correlate these indicators with process execution, file contents and the device owner’s authorization.
Did Claude Code Remove the Miner Successfully?
The initial screenshot reportedly showed Claude asking permission before terminating the mining process and modifying suspicious startup components.
That distinction matters because removing system files or stopping background services can have consequences beyond the immediate task.
In a follow-up response on Reddit, the developer said Claude handled most of the cleanup.
One file reportedly required manual deletion because the assistant encountered an access restriction.
The developer also said a Malwarebytes scan was performed afterward.
These statements support the conclusion that remediation was attempted, but they do not establish complete eradication.
The publicly available account does not include a full post-cleanup forensic report, a complete inventory of removed files or independently reviewed endpoint telemetry.
It also does not establish whether the original infection mechanism was removed.
The developer suspected cracked audio plugins may have introduced the unwanted software, but no specific installer, plugin or distribution channel has been confirmed as the source.
How to Detect a Hidden Crypto Miner on macOS
Mac users who notice persistent heat, unexplained battery drain, loud fans or unusually slow performance should investigate the underlying resource usage.
Those symptoms can also be caused by legitimate software, hardware issues or demanding workloads. They are reasons to inspect the system, not proof of malware.
1. Examine CPU Usage in Activity Monitor
Open Activity Monitor from Applications > Utilities and select the CPU tab.
Sort processes by CPU usage and look for applications that maintain unusually high utilization when no demanding task should be running.
Check the process name, executable location and whether the application is expected on the device.
Video encoding, virtualization, software builds and other legitimate workloads can consume considerable CPU resources, so context is essential.
2. Inspect Running Processes in Terminal
Developers and administrators can use the following read-only command to list processes with high CPU utilization:
ps -axo pid,ppid,%cpu,command -r | head -20To search for process command lines containing the XMRig name:
ps aux | grep -i '[x]mrig'A negative result does not prove the Mac is clean. Unauthorized miners can use different executable names or be launched through scripts and other components.
3. Review Login Items and LaunchAgents
Open System Settings and inspect Login Items and Extensions for unfamiliar background software.
Advanced users can also list per-user LaunchAgent files:
ls -la ~/Library/LaunchAgents/Administrators investigating a suspected compromise may need to inspect system-wide LaunchAgents and LaunchDaemons as well.
Do not delete an entry simply because its name looks unfamiliar. Determine which application created it and what executable it runs.
4. Examine Unusual Executable Locations
If a suspicious process has been identified, record its executable path and inspect its associated files before removing anything.
Temporary directories, unexpected background executables and scripts that recreate missing files can provide useful investigative leads.
However, legitimate applications also create temporary files and helper programs. Suspicious paths should be evaluated with additional evidence.
5. Check Network Connections and Security Alerts
Unauthorized mining normally requires communication with mining infrastructure unless it is configured to operate in another way.
Security teams can review endpoint network telemetry, DNS logs, firewall records and process-to-connection relationships for unexplained mining-related traffic.
A connection to a known mining pool may justify investigation but is not sufficient on its own to establish malicious behavior.
Run an up-to-date, trusted security scanner and review its findings alongside system activity.
Remediation Verification: How to Check Whether the Threat Is Gone
Removing a visible miner process is only part of the response.
If unauthorized mining is confirmed, users should determine whether the installation mechanism, startup configuration or any related components remain active.
For a personal Mac, a practical response includes the following checks:
- Record the suspicious process, executable path and relevant startup configuration before cleanup when feasible.
- Use reputable endpoint protection software to examine the device.
- Remove unauthorized software and associated persistence components after confirming their purpose.
- Restart the Mac and verify that the suspicious process does not reappear.
- Recheck CPU activity and investigate continued abnormal resource consumption.
- Review recently installed software, particularly applications from untrusted or unofficial distribution sources.
- Consider potential credential exposure if the device contained sensitive developer or business accounts.
For company-managed Macs, notify the security team before deleting potential evidence or making disruptive changes.
If compromise is credible, incident responders may need to isolate the device, preserve logs, inspect additional persistence mechanisms and determine whether rebuilding the system is safer than attempting selective cleanup.
Where credentials may have been exposed, change affected passwords and revoke potentially compromised tokens from a trusted device.
That can include developer access tokens, SSH keys, cloud credentials, repository access and authenticated browser sessions, depending on the evidence and threat model.
A successful malware scan and normal CPU readings are reassuring signs, but neither independently proves that all attacker access has been eliminated.
Why AI Coding Assistants Need Permission Boundaries
The incident shows a useful side of AI-assisted troubleshooting.
Claude reportedly recognized that the sensor readings required further explanation, collected additional system information and identified an unexpected process.
But the same ability to inspect and modify a development environment introduces security questions.
An AI coding assistant with broad terminal access may be able to inspect sensitive directories, execute commands or change files outside the immediate programming task.
That makes authorization and human review essential.
Organizations should distinguish between read-only investigation and actions that modify system state.
For example, listing running processes is materially different from terminating services, deleting startup entries or altering security configurations.
A coding agent may help investigate a problem, but its recommendations should not bypass existing endpoint security procedures.
This distinction is also central to our earlier analysis of AI agent security and why visibility alone is not enough. Discovering unexpected behavior creates an opportunity to respond, but secure operation still depends on permissions, approved actions and accountable controls.
Confirmed vs Unknown: What the Public Evidence Establishes
Supported by the Developer’s Account
- The developer asked Claude Code to create a Mac temperature-monitoring application.
- Unexpected sensor readings prompted further investigation.
- Claude reportedly identified an XMRig process consuming approximately 1,175% CPU.
- The screenshot referenced
/tmp/rigupdaterand a mining pool destination. - A suspicious LaunchAgent configuration was reportedly identified.
- The developer said Claude helped with cleanup and that one file required manual removal.
- The developer reported running a Malwarebytes scan afterward.
Not Independently Confirmed
- The actual infection source and installation date.
- Whether cracked audio plugins were responsible.
- The identity of whoever installed or controlled the mining process.
- The amount of cryptocurrency generated.
- Whether credentials, source code or personal files were stolen.
- Whether additional malicious components were present.
- Whether the reported 112°C measurement reflected a validated CPU sensor reading.
- Whether remediation removed every persistence mechanism.
- Whether other computers were affected by the same operation.
There is currently no basis in the published account to connect this incident to a specific malware family, named threat actor or coordinated campaign beyond the reported presence of XMRig.
CyberUpdates365 Analysis
The most interesting part of this case is not simply that Claude recognized a cryptocurrency mining process.
It is the sequence of reasoning that led to the discovery.
The assistant was given a development objective, examined the result of its own work and reportedly detected an inconsistency between expected and observed system behavior.
That discrepancy triggered further investigation.
For developers, the practical lesson is that testing software should include checking whether its results are plausible, not merely whether it compiles or runs.
For security teams, the incident illustrates how useful findings may emerge from ordinary operational telemetry rather than dedicated security alerts.
CPU utilization, process ancestry, startup configurations and network connections can all provide context when something behaves unexpectedly.
However, a successful AI-assisted investigation should not be confused with a comprehensive endpoint security capability.
A coding assistant can miss threats, misinterpret indicators or recommend destructive actions. It may also lack the visibility available to enterprise security tools.
The reported request for user permission before cleanup is therefore an important detail.
AI tools can support investigation while still operating within human-defined boundaries. That balance matters more than whether an assistant can automatically execute every available command.
The broader security lesson is that anomaly-driven investigation can uncover hidden threats, but reliable remediation still requires evidence, authorization and verification.
Research Evidence
- Initial public report: October 18, 2026.
- Reporting source: Reddit user UntilHEX.
- AI assistant: Anthropic Claude Code.
- Operating system: macOS.
- Original task: Build a temperature-monitoring application.
- Reported miner: XMRig.
- Reported CPU usage: Approximately 1,175%.
- Reported peak temperature: 112°C, unverified.
- Suspicious executable:
/tmp/rigupdater. - Reported mining destination:
pool.hashvault.sh. - Reported persistence: User LaunchAgent with encoded script and
KeepAlive. - Reported cleanup: AI-assisted removal, one manually removed file and a subsequent malware scan.
- Confirmed infection vector: Unknown.
- Confirmed credential theft: Not established.
- Independent forensic validation: Not publicly available.
Frequently Asked Questions
Did Claude Code really detect a crypto miner on a Mac?
A developer reported that Claude Code identified an XMRig mining process while checking abnormal temperature readings. The account includes a screenshot, but no independent forensic report has been published.
What caused Claude to discover the miner?
Claude was developing a temperature-monitoring application. When raw sensor readings appeared unusually high, it reportedly investigated CPU activity and identified the mining process.
What does 1,175% CPU usage mean on macOS?
When CPU utilization is reported per logical processor, 1,175% is equivalent to approximately 11.75 logical processors being fully utilized. It does not mean the computer exceeded its total available CPU capacity by 1,175%.
Is XMRig always malware?
No. XMRig is legitimate open-source mining software. It becomes a security concern when installed or operated without the device owner’s authorization.
Can a crypto miner damage a Mac?
Sustained mining can cause heavy resource consumption, heat, fan activity and performance degradation. However, the reported temperature reading in this incident does not establish that permanent hardware damage occurred.
How can a crypto miner restart after being stopped?
Unauthorized software may use startup mechanisms such as macOS LaunchAgents to relaunch after termination or login. A suspicious persistence component must be investigated separately from the visible mining process.
Can Claude Code replace antivirus software?
No. Claude Code may help inspect processes or interpret suspicious behavior when given appropriate access, but it is not a substitute for dedicated endpoint protection, incident response tools or forensic verification.
Final Takeaway
A routine Mac temperature-monitoring project became an unexpected security investigation when Claude Code reportedly identified an XMRig process using approximately 1,175% CPU.
The developer’s account suggests that the assistant helped uncover both the resource-intensive process and a suspicious startup mechanism.
However, the initial infection method, any potential credential exposure and the completeness of the cleanup remain unverified.
For Mac users, unexplained system load is worth investigating. For developers using AI coding assistants, the case demonstrates the value of validating system behavior while maintaining clear permission boundaries.
Finding a suspicious process is the beginning of an investigation, not proof that every related security risk has been eliminated.
If an AI coding assistant discovers a threat, should it also have permission to remove it?
Finding a suspicious process is one thing. Allowing an autonomous agent to change system configurations or delete files raises a different set of security risks.
Read: AI Agent Security — Why Visibility Alone Is Not Enough →
