Claude Code Spotted a Cryptominer on Mac While Building a Temperature App

While building a Mac sensor-monitoring app, a developer reported that Anthropic’s coding agent Claude Code identified an XMRig cryptominer running on the machine and consuming roughly 1175% CPU while temperatures reached about 112°C. macOS reports CPU use summed across cores, which explains the high percentage figure. The miner was reportedly configured to relaunch at startup via a login item dated August 29. Claude Code recommended a staged cleanup - stop the startup item, terminate the process, and move associated files to quarantine - asked for user approval before taking actions, and guided most steps; one file required manual deletion and a Malwarebytes scan was run afterward. There is no independent forensic confirmation of complete removal or how XMRig was installed.

This account is a single unverified user report with meaningful gaps, but it illustrates that a coding agent with access to local processes can connect abnormal thermal readings and sluggish behavior to a likely cause and provide useful remediation steps. The episode highlights the risks tied to agent permissions if actions are taken without user consent and reinforces basic hygiene: check Activity Monitor, Login Items and Extensions, and run a full scan with reputable endpoint security. An AI assistant can be a helpful early signal but does not replace dedicated security tools or forensic validation.