Claude AI agent detects and removes crypto miner from developer's Mac
While helping build a temperature monitoring application, Anthropic's Claude Code identified and eliminated hidden cryptomining malware consuming excessive CPU resources on a developer's system.
A developer working on a Mac temperature monitor application received an unexpected assist from Claude Code when the AI agent flagged suspicious activity on the system. The coding assistant alerted the developer, known on Reddit as UntilHEX, to the presence of unauthorized software consuming computational resources. "Your Mac is running a crypto miner that I didn't put there," the agent reported, identifying the malware as xmrig and noting it was consuming roughly 1175% CPU across approximately 12 cores. The discovery proved timely, as UntilHEX acknowledged the infection "explains why my Mac has been running like s**t."
Claude caught a cryptominer on my Mac whilst building me a temperature monitor app
UntilHEX, Reddit
The very behavior that made the cryptomining operation effective—its relentless consumption of processing power—ultimately led to its detection. Evidence suggests the malware was added to the Mac's startup sequence on August 29. UntilHEX appears to have initiated the temperature monitoring project specifically to investigate why the machine was running so hot, inadvertently creating the conditions for the threat's discovery.
Claude's intervention began when UntilHEX grew concerned about unusually elevated readings from the Mac's temperature sensors. The AI agent analyzed the data and identified the root cause: CPU temperatures reaching 112 degrees Celsius, driven by the sustained heavy computational load from xmrig consuming roughly 1175% CPU across approximately 12 cores. The agent explained how the cryptomining software had concealed itself within the system and configured itself to launch automatically at startup.
Rather than taking unilateral action, Claude Code sought permission before proceeding with remediation. The agent proposed a measured approach: "Can I clean it up now? I'd stop the startup item and the miner, and move the files into a quarantine folder." This cautious stance reflected the AI's awareness of the potential risks involved in modifying system files without explicit authorization.
UntilHEX authorized the cleanup, and Claude executed the removal process. According to the developer's account, the operation proved largely successful, though one manual intervention was required. "I only had to delete 1 file manually because Claude had an access issue, but it was very effective," UntilHEX reported. Following the AI-assisted removal, the developer ran a Malwarebytes scan to verify the cryptominer had been completely eliminated from the system.