An ordinary coding task led to an unexpected security discovery when Claude Code reportedly found a hidden cryptocurrency miner on a developer’s Mac. The AI assistant was building a temperature monitoring app when unusually high sensor readings prompted it to investigate CPU activity. It identified XMRig consuming about 1,175% CPU, described as roughly 12 cores of processing load.

The developer, posting as u/UntilHEX on Reddit, said Claude checked running processes after reviewing raw sensor data. The discovery offered an explanation for the Mac’s poor performance. However, the account remains a user report supported by a screenshot, rather than a published forensic investigation.

High CPU Usage Exposed the Hidden Miner

According to the shared screenshot, Claude reported that the CPU had peaked at 112°C. “Your Mac is running a cryptominer that I didn’t put there,” the assistant warned. Those figures reflect the reported session and have not been independently verified through hardware logs or a separate examination.

The screenshot identified /tmp/rigupdater as the miner’s running location and pool.hashvault.sh as its mining pool destination. These details provide useful leads for investigators examining this specific device. They do not establish how the software arrived, who installed it, or whether other systems were affected.

XMRig is not inherently malicious. It is mining software with official macOS builds, including support for Apple Silicon. The security concern is its apparent use without the owner’s knowledge or consent. Finding the program alone would not prove an infection without examining its installation, configuration, and activity.

LaunchAgent Reportedly Kept the Miner Running

Claude also flagged a suspicious property list file inside ~/Library/LaunchAgents/. The screenshot described a randomly named startup entry dated August 29 that ran a large encoded script through bash, with KeepAlive enabled. Claude said the entry was already present before its development work began.

Apple’s LaunchAgent documentation explains that user agents run within a logged-in user’s session. The KeepAlive setting can tell launchd to keep a job running. That makes the startup entry important because stopping a process without disabling its launcher may allow it to return. LaunchAgents themselves are legitimate macOS features, not automatic proof of malware.

The screenshot also raised concern about credentials available on the Mac, including its GitHub login. That warning describes possible exposure, not confirmed theft. The public evidence does not show that passwords, access tokens, source code, or other files were stolen. The infection route and full scope remain unknown.

Claude initially said it had not killed or removed anything. Instead, it requested permission to stop the startup item and miner, then move files into quarantine. UntilHEX later said the assistant performed cleanup, although one file required manual deletion because of an access issue. A Malwarebytes scan followed, according to Tom’s Hardware.

The behavior resembles techniques seen in other Mac threats, without proving a connection. Cyber Security News previously covered fake CAPTCHA attacks that install a backdoor and XMRig. That campaign used a LaunchAgent and could combine mining with password theft, showing why removing a miner alone may leave risks behind.

Separate reporting on CrashStealer’s abuse of Apple crash-reporting branding also documented LaunchAgent persistence. Neither campaign has been linked to UntilHEX’s Mac. Their relevance is the shared use of trusted operating system features to keep unwanted software running.

For affected users, the practical lesson is to investigate unexplained heat and sustained CPU load, review persistence, and check account exposure. Suspected compromise warrants isolation and password changes from a clean device. Claude’s discovery was useful, but the reported cleanup does not establish that every threat was removed.

The post Claude AI Detects Hidden Crypto Miner While Building Temperature Monitor App on Mac appeared first on Cyber Security News.