Claude AI Discovers Hidden XMRig Miner on Developer's Mac
An AI assistant reportedly identified a cryptocurrency miner consuming significant CPU resources on a user's Mac while assisting with app development, highlighting AI's potential in threat detection.
An ordinary coding task took an unexpected turn when the AI assistant Claude Code reportedly discovered a hidden cryptocurrency miner operating on a developer's Mac. The AI was assisting the user, who posted on Reddit under the alias u/UntilHEX, in building a temperature monitoring application. During the development process, Claude flagged unusually high CPU activity and extreme temperature readings, prompting a deeper investigation into the system's processes.
The AI assistant identified the XMRig cryptocurrency miner as the culprit, consuming an alarming amount of processing power, reportedly around 1,175% CPU, which translates to approximately 12 full CPU cores. This discovery provided a plausible explanation for the Mac's sluggish performance. The developer shared a screenshot as evidence, detailing Claude's findings, though the incident remains a user-reported account rather than a formal forensic analysis.
According to the shared screenshot, Claude indicated that the Mac's CPU had peaked at a concerning 112°C. The AI's warning stated, "Your Mac is running a cryptominer that I didn’t put there." While these figures are specific to the reported session and have not been independently verified, the screenshot provided specific details about the miner's operation. It indicated the miner was running from /tmp/rigupdater and communicating with the mining pool pool.hashvault.sh.
XMRig itself is legitimate mining software, with official builds available for macOS, including support for Apple Silicon. The security concern arises from its apparent unauthorized use on the developer's machine. The presence of the software alone does not confirm a compromise without examining its installation, configuration, and persistence mechanisms.
Further investigation by Claude also uncovered a suspicious property list file within the user's ~/Library/LaunchAgents/ directory. This file, dated August 29, was configured as a randomly named startup entry designed to execute an encoded script via bash and utilized the KeepAlive feature. Claude noted that this entry predated its involvement in the development task. macOS LaunchAgents are legitimate system features that run within a user's session, and KeepAlive can ensure a process remains active, making this persistence mechanism critical for understanding how the miner maintained its presence.
While the screenshot raised concerns about potential exposure of sensitive information, such as GitHub credentials, there is no concrete evidence presented to confirm that any data, including passwords, access tokens, or source code, was actually stolen. The exact infection vector and the full extent of any compromise remain unknown.
Claude reportedly offered to assist with cleanup, requesting permission to stop the miner and its associated startup item, and to quarantine suspicious files. The developer confirmed that the AI performed some cleanup, although one file required manual deletion due to access restrictions. A subsequent scan with Malwarebytes was also performed. The observed persistence techniques, particularly the use of LaunchAgents, are reminiscent of other threats targeting macOS, though no direct link has been established in this case.
This incident underscores the importance of monitoring system performance for unexplained anomalies like high CPU usage and temperature spikes. Users should regularly review persistence mechanisms, such as LaunchAgents, and be vigilant about potential credential exposure. In cases of suspected compromise, isolating the affected system and changing passwords from a trusted device are crucial steps. While Claude's intervention was helpful, the full scope of the threat and the completeness of the cleanup are not definitively established.