A developer investigating unusually high temperature readings on their Mac stumbled upon an unexpected culprit: a cryptocurrency miner quietly eating up the machine’s processing power. The discovery came while using Anthropic’s Claude Code to work on a temperature-monitoring app, with the AI assistant helping to trace the problem to an unauthorised XMRig process running in the background.
The incident was shared by Reddit user UntilHEX, who said Claude Code identified a process called XMRig using approximately 1,175% CPU, equivalent to nearly 12 fully occupied CPU cores. The miner was also pushing the computer’s reported temperature to 112°C, explaining why the machine had been running unusually slowly.
Claude Code Discovered The Hidden Miner
According to the developer’s Reddit post, they were building a temperature-monitoring app and asked Claude Code to check raw sensor readings to ensure they were accurate. When the readings appeared unusually high, the AI coding assistant investigated the processes running on the Mac and found XMRig, an open-source cryptocurrency mining application, consuming an excessive amount of CPU resources.
The developer’s account also indicated that the miner had been configured to launch automatically when the Mac started up. This would allow it to continue running in the background and potentially restart even after the active process was terminated.
After identifying the suspicious process, Claude Code reportedly offered to stop the miner, disable its startup mechanism and move the associated files into quarantine. The assistant sought the developer’s permission before proceeding with the cleanup.
The developer later confirmed in the Reddit thread that Claude Code was able to handle most of the removal process, although one file had to be deleted manually because of an access-permission issue. They also ran a Malwarebytes scan afterwards to check for any remaining threats.
How To Spot And Deal With Hidden Cryptominers
This incident is a reminder that cryptominers can quietly consume a computer’s resources without the owner realising what is happening. Since the attacker benefits from using someone else’s hardware, the software may be designed to run in the background and persist across restarts.
Common warning signs include a computer that suddenly becomes sluggish, unusually high CPU or GPU utilisation while idle, fans running constantly, excessive heat and battery life that deteriorates without an obvious explanation. Higher electricity consumption may also be a concern for desktop systems that remain under heavy load.
To reduce the risk of infection, download applications from official websites or trusted app stores, keep the operating system and security software updated, and avoid pirated software or unfamiliar installers. Run a reputable security scan, quarantine or remove confirmed threats, and check for persistence mechanisms that could restart the malware after a reboot. Simply ending a suspicious process may not be enough if another component launches it again.
Ultimately, having an AI assistant investigate a suspicious process can be convenient, but it is not a prerequisite for protecting your computer. Keeping software updated, downloading programs from trusted sources, monitoring unusual system behaviour and using reputable security tools are practical steps anyone can take without relying on an AI assistant.
(Source: Reddit, via Tom’s Hardware)
