Claude Code Finds XMRig Miner Draining 12 Cores on Developer's Mac

Anthropic's Claude Code detected the XMRig cryptocurrency mining program running on a developer's Mac, according to aitimes.com. The miner was consuming about 1175% CPU, the equivalent of roughly 12 cores.

The developer, Reddit user UntilHEX, was building an app to monitor the machine's temperature on October 18 and asked Claude Code to analyse the sensor data because readings were higher than expected. The agent traced the load to XMRig and found that the miner had been registered as a startup item, estimated to have been added around August 29.

Claude Code did not stop the program or delete any files on its own. Instead, it proposed disabling the startup entry, stopping the mining process and moving the related files into a quarantine folder. The developer had to delete one file manually because of access permission issues and let the AI handle the rest.

A follow-up scan was run with Malwarebytes, but the specific results were not disclosed, so full removal is unconfirmed. It is also not known how the malware was installed on the Mac.

Limits of the cleanup

The case illustrates what an AI coding agent can do inside a session on a user's machine and where the process stops: it can identify a suspicious process and draft a remediation plan, but execution still depends on the user's consent, and confirmation of removal rests on separate security tools.