A Reddit post about a Mac temperature app drew thousands of upvotes this week. The poster said they asked Claude Code to build a Mac temperature monitor. When Claude dumped the raw sensor readings to check they were accurate, the numbers looked far too high, so it checked what was using the CPU and found a crypto miner, xmrig, running at about 1,175 percent CPU, roughly twelve cores. This post explains what the story shows, what it does not, and how to check your own Mac, with or without an AI agent.
Everything about the incident comes from the Reddit post and its comments, which we cannot verify. We did not run the commands below on a Mac in this environment, so test them yourself and treat them as a starting point.
TL;DR
| Question | Answer |
|---|---|
| What happened? | Claude Code, building a temperature monitor, noticed implausible readings, checked CPU use and found xmrig |
| How bad was it? | About 1,175% CPU (around 12 cores), per the post |
| Was it removed? | Mostly, per the user, who deleted one file manually and ran a malware scan afterward |
| Is it verified? | No. One anonymous account |
| Why does it matter? | It is a realistic example of cryptojacking and of an agent noticing a symptom while doing something else |
| What should you do? | Learn the read-only checks below and be careful about what an agent may delete |
What the Reddit post says
The user said their Mac had been "running like crap" and that Claude Code found the miner while building the monitor app. In comments, the user said Claude cleaned it up "pretty much," with one file deleted manually because Claude had an access issue, and that they ran Malwarebytes to be sure. Asked how it got there, the user guessed pirated audio plugins.
Other comments questioned the details. One person said a 112 degree Celsius peak suggested a thermal paste problem, and the poster replied about a CPU model that does not appear in Macs, which suggests that comment referred to a different computer. Another commenter wrote that many more people probably carry miners and similar malware than we think. These are opinions, not evidence.
So the safe reading is: a plausible, common kind of infection, discovered by an agent that was already looking at system data for another reason.
Why would a temperature app reveal a miner?
The logic is simple and worth noticing. A temperature monitor reads sensors and, to verify them, compares readings against load. If temperatures and fan speeds are high while the machine is idle, something is using the CPU. A careful agent, or person, asks the next question: what process is using it? On macOS that means looking at the process list sorted by CPU.
That is the same reasoning a human would use. The agent's value here was persistence and willingness to investigate an anomaly it was not asked about, which is also the behavior that can go wrong if it then starts deleting things unprompted. More on that below.
What is xmrig, and why is it on Macs?
XMRig is open-source software that mines Monero using the CPU. The program is legitimate. Attackers bundle or drop it onto other people's computers so the victim pays for electricity and suffers heat, noise and wear while the attacker collects the coins. This is called cryptojacking.
Common ways a miner arrives on a Mac:
- Cracked or pirated software, including plugins, games and apps, which often ship with extra payloads.
- Fake installers and counterfeit apps that imitate real products. See our post on a fake Claude app delivering crypto malware.
- Malicious downloads and browser extensions.
- Compromised developer tools or packages.
Miners usually try to persist across restarts, so they install a launch agent, a login item or a scheduled job.
How to check a Mac for a cryptominer
These are read-only checks. They list information and change nothing.
1. Look at CPU use
Open Activity Monitor, choose the CPU tab and sort by % CPU. A process using hundreds of percent while you are idle is suspicious. In Terminal:
ps -Aceo pid,pcpu,comm -r | head -15
On macOS, -r sorts by CPU, and the output lists process ID, CPU percentage and name. Note any name you do not recognize. Miners often use disguised names, so a normal-looking name is not proof, and an unusual one is not proof either.
2. Check startup items
Open System Settings, then General, then Login Items and review what is allowed to run in the background. Then list the launch folders:
ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons
launchctl list | grep -v com.apple
crontab -l
Look for entries you do not recognize, recently created files, or names that imitate Apple or well-known apps.
3. Inspect network connections
lsof -i -P -n | grep ESTABLISHED
Look for unfamiliar processes holding long-lived outbound connections. Miners connect to mining pools, and a process that is both heavy on CPU and constantly connected to an unknown remote address deserves attention.
4. Identify before you delete
For any suspicious process, find where it lives before you touch it:
ps -p PID -o pid,ppid,command
Replace PID with the process ID. The full path and the parent process help you work out how it started.
5. Scan and verify
Run a reputable malware scanner, and compare what you found against known indicators from trustworthy sources. The Reddit user ran Malwarebytes afterward, which is a sensible second check.
If you find one
- Do not just kill the process. If a launch agent restarts it, it will return. Find the persistence mechanism first.
- Note paths and names so you can report them and confirm removal.
- Disconnect from the network if you suspect more than a miner, such as a remote access tool.
- Remove the launch agent and the files, then restart and confirm CPU use is normal.
- Think about what else was exposed. A miner proves something ran code on your machine. Change important passwords from a different, clean device and review your accounts for suspicious activity.
- Consider a clean reinstall if you cannot establish how it got in or you handle sensitive data.
- Fix the entry point. If it came from pirated software, stop using it.
Using an AI agent for this, safely
The story suggests a use for coding agents, but it also shows why guardrails matter. An agent with shell access can do all of the above quickly. It can also delete the wrong file, kill a legitimate process or erase evidence.
A sensible approach:
- Ask for investigation only. Say: "Check what is using my CPU and list startup items. Do not delete or change anything."
- Review the findings yourself, and ask the agent to explain why each item is suspicious.
- Approve each destructive step individually, with the exact command shown first.
- Keep permissions tight. Use permission modes that require confirmation for risky commands. See our guide to Claude Code permission modes and our sandbox guide after an rm -rf incident.
- Do not paste commands from unknown sources. Malware instructions sometimes arrive disguised as helpful fixes.
- Back up first if the machine matters to you.
Microsoft's security chief recently argued that agents should themselves be treated as insiders and contained outside the model. We summarize that in our post on securing the agentic insider. The same principle applies at a personal scale: an agent that can find malware can also cause damage, so limit what it may do without asking.
What this story does and does not show
It shows that a miner can hide for a long time behind a vague symptom such as a slow, hot Mac, and that an agent investigating an anomaly can surface it.
It does not show that Claude is a replacement for security software. This was an incidental catch, reported by one anonymous user, with no logs. It also does not show how often it works. Plenty of infections would not be noticed by an agent building a different app.
It also should not make you complacent about macOS. As one commenter noted, macOS does not warn you when a background process uses your whole CPU, and a miner is quiet by design.
Prevention checklist
- Avoid cracked software, and download apps only from developers you trust.
- Keep macOS and apps updated.
- Review Login Items and background items occasionally.
- Watch for persistent heat, fan noise and slow performance.
- Use a reputable endpoint security tool.
- Be careful with developer tools, packages and browser extensions.
- Use a standard user account for daily work, not an administrator account.
Bottom line
An anonymous Reddit post says Claude Code found an xmrig miner on a Mac while checking temperature readings. We cannot verify it, but the scenario is realistic and the lesson is practical: a hot, noisy, slow computer is a symptom worth chasing, and the investigation is simple enough to do yourself. If you let an AI agent help, keep it read-only until you have seen what it found.
Related reading
- Nadella: assume AI models are compromised
- Securing the agentic insider: Microsoft Project Perception
- Fake Claude app delivers crypto malware
- macOS Codex malware warning and false positive
- Claude Code permission modes explained
- Claude Code rm -rf incident and sandbox guide
- Claude Security: scan and fix, public beta
The incident details come from a Reddit post and its comments as of October 20, 2026, and are unverified. Commands are standard macOS tools but were not run by us on a Mac. Test them yourself and back up before changing anything.