Image: Anthropic

A Reddit user asked Claude Code to build a simple temperature monitor for his Mac. Along the way, Anthropic's coding agent found the real reason the machine was running so hot: a hidden cryptocurrency miner he says he never installed.

The user, u/UntilHEX, posted the story on the r/claude subreddit, where it passed 1,000 upvotes, and AI commentator Chubby (@kimmonismus) shared it on X. According to the post, Claude dumped the raw sensor readings to check they were accurate, saw numbers that looked far too high, and then checked what was using the processor.

Claude caught a cryptominer whilst building a temperature app.

“Mac is running a cryptominer that didn’t put there.” pic.twitter.com/Oi5W6AMcXn

— Chubby♨️ (@kimmonismus) October 19, 2026

The culprit was XMRig, running at about 1,175% CPU. macOS counts each processor core as 100%, so that's close to 12 cores working flat out. A screenshot of Claude's report shows the miner running from a temporary folder and sending its work to a mining pool. It also restarted itself automatically through a randomly named startup file dated late August, well before the app project began.

Image: u/UntilHEX via Reddit

Just as telling is what Claude didn't do. "I haven't killed or removed anything," it wrote, then asked permission to stop the startup item and the miner and move the files into a quarantine folder rather than delete them. It also warned that malware running on the account "can reach everything you can, including the GitHub login on this Mac."

That's the right instinct for an agent with access to your files. Deleting things unprompted could remove the wrong item or destroy clues about how the infection started.

The user says Claude handled almost all of the cleanup. He removed one file by hand after an access issue and ran a Malwarebytes scan to be sure. As for the source, he wrote that it's "definitely because of cracked audio plugins."

That fits a long pattern. XMRig is a legitimate open-source miner, but criminals love it. Palo Alto Networks' Unit 42 says attackers favor Monero, the coin XMRig mines, because transactions are hidden and mining works well on ordinary CPUs.

In 2019, ESET found LoudMiner, an XMRig-based miner hidden in 95 pirated Mac audio apps and plugins, including Ableton Live and AutoTune. ESET noted that music producers own powerful machines and expect heavy CPU use, which makes perfect cover. Jamf Threat Labs later found pirated Final Cut Pro copies whose miner shut itself down within seconds of Activity Monitor opening.

Macs do have built-in defenses. Apple says XProtect blocks and removes known malware, while Gatekeeper checks that downloaded apps come from identified developers. But XProtect relies on signatures for threats Apple already knows, and users can choose to override Gatekeeper, which cracked software often asks them to do.

How to check your own Mac

• Open Activity Monitor and sort by % CPU. Search any unfamiliar process near the top while the Mac is idle. A Mac that runs hot, loud or slow with nothing open is a warning sign, even if Activity Monitor looks clean.
• Look in System Settings > General > Login Items & Extensions for background items you don't recognize.
• In Finder, use Go > Go to Folder to check ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons. Random-looking file names deserve a closer look. Objective-See's free KnockKnock lists everything set to launch automatically.
• Run a reputable malware scanner.
• If you find something, change passwords and revoke saved logins and tokens, including GitHub, from a clean device.
• Skip cracked apps and plugins entirely.

For now, this is one person's account. We couldn't independently confirm the infection or how it got there, and the screenshot shows only part of the conversation.