Claude Code detected xmrig secretly running on a developer’s Mac, using around 1175% CPU—or approximately 12 cores—causing the CPU temperature to spike to 112°C. This explains why the machine was running abnormally slowly.
After receiving permission, Claude was able to stop the startup item and miner and move the files to a quarantine folder. However, the user still had to delete one file manually because Claude ran into an access-permission issue.
When an Overheating Machine Led AI to the Cause
UntilHEX started building a Mac temperature-monitoring app after the machine’s performance deteriorated and the sensor readings appeared unusually high. They then provided the data to Claude Code for analysis.
Claude noticed that xmrig was consuming substantial system resources and warned that it was a crypto miner that had not been installed by the user. The cause of the overheating was uncovered through an investigation originally intended to solve the problem directly.
Where Claude Code Fits Into the Story
Claude Code acted as a coding agent that helped the developer build a Mac temperature-monitoring app and read sensor data to identify the cause of the abnormal heat.
The key strength in this case was its ability to connect the sensor data with a resource-intensive process, leading it to discover xmrig, a crypto miner that had not been installed by the user.
What the Claude Code Window Revealed
The Claude Code window directly warned that the Mac was running a crypto miner that it had not installed itself. It pointed to xmrig, which was using approximately 1175% CPU, or around 12 cores.
The sensor data also showed that the CPU had reached 112°C. Taken together, the evidence indicated that the machine was under sustained heavy load from a single process—not merely displaying an incorrect temperature reading.
From a Sluggish Machine to Discovering xmrig
UntilHEX’s Mac began behaving as though something was wrong, prompting them to develop a temperature-monitoring app to investigate. After reading the raw sensor data, they found that the temperature was unusually high.
Claude Code continued the investigation and identified xmrig as heavily using the CPU. It also suggested that the crypto miner was likely hidden among the programs launched automatically at startup. The window indicated that this item may have been added on August 29, giving the search for the root cause a clearer direction.
What Claude Code Could Do—and What Still Had to Be Done Manually
| Factor | Claude Code | User |
|---|---|---|
| Root-cause analysis | Identified xmrig's high CPU usage and explained the cause | Had to provide sensor readings for analysis |
| Stopping the process | Suggested stopping the startup item and miner | Had to approve the action |
| Quarantining files | Suggested moving the files to a quarantine folder | Had to verify the results |
| Deleting files | Ran into an access-permission issue | Deleted one file manually |
| Post-cleanup check | Did not run a Malwarebytes scan | Ran Malwarebytes to verify the system |
Claude Code helped trace the symptoms back to the root cause and suggested cleanup measures, but it could not handle every file-management task. The user therefore had to delete one file manually and run Malwarebytes to verify that the system was clean.
Pros
- +Detected xmrig from the machine's overheating and high CPU usage
- +Provided detailed resource-usage data, reaching approximately 1175% or around 12 cores
- +Explained that the miner ran at system startup and suggested stopping it and quarantining the files
Cons
- −Could not automatically handle all files successfully
- −Ran into an access-permission issue, requiring the user to delete one file manually
- −Required a follow-up Malwarebytes scan after cleanup
The Impact Beyond the Price Tag
The miner’s cost was not limited to electricity. It drew power from the Apple Silicon continuously, keeping the machine under heavy load and pushing the CPU temperature to 112°C. The most obvious result was that the Mac became so slow that its owner described it as “running like s**t.”
Another burden was dealing with the aftermath of discovering the problem. Claude Code was able to stop the startup item and quarantine the files, but the user still had to delete one file manually because of an access-permission issue. They then had to run a Malwarebytes scan to confirm that the cleanup was actually complete.
AI can connect symptoms such as overheating and slow performance with suspicious processes more quickly, but malware cleanup should not end with an agent’s commands.
This incident still required a second layer of verification through a Malwarebytes scan, making it clear that results should be checked every time—especially when file-access issues are involved.