A Reddit user said a routine attempt to build a Mac temperature monitoring tool with Claude Code ended with the discovery of a hidden XMRig cryptocurrency miner on the machine. The user, UntilHEX, said the Mac had become increasingly slow and frequently overheated, with CPU usage at one point reaching 1175% and peak temperature climbing to 112°C.
According to the account shared on Reddit, UntilHEX was using Claude Code to develop the monitoring app and verify whether the sensor readings collected by the software were accurate. While checking the raw temperature data, the user noticed readings that looked far outside the normal range. That led to a closer look at system resource usage, where Claude Code identified a process named XMRig.
Abnormal temperature readings led to the process
The discovery did not come from a dedicated malware scan. It emerged during application development. UntilHEX said the original goal was simply to understand why the Mac had been running poorly and overheating so often.
As the investigation moved from sensor data to system activity, Claude Code flagged XMRig as the source of the heavy load. Based on the analysis described by the user, the process was consuming about 1175% of CPU resources, roughly equivalent to around 12 CPU cores running at full capacity. The CPU temperature peaked at 112°C.
UntilHEX said the program was not something intentionally installed for development or testing. Claude Code explicitly told the user, 「Your Mac is running a cryptocurrency mining program, and I did not install it.」
That finding gave a direct explanation for the Mac's long-running performance issues. A tool meant to monitor temperature ended up exposing what may have been the real reason the machine had been slowing down for a long time.
Startup data suggested the miner may have been there for some time
Claude Code's follow-up analysis, as described by UntilHEX, indicated that the mining program may have been added to the system's startup items as early as Aug. 29. If that timestamp is accurate, the software could have been running in the background for quite a while.
XMRig itself is open-source cryptocurrency mining software that uses computing resources such as CPU power for mining. It is not inherently malware. But if it is installed and run on someone else's device without the owner's knowledge or consent, it becomes a tool for unauthorized use of computing resources.
How the program got onto the Mac remains unclear. In Reddit comments, UntilHEX said the issue may have been related to a cracked audio plugin.
Claude Code asked for permission before cleanup
After identifying the process, Claude Code did not immediately terminate it or delete files. UntilHEX said it first explained what had been found and asked whether it could proceed with cleanup.
The steps proposed by Claude Code included:
- stopping the mining process,
- disabling the related startup item,
- and moving associated files into quarantine.
Only after receiving permission did it begin the cleanup. In a later comment, UntilHEX said most of the work was completed without major issues, although one file still had to be removed manually because of permission restrictions.
Afterward, the user ran Malwarebytes on the Mac to check whether any malicious files remained.
Reddit discussion widened to malware risks on macOS
The post drew a wave of comments. Some users joked about Claude Code quickly distancing itself from the miner, saying that a line like 「I didn't put it there」 was not exactly reassuring.
Others said they were surprised that a Mac could be infected at all. One commenter replied that the lower visibility of malware on Macs in earlier years did not necessarily mean macOS had uniquely strong built-in protection. The commenter argued that the platform's smaller market share had simply made it a less common target. As Mac adoption grows, that may change.
Another commenter raised concerns about the broader scale of infections involving malware, RATs, mining software, and other unwanted programs. The point was that many users may dismiss symptoms such as sluggish performance, louder fans, or excess heat as signs of aging hardware or heavy software load, rather than suspecting a hidden process consuming resources in the background.
Some comments also said macOS does not appear to have a built-in mechanism dedicated to flagging this kind of issue in a way that clearly alerts users when system resources are being continuously occupied by suspicious software. In that discussion, some users compared the situation with antivirus and anti-malware tools on Windows.
By UntilHEX's own account, this was not a case of Claude Code launching a formal security scan. It was a development workflow that happened to expose a hidden mining program. For the user, a simple effort to write a temperature monitor turned into an unexpected malware discovery.
