An unexpected discovery unfolded when an AI assistant, Claude, detected a hidden cryptocurrency miner on a developer’s Mac while creating a temperature monitoring application. The AI, noticing unusually high sensor readings, investigated the CPU activity and identified XMRig utilizing approximately 1,175% CPU, equating to about 12 cores of processing load.
Uncovering the Hidden Cryptominer
The developer, known as u/UntilHEX on Reddit, reported that Claude examined running processes after analyzing raw sensor data. This finding shed light on the Mac’s subpar performance. However, the information provided is based on a user report with a supporting screenshot rather than a detailed forensic analysis.
According to the screenshot, Claude noted the CPU temperature spiking at 112°C. The AI assistant alerted, “Your Mac is running a cryptominer that I didn’t put there.” These figures, drawn from the user’s session, have not been independently verified through hardware logs or another scrutiny.
LaunchAgent’s Role in Sustaining the Miner
Further investigation by Claude revealed a suspicious property list file within ~/Library/LaunchAgents/. The screenshot highlighted a randomly named startup entry dated August 29, which executed a significant encoded script via bash, with KeepAlive enabled. Claude reported that this entry had been present before it began its development work.
Apple’s LaunchAgent documentation specifies that user agents operate within a logged-in user’s session. The KeepAlive feature allows the job to continue running, making the startup entry crucial, as halting a process without disabling its launcher could enable it to restart. LaunchAgents themselves are legitimate macOS components, not definitive proof of malware.
Implications and Security Measures
The screenshot also raised concerns about the Mac’s accessible credentials, including GitHub logins, indicating possible exposure but not confirmed theft. Public evidence lacks confirmation of stolen passwords, access tokens, source codes, or other files. The infection route and overall impact remain uncertain.
Initially, Claude declared it hadn’t terminated or removed anything but sought permission to halt the startup item and miner, subsequently quarantining the files. UntilHEX later confirmed the assistant performed cleanup, though one file required manual deletion due to access issues.
This behavior mirrors techniques seen in other Mac threats, without proving a direct link. Cybersecurity reports have previously highlighted fake CAPTCHA attacks installing backdoors and XMRig, utilizing LaunchAgent and potentially combining mining with password theft. Removing a miner alone might not mitigate all risks.
For users, the key takeaway is to explore unexplained heat and persistent CPU load, review persistence mechanisms, and assess account exposure. Suspected compromises necessitate isolation and password changes from a secure device. While Claude’s discovery was beneficial, it doesn’t confirm the complete removal of all threats.
