A Mac user who develops with Claude's assistance recently got a lesson from his own computer. The machine had long been running sluggishly and was absurdly hot, but he never found the root cause—until he asked Claude to help write a temperature monitoring app to see exactly what the sensors were reporting. Before the temperature tool had even warmed up, the AI had already caught a whiff of something wrong.
The protagonist of this story is Reddit user UntilHEX. His intention was simple: his computer kept lagging, so he figured he'd just have Claude write a little temperature program that could read sensor data and track down the cause of the performance anomaly. The problem showed up in the temperature data itself—as Claude read the readings, it found the values were obviously and absurdly high. It didn't let this anomaly slide, but followed the thread straight into system resource usage. It quickly issued an alert: this Mac was running an unauthorized cryptocurrency mining program.
Following the AI's lead, an investigation revealed a truth that was glaring. A process named XMRig was continuously consuming about 1175% of CPU resources—in plain terms, roughly filling up all 12 CPU cores at the same time. The machine had been put through this for who knows how long, with the processor temperature pushed all the way up to 112 degrees Celsius, right at the edge of the system's thermal limit. This was the root of all the lag and heat.
XMRig itself is a legitimate open-source Monero mining program, but it has a bad reputation: it is often smuggled into trojans by malicious actors, who covertly hijack victims' computing power to mine for profit. On this computer, it was running from a temporary directory, silently connecting to a mining pool named HashVault, sending the proceeds of that computing power outward.
What made things worse was that Claude then discovered this was no ordinary background process—it had long-term persistence via a disguised LaunchAgent startup item. In other words, even if the user manually killed the mining process, it would resurrect itself, like a tenant refusing to leave the system, and it was extremely well hidden.
Admirably, Claude did not overstep its authority. First it explained the malware's operating mechanism and potential risks to the user in full detail, and only then requested authorization: stop the relevant startup item, terminate the mining process, and move the suspicious files into a quarantine directory—rather than deleting them permanently, leaving the power of life and death to the human. Only after UntilHEX nodded did the AI take part in the cleanup. According to his afterward feedback, the whole process worked immediately, with the vast majority of the cleanup done with AI assistance, and only a single file getting stuck on permissions and requiring his manual handling. He then ran an additional scan with Malwarebytes, confirming the system had fully returned to normal.
This false alarm finally resolved UntilHEX's long-standing puzzlement: why his Mac had always been so off. He suspects the source of the infection was most likely certain cracked audio plugins. The security community has long had a consensus—a large number of pirated audio production tools and plugins come bundled with mining programs like XMRig, and since music production is itself a high CPU-load scenario, malware hiding in there is even harder to detect than usual.
Zooming out, this incident is a vivid footnote to the expanding boundaries of AI agent capabilities. A Claude that was dutifully writing code and reading temperatures, by taking one extra step of "autonomously checking system status," accidentally caught a mining trojan hidden deep in the device and helped the user get their performance back. When AI is no longer just a passive question-answering tool but starts actively keeping watch over whether your machine is "sick," the way people and their assistants get along quietly moves forward another notch.