Claude Code Detects Hidden XMRig Cryptominer Consuming 1175% CPU on Mac

A Mac user reported that Anthropic’s Claude Code found an unauthorized XMRig cryptocurrency miner while helping develop a temperature-monitoring application.

The mining process reportedly consumed approximately 1,175% CPU, equivalent to nearly 12 fully utilized processor cores, which explained the machine’s sluggish performance.

Claude Detects Hidden XMRig

The account, shared by Reddit user u/UntilHEX, describes an unexpected finding during routine development rather than a planned malware investigation.

Although the miner’s behavior has been covered, the incident remains a user-reported finding and has not undergone independent forensic verification.

According to the user’s account, Claude Code inspected raw temperature sensor readings to validate the application’s accuracy. When the readings appeared unusually high, the assistant investigated running processes and identified XMRig as the source of excessive CPU consumption.

The reported 1,175% CPU usage does not indicate that the processor exceeded its physical capacity. macOS process-level CPU accounting can aggregate utilization across multiple cores, with each fully occupied core contributing approximately 100%.

Therefore, a multithreaded process can legitimately show utilization well above 100%. This distinction matters because it indicates sustained parallel computation across much of the processor, not a measurement error or an impossible workload.

Reports indicate that the miner executed from a temporary directory and connected to the mining pool at pool.hashvault.sh.

A macOS LaunchAgent reportedly maintained persistence through an encoded script, allowing the mining process to execute automatically when the user logged in.

The LaunchAgent’s KeepAlive configuration would restart the process after termination, meaning that simply stopping the visible mining process would not necessarily eliminate the underlying persistence mechanism. The user reportedly approved a cleanup after Claude Code identified the activity.

XMRig itself is not inherently malicious; its official documentation describes it as an open-source, cross-platform CPU/GPU mining application with macOS binaries. The security issue is cryptojacking: deploying mining software on another person’s computer without authorization.

The available account does not clarify how the miner first infiltrated the Mac. Secondary reporting suggests that the user suspected cracked audio plugins, but no specific installer, verified delivery chain, or identified threat actor has been confirmed. Treating this suspicion as a confirmed infection vector overstates the evidence.

This case illustrates how troubleshooting during development can uncover suspicious resource consumption. However, it does not establish that Claude Code provides comprehensive malware detection or can replace dedicated endpoint security. Its reported discovery followed an observable performance anomaly during an unrelated coding task.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.