Claude AI denies installing cryptominer on Mac

UntilHEX, a Reddit user, used Claude Code to build a Mac temperature monitor app. While checking the sensor's accuracy, the AI found a cryptominer using about 1,175% of the CPU, roughly 12 cores' worth. The software identified the process as xmrig, and the CPU temperature peaked at 112°C.

Discovering the cryptominer

Claude said the cryptominer was in a LaunchAgents folder that was there before it built anything. It offered to quarantine the software, but the user had to remove one component by hand because Claude did not have access to that part of macOS.

After the removal, a third-party security check confirmed the miner was gone, and the Mac's temperature returned to normal. Claude's comment that it had not installed the miner seems more likely to be a training artifact than a sign of rogue behavior, though it is unclear how the malware got onto the Mac.

The case is a reminder to watch system vitals when running AI tools. Macworld advises downloading software only from the Mac App Store or directly from developers, and never opening links in unexpected emails or texts.

The problem is unlikely to affect most users. Anyone running AI agents with broad access to their Mac may want to keep an eye on Activity Monitor and check what the agent is doing when they are away.