AI Tool Flags 1,175% CPU Load From Hidden XMRig Miner on Mac

An AI coding assistant named Claude Code reportedly identified a hidden cryptocurrency miner on a developer’s Mac while constructing a temperature monitoring application. The tool flagged unusual sensor readings that prompted an investigation into high CPU activity, leading to the discovery of unauthorized software running on the system.

According to a user report on Reddit, the AI assistant detected XMRig consuming approximately 1,175% of the CPU, which translates to roughly 12 cores of processing load. The developer, posting under the username u/UntilHEX, shared a screenshot showing the assistant’s analysis of raw sensor data. This activity explained the device’s poor performance, though the account remains a single user report rather than a verified forensic study.

Technical indicators

The screenshot indicated that the CPU temperature peaked at 112°C during the session. Claude Code explicitly warned the user that the Mac was running a cryptominer that the assistant had not installed. The tool identified the miner’s location as /tmp/rigupdater and noted it was sending data to the mining pool pool.hashvault.sh. These details offer specific leads for investigators examining this device, but they do not confirm how the software arrived or if other systems are compromised.

Persistence mechanisms

The AI also flagged a suspicious property list file located in the ~/Library/LaunchAgents/ directory. This entry, dated August 29, contained a randomly named startup item that executed a large encoded script through bash. The configuration included the KeepAlive setting, which instructs the system to keep the job running. Apple’s documentation notes that LaunchAgents are legitimate features, but the KeepAlive setting ensures the process restarts if stopped, complicating removal efforts.

Defender's checklist

Investigating this incident requires examining the specific files mentioned in the screenshot. Security teams should look for the /tmp/rigupdater path and the associated LaunchAgent entry. Because XMRig has official macOS builds, finding the binary alone does not prove malicious intent without reviewing its configuration and installation history. The report also raised concerns about exposed credentials, including GitHub logins, suggesting a broader review of stored secrets on the affected machine is necessary.

Operational impact

Organizations should ask whether development workflows allow AI tools to access system-level processes. Teams usually need to verify if coding assistants have permissions to inspect running tasks or hardware sensors. Managers must determine if such tools can detect unauthorized background processes during routine work. Security leads should communicate with engineering staff to clarify what data these assistants can see. Departments must decide if AI-driven diagnostics should be standard practice for performance issues.

What to do and how to stay safe: XMRig

• Review startup items and LaunchAgents for unknown scripts or encoded commands.
• Monitor CPU usage and temperature spikes that do not align with active workloads.
• Check for unauthorized mining software in temporary directories like /tmp.
• Audit stored credentials on machines where performance anomalies are detected.

Step-by-step guide: Implementing AI Usage Policies at Work: A Step-by-Step Framework

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific software did the AI tool identify?

The AI assistant identified XMRig, a cryptocurrency mining program, running on the Mac.

How did the AI tool discover the miner?

It investigated high CPU activity and abnormal sensor readings while building a temperature app.

Was the miner persistent?

Yes, a LaunchAgent with KeepAlive enabled was found to keep the miner running.