As AI gets more powerful, Vibe Coding has become quite popular over the past two years. Even people without a professional programming background can use AI coding tools like Claude Code to build the small tools they want.
Recently, a Reddit user did just that: he asked Claude Code to help build a Mac temperature monitoring app. He originally just wanted to check how hot the CPU was getting, but before the app was even finished, Claude noticed something off while checking the sensor data. After tracing it down, it found a cryptocurrency mining program secretly running in the background. The program’s CPU usage was as high as 1,175%, and the temperature reached 112°C, which finally explained why his Mac had been running sluggishly for so long.
Using Claude Code to build a Mac temperature monitoring app unexpectedly uncovered a secret crypto-mining program! CPU usage hit 1,175%, and the temperature spiked to 112°C.
Reddit user UntilHEX recently shared on r/ClaudeAI that they asked Claude Code to help build a macOS temperature monitoring app. To check whether the temperatures the app read were accurate, Claude first dumped all the raw temperature sensor data for comparison, and found that the numbers were unreasonably high.
Claude caught a cryptominer on my Mac whilst building me a temperature monitor app
byu/UntilHEX inClaudeAI
Claude didn’t stop at the data being unreasonable; it kept investigating what was eating the CPU and eventually found a program named xmrig that had been continuously consuming a large amount of computing resources. In the screenshot posted by UntilHEX, you can see that Claude listed this as the most important item in its report and told him directly: “Your Mac is running a mining program, and I didn’t install it.” xmrig was using about 1,175% CPU, roughly equivalent to 12 cores, which is why the temperature got so high, with the CPU reaching a maximum of 112°C:
Claude also disclosed other details, including that the mining program was run from a temporary folder and connected to a mining pool named pool.hashvault.sh; the computer had a startup item dated August 29 whose name was a string of random gibberish, which concealed a large encoded script and was set to keep running continuously.
Finally, a reminder: malware runs under the user’s identity, so it can access anything you can access, including the GitHub login credentials on this Mac.
After reading all this, UntilHEX finally understood why the Mac had been running so slowly, and thought Claude was actually pretty impressive.
From beginning to end, he never asked Claude to scan for viruses or check whether the computer was infected. Instead, while developing tools and verifying test results, he noticed the data didn’t make sense, proactively investigated the cause, and only then uncovered a mining program that had been hidden for several weeks.
Afterward, he also had Claude perform the deletion. During the process, only one file ultimately had to be deleted manually because Claude ran into an access permission issue; overall, the cleanup was very effective. After cleaning, he also ran a Malwarebytes scan to confirm that the computer was clean.
xmrig is open-source Monero mining software. Monero can be mined with the CPU of an ordinary computer, so attackers often bundle it into malware and secretly use other people’s computers to mine:
As for how the mining program got onto the computer, UntilHEX isn’t sure either; he suspects it has something to do with a cracked audio plugin. Some users in the thread also pointed out that Apple’s built-in XProtect can already recognize XMRig, and Gatekeeper will also block unsigned apps, so it was more likely a modified version that the user manually allowed.
Source: KOCPC Chinese