Anthropic's Claude Code Spotted 1,175% CPU XMRig Miner on Mac via LaunchAgent

Anthropic’s Claude Code uncovered an active XMRig cryptocurrency miner on a Mac while assisting a developer with a temperature-monitoring application. The unauthorized software was consuming substantial processing power, which degraded system performance. This incident highlights how development tools can inadvertently reveal hidden malicious activity during routine debugging tasks, rather than through dedicated security scans.

How it unfolded

• User u/UntilHEX reported the incident on Reddit after noticing sluggish Mac performance.
• Claude Code investigated unusually high temperature sensor readings during application development.
• The assistant identified XMRig as the source of excessive CPU consumption and connected processes.
• Reports indicate the miner ran from a temporary directory and contacted pool.hashvault.sh.
• A LaunchAgent with KeepAlive settings ensured the process restarted after termination.

Who is affected

This specific incident involves a single Mac user who reported the findings via Reddit. The malware targeted the local machine’s processing resources for cryptocurrency mining without authorization. No broader campaign or specific vulnerability affecting all macOS users has been confirmed in this report. The impact was limited to the compromised system’s performance.

The fix

The user reportedly approved a cleanup action suggested by Claude Code after the assistant identified the malicious activity. No official patch or vendor update for the underlying infiltration method has been confirmed by Anthropic or Apple. Users relying on similar development assistants should verify system integrity independently. Manual removal of persistence mechanisms like LaunchAgents is often required to fully eliminate such threats.

What made it possible

Cryptojacking relies on deploying mining software without consent, often hiding within system processes. Attackers typically exploit weak access controls or social engineering to install persistent agents. These agents use system features like LaunchAgents to survive reboots and process termination. Teams usually monitor for unexpected high CPU usage and unauthorized network connections. Check whether development environments have isolated permissions to prevent lateral movement. Verify that automation tools cannot modify system-level configurations without explicit, logged approval.

What to do and how to stay safe: XMRig

• Monitor system performance metrics for sudden spikes in CPU usage that correlate with unknown processes.
• Review scheduled tasks and launch agents for scripts that restart processes automatically after termination.
• Isolate development environments from production systems to limit the scope of potential compromise.
• Verify network connections from development tools to ensure they only contact authorized repositories.

Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Claude Code remove the malware automatically?

The user reportedly approved a cleanup action after the assistant identified the activity, indicating manual confirmation was required.

How much CPU did the miner consume?

The process consumed approximately 1,175% CPU, which reflects utilization across nearly 12 processor cores on the Mac.

Is XMRig inherently malicious software?

XMRig is an open-source mining application; the security issue is cryptojacking, which involves deploying it without authorization.