[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-claude-code-spots-hidden-crypto-miner-eating-12-mac-cores":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},11794,"claude-code-spots-hidden-crypto-miner-eating-12-mac-cores","Claude Code Spots Hidden Crypto Miner Eating 12 Mac Cores","A Mac temperature app project ended with Claude Code flagging a miner pushing the CPU to 112 degrees Celsius, and offering to remove it.","A coding agent helping a developer build a Mac temperature monitor found a hidden crypto miner on the machine, then asked permission before touching it.\n\nThe developer, who posts on Reddit as UntilHEX, described the episode in a post. They were building the app to find out why the Mac had been running so badly, and a dump of raw sensor readings looked too high to them. Claude Code reported the CPU peaking at 112 degrees Celsius under sustained load. It traced the heat to xmrig, a widely used open-source mining program, using about 1175% CPU, or roughly 12 cores' worth. The post does not say how many cores the Mac has. \"Your Mac is running a crypto miner that I didn't put there,\" the agent said.\n\nA screenshot suggests the miner was added to the startup list on August 29. Claude described how the software hid itself and launched at boot, but it removed nothing on its own. It asked, \"Can I clean it up now?\" and proposed stopping the startup item and the miner, then moving the files into a quarantine folder.\n\nUntilHEX agreed. They said they had to delete one file by hand because Claude hit an access issue, but called the cleanup \"very effective\". A Malwarebytes scan followed to check the work. The coverage of the post does not give that scan's result.\n\nThe miner gave itself away through appetite. Any tool that reads the process list would have shown the same 1175% figure, and Activity Monitor, the Mac's built-in process viewer, was there all along. What the agent added was position: it was already reading system data for an unrelated task and was willing to speak up about something outside it. The ask-first step is the better design choice, since an agent with shell access that deletes files unprompted creates its own risk.\n\nThis is one unverified anecdote, and the post does not say how the miner arrived. It also leaves a question: a miner that capped itself at a fraction of one core would likely have caused no alarming temperatures, and no monitor app to go looking.","[\"claude-code\",\"cryptomining\",\"malware\",\"mac\"]","2026-10-19T11:36:20.000Z","2026-10-19T11:57:21.634Z","2026-10-19T11:57:21.964Z","published",null,[],"security",[26,27,28,29],"claude-code","cryptomining","malware","mac",[31],{"name":32,"url":33},"Tom's Hardware","https:\u002F\u002Fwww.tomshardware.com\u002Ftech-industry\u002Fcryptomining\u002Fclaude-code-ai-agent-caught-a-crypto-miner-hiding-on-a-developers-overheating-mac-xmrig-task-was-hogging-about-1175-percent-cpu-roughly-12-cores-pushing-temps-to-112-degrees",0,{"sections":36},[37,42,46,51,56,61,66,71,76,81,86,91,96,101],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",7040,"2026-10-18T11:00:00.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",1011,"2026-10-19T17:00:00.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",542,"2026-10-19T07:43:19.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",531,"2026-10-19T17:21:45.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",268,"2026-10-19T15:49:37.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",242,"2026-10-19T18:10:55.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",205,"2026-10-19T10:00:00.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Startups","startups",134,"2026-10-18T12:02:57.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",130,"2026-10-19T17:26:40.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",118,"2026-10-16T15:52:39.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"General","general",86,"2026-10-19T15:44:20.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",78,"2026-10-19T12:01:04.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",37,"2026-10-14T10:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]