A developer asked Claude Code to check a Mac that overheated and experienced noticeable slowdowns during ordinary use.

During the diagnostics the AI agent detected a concealed XMRig process actively mining Monero on the machine.

Discovery and impact

According to the user, the miner consumed almost all capacity of the processor and loaded about 12 cores, causing high temperatures.

System sensors reported temperatures reaching 112 °C, leading to thermal throttling and sustained performance degradation under normal workloads.

Removal and follow-up

The agent assisted in terminating the mining process and removed its persistence mechanisms from system startup configurations.

No indicators of the initial infection vector were reported, and the user did not specify how the miner appeared on the device.

Implications for users

The case highlights how automated code assistants can aid local troubleshooting by inspecting running processes and suggesting remediation steps.

Users should verify startup items and monitor CPU and temperature metrics when unexplained slowdowns or excessive thermal readings occur.

The discovery was reported by the device owner, who supplied telemetry and a description of the actions taken with Claude Code's assistance.