Claude was building a temperature app. It found a cryptominer secretly running on the user's Mac

A user who asked Claude to build a Mac temperature monitor learned the machine was running hot because of someone else's cryptominer.

A screenshot of the exchange, first posted to Reddit's r/claude, spread on X on Oct 19, where one repost passed 350,000 views and 6,500 likes. 'Your Mac is running a cryptominer that I didn't put there,' Claude wrote.

According to the screenshot, Claude spotted xmrig using about 1,175% CPU, roughly 12 cores, with temperatures peaking at 112°C. The miner ran from /tmp/rigupdater, mined to pool.hashvault.sh and was kept alive by a randomly named LaunchAgent dated Aug 29, well before the app existed.

Claude said it had not killed or removed anything yet and warned the malware could reach everything the user could, including their GitHub login. 'As inference gets cheaper we will have persistent agents constantly scanning everything,' one reply (385 likes) said.