A routine development task took an unexpected turn when Claude Code helped identify a cryptocurrency miner running on a developer’s Mac. The machine had been running unusually hot, and the investigation uncovered XMRig, a tool commonly used to mine cryptocurrency. The reported processor load reached about 1,175%, or roughly 12 logical cores, while temperature readings climbed to 112°C.
The process behind the heat
The miner reportedly appeared to be configured to start automatically, which meant the workload could return after a restart. Claude Code helped inspect the process and outline a cleanup path. The developer later reported that one file had to be removed manually after the agent ran into an access problem, followed by a scan with Malwarebytes.
The available account does not establish how the miner first reached the computer. It would be premature to blame a particular download, package or software supply chain without forensic evidence. High CPU use can signal malware, but it can also come from legitimate compilation, runaway applications or poorly behaved background services.
What Mac users should check
Users who see unexplained heat, fan activity or battery drain should inspect Activity Monitor, verify unfamiliar process paths and review login items and launch agents. Security software can provide a second opinion, while operating-system updates reduce exposure to known flaws. Developers should be especially careful when granting an AI coding agent permission to run shell commands or alter system files.
The episode is a useful demonstration of AI-assisted troubleshooting, not proof that an AI agent can guarantee a clean system. A credible response still depends on checking evidence, limiting privileges and confirming that suspicious persistence mechanisms have actually been removed.
How to interpret the warning
An unusually hot computer should be treated as a symptom to investigate, not as proof of a particular infection. Activity Monitor can show whether one process is consuming an abnormal share of processor time, but the process name alone is not enough to establish legitimacy. Users should examine the executable location, publisher where available, launch behavior and any related files. A familiar name can be misused, while a legitimate developer tool can temporarily create a heavy workload.
The reported 1,175% CPU figure uses a multi-core convention in which one fully occupied logical core is roughly 100%. It So describes a process using the equivalent of many cores, rather than a processor exceeding its physical capacity. The reported 112°C reading is striking, but readers should not treat one temperature number as a universal threshold for every Mac model or sensor. Hardware, sensor location, workload and measurement tools affect interpretation.
AI coding agents can make an investigation faster by summarising processes, proposing shell commands and explaining unfamiliar output. They can also make mistakes, overlook persistence or suggest actions with broad consequences. A useful workflow is to ask the agent to explain each proposed command, review destructive operations before running them, and independently verify the result. A second security scan is helpful, but it should complement, not replace, a review of startup items and suspicious files.
What a careful response looks like
If the machine remains hot after the apparent miner is removed, the investigation is not finished. Rebooting and checking whether the process returns can reveal persistence; reviewing login items and launch agents can identify automatic restarts. Users should also update macOS and applications, change credentials if there is evidence of broader compromise, and preserve relevant logs when the device is used for work. In a managed environment, involve the security team before deleting evidence.
The larger lesson is that AI-assisted diagnosis is most valuable when it makes a human investigation more systematic. It can help translate unfamiliar process output into understandable next steps, but it cannot guarantee that every malicious component has been found. Unexplained CPU spikes, persistent fan noise and sudden battery loss deserve attention, especially when they begin after installing software or running an unfamiliar script.
Readers should take a measured approach rather than assuming the same incident is happening on every hot Mac. Start with observable evidence, note when the behaviour began and change one thing at a time. If a suspicious process has administrator privileges or the machine contains sensitive work data, avoid experimenting with commands copied from an unfamiliar forum. Disconnecting from untrusted networks and seeking professional support may be appropriate when compromise appears likely. The key is to combine quick containment with verification: a computer that cools down is encouraging, but it is not by itself proof that every unwanted component has been removed.
One practical rule is to avoid granting an investigation tool more access than the task requires. Review proposed commands, keep a record of what was changed and verify the machine after a restart. If the device belongs to an employer, follow its incident-reporting process rather than silently cleaning it up, because other machines may share the same exposure. The combination of careful process inspection, limited permissions and independent verification is more reliable than relying on any single detection tool.