Looking at this more broadly, it is a vivid illustration of the expanding boundaries of AI agent capabilities.Author and source: AIBase
A Mac user who had been assisted by Claude in development recently learned a hard lesson from their own computer. The machine had been running slowly and overheating for a long time, but the user couldn’t pinpoint the cause—until they asked Claude to help build a temperature monitoring app to see what readings the sensors were reporting. Before the temperature tool was even fully tested, the AI immediately sensed something was off.
The protagonist of the story is Reddit user UntilHEX. His intention was simple: his computer was running slow, so he asked Claude to write a small temperature program that could read sensor data to identify the cause of the performance issue. The problem lay in the temperature readings—Claude noticed the values were alarmingly high, and instead of ignoring the anomaly, it followed the trail into system resource usage. It quickly flagged that the Mac was running an unauthorized cryptocurrency mining program.
Following the direction indicated by AI, the truth was startling: a process named XMRig was continuously consuming approximately 1,175% of CPU resources—in plain terms, that’s equivalent to fully utilizing about 12 CPU cores. The machine had been subjected to this strain for an unknown length of time, causing the processor temperature to spike to 112°C, nearing the system’s thermal limit—the very source of all the lag and overheating.
XMRig is itself a legitimate open-source Monero mining software, but it has a bad reputation: it is often embedded in malware by malicious actors to secretly hijack victims' computing power for mining and profit. On this computer, it runs hidden within a temporary directory, silently connecting to a mining pool called HashVault to send mined rewards outward.
Worse still, Claude discovered that this wasn’t just an ordinary background process—it persisted long-term by exploiting a disguised LaunchAgent entry. In other words, even if users manually terminated the mining process, it would automatically restart itself, like a tenant who refuses to leave, making it extremely stealthy.
Remarkably, Claude did not overstep its authority. It first thoroughly explained to the user how the malicious program operated and its potential risks, then requested authorization to disable the relevant startup items, terminate the mining processes, and move the suspicious files into an isolated directory—rather than permanently deleting them outright, leaving the final decision in human hands. Only after UntilHEX gave approval did the AI proceed with the cleanup. According to his later feedback, the entire process produced immediate results: the vast majority of cleanup tasks were assisted by the AI, with only a single file requiring manual intervention due to permission issues. He subsequently ran an additional scan with Malwarebytes to confirm the system had fully returned to normal.
This false alarm finally cleared up UntilHEX’s long-standing confusion: why his Mac had always felt so off. He suspected the infection likely originated from some pirated audio plugins. The security community has long concluded that many pirated audio production tools and plugins commonly bundle mining programs like XMRig—and since music production is inherently a high-CPU-load scenario, malicious code hidden within is harder to detect than usual.
Looking at this bigger picture, it’s a vivid illustration of the expanding boundaries of AI agent capabilities. A Claude that simply writes code and reads temperatures unexpectedly caught a hidden mining trojan deep within the system—restoring the user’s performance—by taking one extra step: autonomously checking system status. When AI moves beyond passively answering questions and begins proactively monitoring whether your machine is “unwell,” the way humans interact with their assistants quietly shifts forward another step.