An unexpected discovery has raised alarms over stealth crypto mining on Macs: a developer using an AI assistant uncovered a hidden miner while building a simple temperature monitoring app. In the process, the AI detected extreme CPU usage and other red flags pointing to malicious activity.
How the Miner Was Found
The incident came to light when a user known as UntilHEX shared a post revealing that their Mac was running extremely hot during development work. The AI assistant, Claude Code, had been analyzing raw sensor data from the machine, noticed the abnormal temperatures, and then checked active processes. That’s when it found XMRig maxing out CPU resources—about 1,175% usage, equivalent to roughly 12 CPU cores—alongside a system path indicating location in /tmp/rigupdater and a mining pool connected to pool.hashvault.sh. Physical logs or separate forensic verification were not provided.
The AI also identified a suspicious startup script in the user’s LaunchAgents folder. That randomly named plist file, dating back to late August, ran an encoded script through bash and had the KeepAlive flag enabled, meaning the miner could survive reboots and keep running automatically.
Security Implications & Risk Exposure
XMRig itself isn’t illegal or malware—it’s legitimate mining software whose builds include official macOS and even support for Apple Silicon. In this case, the issue is usage without the user’s knowledge or consent. Finding it on a machine doesn’t automatically mean full-blown compromise; for that, one would need to assess how it was installed, with what permissions, and any associated malicious behavior.
The hidden miner could expose more than just processing power. The AI raised concerns that credentials—including a GitHub login—might be accessible. There’s no public proof yet of stolen passwords, data, or broader breach, but the presence of a runner script in LaunchAgents and unknown file locations are typical persistence techniques used in other Mac-focused threats.
What Was Done—and What’s Still Unknown
When the AI exposed the irregularities, it asked for permission before stopping and quarantining the miner and related startup items. The user reports that cleanup was successful, though a file had to be deleted manually due to access restrictions. What remains unclear is how the miner got onto the Mac in the first place, whether the intrusion expanded beyond one device, and whether all traces were eradicated.
Like earlier attack campaigns, this case shows how adversaries leverage legitimate OS features—like LaunchAgents with KeepAlive—to maintain persistence, sometimes alongside password exfiltration or other malicious behavior. Users experiencing high system load, overheating, or sudden system sluggishness should examine their processes, startup agents, and consider resetting credentials from a clean device if they suspect compromise.
Even though this case started from a benign development task, it underscores a far louder warning: unsuspecting systems can harbor miners without obvious signs. It’s not just about the performance hit—it’s about control, exposure, and unseen damage. What to watch for next: whether similar reports emerge, how AI tools evolve in spotting stealth threats, and whether Apple or security vendors respond with patching or enhanced removal utilities.
