Claude Code AI agent detected and helped remove an xmrig crypto miner from a developer’s overheating Mac — marking the first public case of an AI coding assistant acting as real-time malware watchdog. The incident, shared by Redditor UntilHEX and reported by Tom’s Hardware, unfolded when the developer used Claude Code to debug unusually high temperature readings from their Apple Silicon Mac. The AI didn’t just parse sensor data, it identified the root cause: xmrig running at ~1175% CPU, consuming roughly 12 cores and pushing temperatures to 112°C. That’s not thermal throttling. That’s emergency-room heat. And it had been lurking since August 29, auto-launching at startup. Claude Code didn’t execute removal by default. It flagged the threat, explained how the miner hid itself, then asked permission: “Can I clean it up now?” It proposed stopping the startup item, halting the process, and quarantining files. Not deleting outright. The developer granted consent. One file required manual deletion due to macOS access restrictions, but otherwise, Claude handled the cleanup. A follow-up Malwarebytes scan confirmed success. This isn’t antivirus software repackaged as AI. Claude Code is a coding agent trained to write, explain, and reason about code, not scan for signatures or monitor processes. Its detection emerged from behavioral inference: abnormal CPU utilization patterns + thermal correlation + startup persistence analysis. No signature database. No heuristic engine. Just logic applied to live system telemetry. The episode points to a quiet shift: AI coding tools are evolving beyond autocomplete and documentation into active runtime collaborators. Capable of diagnosing environmental anomalies that humans miss, especially when those anomalies look like hardware failure. For developers in India and the US running local dev environments on Macs or Linux laptops, this raises a practical question: if your machine is suddenly sluggish or hot, should you open Claude Code before opening Activity Monitor? Availability remains unchanged: Claude Code is free to use via Anthropic’s web interface and official apps. No new version number, no paid tier unlock, no enterprise rollout tied to this event. But the precedent is set. Next step: watch for integrations. Will future versions of Claude Code offer optional, opt-in system health monitoring? Will Apple or Microsoft bake similar reasoning layers into Xcode or VS Code extensions? Until then, the lesson stands, sometimes the best security tool is the one already open in your browser tab, quietly reading your logs.