Claude tells Ben Thompson his Mac Mini is compromised

Ben Thompson's Mac Mini was flagged as compromised by Claude Code's persistent monitoring tool, which restarts every 30 minutes. During a restart, Claude detected a crypto miner installed on the Mac Mini. The compromise was traced to a port 5900 screen sharing vulnerability, allowing remote control of the device. Thompson uses this tool to track his work, and full details are available in his blogpost.

This report details how an AI tool detected a system compromise, unlike typical antivirus software that relies on signature-based detection.