A hacked Mac exposes the mismatch between app permissions and persistent agents

Ben Thompson says an attacker installed a cryptocurrency miner on the always-on Mac Mini he uses for Claude and Codex. His persistent Claude session noticed suspicious changes, stopped executing commands and alerted him. He subsequently investigated and wiped the machine. This is a first-person incident account, not a controlled demonstration that agents improve security overall.

His broader complaint concerns permissions. A headless computer is operated remotely, yet macOS often requires approval through protected graphical prompts. Agents generate new programs continually, so permission attached to each executable can repeatedly interrupt a workflow whose overall purpose the user already authorized. Thompson argues for controls that understand the delegated agent’s role.

Apple’s October 2 announcement approaches the problem from the opposite direction. Full Disk Access can expose files, messages, mail and browsing history, including other people’s communications. Apple promises additional controls requiring especially explicit user action, without yet specifying the complete implementation.

Synthesis: These goals can coexist. An agent needs usable, persistent delegation; a user needs boundaries it cannot silently expand. The design challenge is making authority understandable and revocable without turning every routine action into another prompt. Thompson’s account also illustrates why one successful detection cannot justify unrestricted access.