Ben Thompson: a persistent Claude Code agent flagged and helped remediate a real macOS exploit on his Mac
2026-10-05
Stratechery's Ben Thompson describes his always-on Mac Mini (running only Claude Code and Codex) being compromised via macOS vulnerability CVE-2026-65400, a since-patched screen-sharing flaw under active exploitation per a Dutch NCSC warning. Thompson's persistent Claude Code agent detected anomalous admin-level access during a scheduled restart, halted command execution, and flagged it as urgent; he then used Claude to identify the exact intrusion window, build a monitoring tool, and wipe the machine.
Significance 3: A concrete, named practitioner account of a persistent AI agent adding real security value is a useful adoption-outcomes data point for agentic tooling, though it is a single first-person anecdote rather than a systematic study.
Implications · machine-drafted, not owner judgment
A genuine positive data point for persistent agentic monitoring's practical value, relevant to tools that extend what a solo practitioner can produce — but it is an anecdote from one sophisticated user running a tightly scoped setup (a dedicated machine with nothing else installed), so it doesn't generalize to typical enterprise deployments without far more guardrail and monitoring infrastructure than most organizations currently have.
- Similar documented cases of agentic tools catching unrelated security incidents
- Whether Anthropic or OpenAI productize this kind of persistent-anomaly-detection behavior explicitly
Sources
- curator Apple and a Hacker's Future retrieved 2026-10-06