My MacBook was quietly sending data to a server every night.
Then Claude Code helped me spot what could have been a $6,800 crypto loss.
It started with something small.
My fan kept spinning at night. The lid was closed, and I wasn't running anything.
So I asked Claude Code one question:
"What is this Mac doing when I'm not using it?"
Six minutes later, it flagged something suspicious.
A browser extension appeared to be sending open-tab URLs and session cookies to a recently registered domain.
Here's what made it concerning:
→ The extension was a "free PDF converter" with 4.8 stars.
→ The domain had been registered just 11 days before installation.
→ The server was hosted on a cheap rental plan.
→ The extension appeared to send data every night at 3:12 AM.
→ The exposed session data potentially included access to my crypto exchange.
No password needed. A stolen session cookie can let an attacker bypass the usual login flow, sometimes without triggering another 2FA prompt.
Claude Code's first recommendation was to revoke active sessions from my phone.
I did.
18 minutes later, an exchange login alert reportedly came from a city I'd never visited.
The session had already been revoked.
$6,800 in USDC was potentially at risk.
The money was still there.
The scary part? The legitimate PDF tool had millions of users. The extension I'd installed was a copy with a different publisher name and just nine reviews.
I'd found it through an ad.
Here's what I'd do differently:
→ Install browser extensions through trusted official sources.
→ Verify the publisher, not just the star rating.
→ Review extension permissions before installing.
→ Revoke suspicious sessions immediately and rotate credentials if needed.
→ Keep significant crypto holdings in a hardware wallet.
→ Run regular, read-only security audits of your Mac.
That last step is now part of my routine.
Every Sunday, Claude Code checks what's running, what is making network connections, and which apps and extensions deserve a closer look.
It reports suspicious activity and asks before making changes.
The real lesson isn't that AI replaces security tools. It's that an AI coding agent can help you investigate activity you might otherwise overlook.
One caveat: a suspicious connection is evidence to investigate, not proof of malware. Audit findings need to be verified before drawing conclusions.
I've shared the prompts for auditing both Mac and Windows systems below.
Bookmark this. Your laptop might be doing more than you think.
WHAT THE FK** Most people still ask Claude “does this strategy still work?”
It answers from memory. I forced it to answer from data. I built a 4-agent stack that only keeps strategies after they survive post-publication decay. 87 days. $5,000 → $128,400. Average trade $214. Win rate 61%. Max DD 11.3%. Zero strategies that were famous in 2015–2019 survived the filter. How it actually works:
1. Agent 1 pulls every new paper / published signal + its exact rules
2. Agent 2 runs the rules ONLY on data after the publication date (delistings included)
3. Agent 3 does parameter sweeps ±20% + cost stress + shock tests. If it dies -killed instantly
4. Only what remains goes to live paper trading. The fourth agent watches decay in real time and liquidates the moment the edge collapses This is the exact opposite of “textbook looked good so I trade it”. The strategies that are still running right now are the ones that passed the trial Veles described. Most AI setups explain strategies. This one tries to kill them.