What to expect from your first scan

Looks at your 100 busiest processes for known-bad tools, such as crypto miners, and risky command lines: reverse shells, download-and-run, encoded commands, and connections to common remote-access ports.

Lists services listening beyond this Mac's own loopback address, the open doors other devices could try. Listening doesn't prove anyone can reach them.

With Full Disk Access, reads the permissions macOS has granted, such as camera, microphone, Screen Recording and Accessibility, and flags sensitive ones left behind by apps you removed. You'll probably find a few you forgot.

Reviews the LaunchAgents and LaunchDaemons folders in your user and system Library and flags unsigned or unusual items, a common way malware survives a restart.

Spots supported AI agents that are running, such as Claude Code, Cursor or GitHub Copilot, and shows the files, connections and child processes they have open.

Checks the files in Downloads against a built-in list of known-malware hashes and malware-signature rules. Scripts and Windows installers also get simple checks.

The checks add up to a 0 to 100 score: Apps 30, Network 25, Permissions 20, AI agents 25. A check that can't run shows as not checked, never as passed.

Findings land in the Issues list. Some offer Quit or Quarantine after you confirm; most open the right page of System Settings or Finder. After that, CoreLock scans again every 15 minutes by default.