macOS XProtect false positive: Sparkle Updater.app flagged as malware

Summary

macOS XProtect/syspolicyd is flagging the bundled Sparkle auto-updater (org.sparkle-project.Sparkle.Updater) inside Codex.app as malware and repeatedly attempting to move it to the trash.

Details

• Affected component: Codex.app/Contents/Frameworks/Sparkle.framework/Versions/B/Updater.app
• Bundle ID: org.sparkle-project.Sparkle.Updater
• Team ID: 2DC432GLL2 (OpenAI, L.L.C.)
• macOS version: Sequoia
• Code signing: Valid Developer ID Application certificate, hardened runtime enabled

Reproduction

The syspolicyd log shows repeated attempts (every ~15 minutes) to quarantine the updater:

syspolicyd: [com.apple.syspolicy.exec:default] Attempting to move malware to trash: PST: (path: cd7aa078cc36520d), (team: 2DC432GLL2), (id: org.sparkle-project.Sparkle.Updater), (bundle_id: org.sparkle-project.Sparkle.Updater)

This can be observed by running:

log show --predicate 'eventMessage CONTAINS "malware" AND eventMessage CONTAINS "updater"' --last 24h --info

Expected behavior

The Sparkle Updater.app bundled with Codex.app should not be flagged by XProtect/syspolicyd.

Possible fix

This may require re-notarizing the Sparkle framework bundle or updating to a newer Sparkle release that is not matched by the current XProtect signature definitions.