Codex-latest-x64.dmg ships with invalid code signatures on Intel macOS

What version of the Codex App are you using (From “About Codex” dialog)?

26.519.31651 (CFBundleVersion 3017)

What subscription do you have?

Not relevant / not included

What platform is your computer?

Darwin 24.6.0 x86_64 i386

Hardware: Intel MacBook Pro, Intel Core i7.

What issue are you seeing?

The official Intel macOS download appears to ship a Codex.app with invalid code signatures for the x86_64 Mach-O binaries.

Download URL used:

https://persistent.oaistatic.com/codex-app-prod/Codex-latest-x64.dmg

The downloaded DMG itself verifies successfully and has the expected origin metadata:

hdiutil: verify: checksum of "/Users/lancet/Downloads/Codex-latest-x64.dmg" is VALID
sha256: 474ec334f7814a7d893580d3d5a5736ef12a1320296e4018b1e4358c75286928
Content-Length from server: 479391610
Last-Modified from server: Fri, 22 May 2026 03:57:47 GMT

However, after mounting the DMG and verifying the app inside the mounted volume, code signature verification fails before any local copy or post-install modification:

$ codesign --verify --verbose=4 '/Volumes/Codex Installer/Codex.app'
/Volumes/Codex Installer/Codex.app: invalid signature (code or signature have been modified)
In architecture: x86_64

$ codesign --verify --verbose=4 '/Volumes/Codex Installer/Codex.app/Contents/MacOS/Codex'
/Volumes/Codex Installer/Codex.app/Contents/MacOS/Codex: invalid signature (code or signature have been modified)
In architecture: x86_64

$ codesign --verify --verbose=4 '/Volumes/Codex Installer/Codex.app/Contents/Resources/codex'
/Volumes/Codex Installer/Codex.app/Contents/Resources/codex: invalid signature (code or signature have been modified)
In architecture: x86_64

$ spctl -a -vv '/Volumes/Codex Installer/Codex.app'
/Volumes/Codex Installer/Codex.app: internal error in Code Signing subsystem

The app can launch in some cases, but macOS-trust-dependent functionality appears to fail. In particular, enabling the setting that allows Codex to use the Mac while the screen is locked / lock-screen Computer Use behavior fails in the app.

Relevant Codex app logs from the installed copy show the managed Computer Use service failing to spawn:

warning Failed to reconcile managed Computer Use service appshotsEnabled=true errorMessage="Failed to spawn managed Computer Use service" errorName=Error errorStack="Error: Failed to spawn managed Computer Use service\n    at rs.ensureServicePidForEnabledAppshots (.../main-DVEWN1ng.js:79:4419)"

What steps can reproduce the bug?

1. On an Intel Mac, download the official x64 DMG:

curl -L -o Codex-latest-x64.dmg https://persistent.oaistatic.com/codex-app-prod/Codex-latest-x64.dmg

1. Verify the DMG checksum structure:

hdiutil verify Codex-latest-x64.dmg

1. Mount the DMG read-only:

hdiutil attach Codex-latest-x64.dmg -readonly -nobrowse

1. Verify the app directly from the mounted volume:

codesign --verify --verbose=4 '/Volumes/Codex Installer/Codex.app'
codesign --verify --verbose=4 '/Volumes/Codex Installer/Codex.app/Contents/MacOS/Codex'
codesign --verify --verbose=4 '/Volumes/Codex Installer/Codex.app/Contents/Resources/codex'
spctl -a -vv '/Volumes/Codex Installer/Codex.app'

Observed result: the app and embedded x86_64 Mach-O binaries report invalid signatures.

What is the expected behavior?

The official Codex-latest-x64.dmg should contain a Codex.app whose x86_64 binaries pass normal macOS code signature verification, and macOS-trust-dependent features such as the lock-screen Computer Use service should be able to start after the user grants the required permissions.

Additional information

The file is not a truncated or incomplete download. The local file size matches the server Content-Length, and hdiutil verify reports the DMG checksum as valid.

This was reproduced by verifying the Codex.app directly inside the mounted DMG, so the failure is not caused by copying the app into /Applications or by a later local modification of the installed app.