›_ Codex Issues
Codex Issues / #24394

Codex Computer Use auth plugin breaks macOS lock-screen unlock

Open 💬 3 comments Opened May 25, 2026 by jzthree
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

Summary

After enabling Codex Computer Use / mobile remote control, local macOS lock-screen unlock fails. The failure is isolated to the system.login.screensaver authorization path. Disabling Codex mobile access did not remove the Codex authorization mechanism, but manually restoring the screensaver auth rule fixed local unlock immediately.

Environment

  • Codex desktop: 26.519.41501
  • Codex Computer Use plugin: 1.0.799
  • macOS: observed before upgrading, and still reproduced after upgrading to macOS 26.5 (25F71)
  • Architecture: arm64

Symptoms

  • Control-Command-Q, wait, enter password: unlock fails
  • Log out and log back in: works
  • Cold boot / hard reboot login: works
  • Different cold-boot/preboot login screen still accepts the same credentials

This points to the lock-screen unlock path rather than account credentials or normal login.

What I Found

The system.login.screensaver authorization rule contained:

system.login.screensaver:
  com.openai.sky.CUAService.AuthorizationPlugin.remote
  use-login-window-ui

Disabling Codex mobile access did not remove com.openai.sky.CUAService.AuthorizationPlugin.remote from this rule.

Workaround / Fix

After backing up the rule, restoring it to the normal macOS login-window UI fixed lock/unlock immediately:

security authorizationdb read system.login.screensaver > ~/Desktop/system.login.screensaver.backup.plist
sudo security authorizationdb write system.login.screensaver use-login-window-ui

After this, security authorizationdb read system.login.screensaver shows only:

use-login-window-ui

and Control-Command-Q lock/unlock works again.

Expected Behavior

  • Codex should not break local lock-screen unlock.
  • Disabling mobile/remote access should remove or disable the Codex screensaver authorization mechanism.
  • If the remote-lock-screen mechanism cannot run correctly, it should fail open to normal local unlock rather than preventing unlock.

Actual Behavior

The Codex authorization mechanism remained in system.login.screensaver and local lock-screen unlock failed until the rule was manually restored.

View original on GitHub ↗

3 Comments

github-actions[bot] contributor · 3 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #24013

Powered by Codex Action

IgorGanapolsky · 3 months ago

This looks like the same failure class I hit while hardening my own Mac agent setup: the visible symptom is usually a broken action loop, but the root cause is often one of these:

  • model/provider route points at an unavailable model
  • stale auth profile or mismatched runtime
  • macOS Screen Recording/Accessibility is granted to the wrong app
  • Computer Use is installed but not exposed to the agent runtime
  • the TUI reuses one global session across unrelated project directories

The fastest sanity check is to verify each layer separately: provider smoke test, isolated per-directory session id, macOS permissions readback, and a real Computer Use tool call such as listing running apps.

I wrote up the checklist here: https://igorganapolsky.github.io/openclaw-mac-ai-workstation-setup/troubleshooting.html?utm_source=github&utm_medium=issue&utm_campaign=openai-codex-24394

If you want this fixed done-for-you on a Mac, I also packaged it as a focused setup service: https://igorganapolsky.github.io/openclaw-mac-ai-workstation-setup/?utm_source=github&utm_medium=issue&utm_campaign=openai-codex-24394

jzthree · 3 months ago

Thanks for the suggestions. I want to clarify the issue so it does not get mixed up with general Computer Use setup problems.

This bug is specifically about the macOS lock screen.

On my machine, Codex added this to the lock-screen authorization rule:

com.openai.sky.CUAService.AuthorizationPlugin.remote

After that, I could not unlock the Mac from the lock screen. This failed even when the Mac had not gone to sleep.
After removing the Codex authorization plugin from system.login.screensaver, lock/unlock worked again immediately.

So the issue is not general macOS permissions, model setup, or Computer Use setup. It is that the Codex lock-screen authorization plugin can break normal local unlock, and disabling mobile/remote access did not remove it.