Codex Computer Use auth plugin breaks macOS lock-screen unlock

Summary

After enabling Codex Computer Use / mobile remote control, local macOS lock-screen unlock fails. The failure is isolated to the system.login.screensaver authorization path. Disabling Codex mobile access did not remove the Codex authorization mechanism, but manually restoring the screensaver auth rule fixed local unlock immediately.

Environment

• Codex desktop: 26.519.41501
• Codex Computer Use plugin: 1.0.799
• macOS: observed before upgrading, and still reproduced after upgrading to macOS 26.5 (25F71)
• Architecture: arm64

Symptoms

• Control-Command-Q, wait, enter password: unlock fails
• Log out and log back in: works
• Cold boot / hard reboot login: works
• Different cold-boot/preboot login screen still accepts the same credentials

This points to the lock-screen unlock path rather than account credentials or normal login.

What I Found

The system.login.screensaver authorization rule contained:

system.login.screensaver:
  com.openai.sky.CUAService.AuthorizationPlugin.remote
  use-login-window-ui

Disabling Codex mobile access did not remove com.openai.sky.CUAService.AuthorizationPlugin.remote from this rule.

Workaround / Fix

After backing up the rule, restoring it to the normal macOS login-window UI fixed lock/unlock immediately:

security authorizationdb read system.login.screensaver > ~/Desktop/system.login.screensaver.backup.plist
sudo security authorizationdb write system.login.screensaver use-login-window-ui

After this, security authorizationdb read system.login.screensaver shows only:

use-login-window-ui

and Control-Command-Q lock/unlock works again.

Expected Behavior

• Codex should not break local lock-screen unlock.
• Disabling mobile/remote access should remove or disable the Codex screensaver authorization mechanism.
• If the remote-lock-screen mechanism cannot run correctly, it should fail open to normal local unlock rather than preventing unlock.

Actual Behavior

The Codex authorization mechanism remained in system.login.screensaver and local lock-screen unlock failed until the rule was manually restored.