Codex Desktop unusable due to recurring syspolicyd/trustd CPU spikes on macOS, malware-like resistance to disabling computer use.

What version of the Codex App are you using (From “About Codex” dialog)?

26.609.41114

What subscription do you have?

Pro

What platform is your computer?

Darwin 24.6.0 arm64 arm

What issue are you seeing?

Summary

The Codex Desktop app is now completely unusable for me due to syspolicyd / trustd CPU spikes on macOS.

Codex Desktop appears to trigger recurring macOS syspolicyd / trustd CPU spikes on macOS. The spikes can happen after Codex is already open and idle, not only during initial launch. CPU usage has reached several hundred percent for syspolicyd, with trustd also spiking.

This does not appear to be caused by MCP servers, the Computer Use notify hook, or the bundled Computer Use app. I disabled/removed those and the issue still recurs.

Environment

• macOS: 15.7.5 (24G624)
• Architecture: Apple Silicon / ARM64E
• App: Codex Desktop
• Codex config mode tested:
• custom permissions
• full access
• approval_policy = "never"
• sandbox_mode = "danger-full-access"
• Username, local paths, and project names redacted.

Symptoms

• Opening/reopening Codex Desktop correlates with syspolicyd and trustd spikes.
• Spikes sometimes calm down, then return later without me launching anything new.
• syspolicyd has reached ~450% CPU.
• trustd also spikes during the same window.
• Other apps can fail to launch while this is happening. Example: Arc failed to launch with a system policy / code-signing error for its Sparkle framework. Arc launched fine when Codex was closed, then syspolicyd spiked again after reopening Codex.
• The machine became unstable enough that one diagnostic attempt caused a crash/reboot.

Evidence from samples

I captured samples of both syspolicyd and trustd during a spike.

syspolicyd sample:

Analysis of sampling syspolicyd (pid 506) every 1 millisecond
Date/Time: 2026-06-13 14:00:52.447 -0400
OS Version: macOS 15.7.5 (24G624)

Dispatch Thread Soft Limit: 64 reached in 1699 of 4894 samples -- too many dispatch threads blocked in synchronous operations

The hot stacks show code-signing, notarization, YARA, and signature verification work:

DispatchQueue_124: com.apple.security.syspolicy.yara
SecStaticCodeCheckValidityWithErrors
Security::CodeSigning::SecStaticCode::staticValidate
Security::CodeSigning::checkNotarizationServiceForRevocation
Security::CodeSigning::SecStaticCode::validateDirectory
CMSDecoderCopySignerStatus
SecCmsSignedDataVerifySignerInfo_internal
SecKeyVerifySignature

trustd sample:

Analysis of sampling trustd (pid 427) every 1 millisecond
Date/Time: 2026-06-13 14:01:27.199 -0400
OS Version: macOS 15.7.5 (24G624)

The hot stack shows certificate/signature verification:

DispatchQueue_80: com.apple.trustd.evaluation
SecCertificateIsSignedBy
SecKeyVerifySignature
SecKeyRunAlgorithmAndCopyResult
SecECPublicKeyCopyOperationResult
ccec_verify
ccec_verify_digest_ws

Interpretation: syspolicyd appears to be repeatedly assessing code bundles/frameworks and asking trustd to verify certificate chains/signatures. The samples do not expose the exact target path being assessed, but the behavior correlates strongly with Codex Desktop being open/reopened.

Things I tried that did not fix it

1. Disabled MCPs entirely.

• No effect. syspolicyd still spiked.

1. Disabled the Codex notify hook that launched Computer Use:

• The config previously contained a notify = [...] line pointing at SkyComputerUseClient.
• I commented/disabled that line.
• This used to work as a workaround, but as of today, for no clear reason, Codex will recreate the notify = [...] line pointing at SkyComputerUseClient in config.toml upon restart.
• As a result issue persisted

1. Removed/blocked the bundled Computer Use app:

• Moved ~/.codex/computer-use aside.
• Recreated ~/.codex/computer-use as an empty directory.
• Codex would then recreate it upon restart.
• Eventually I locked it with permissions/flags so Codex could not reinstall into it.
• Verified Computer Use was not running or installed after reboot.
• The issue persisted.

1. Force-quit Computer Use when it was present.

• syspolicyd continued spiking.

1. Rebooted.

• Computer Use remained absent/blocked.
• Spikes still returned after Codex was reopened.

1. Tried custom permissions instead of full access.

• The issue persisted even outside full-access mode.

1. Closed other apps / terminals.

• Closing the terminal that had run lazygit did not stop the spike.
• Arc launched normally when Codex was closed, then syspolicyd spiked again after Codex was reopened.

Expected behavior

Codex Desktop should not trigger recurring sustained syspolicyd / trustd CPU spikes when idle, especially after MCPs and Computer Use are disabled.

Actual behavior

With Codex Desktop open, macOS repeatedly enters a high-CPU security assessment state involving syspolicyd and trustd. The spike can return randomly after previously calming down.

The really weird stuff

To recap some really worrying things about this:

• Started for no clear reason. Not related to an app update or config change or change on my machine.
• Codex was highly resistant to disabling computer use - a feature I never actually enabled or wanted!
• Codex is now completely unusable to me.

What steps can reproduce the bug?

Issue happens immediately upon opening Codex.

What is the expected behavior?

Codex shouldn't make my computer unusable.

Additional information

_No response_