Codex Chrome extension/native host triggers syspolicyd/trustd CPU runaway on macOS

Summary

After installing/reinstalling the Codex Chrome extension, macOS SystemPolicy services can enter a high-CPU validation loop. The loop is mostly silent in unified logs.

Environment

• macOS: 26.5.1 (25F80)
• Architecture: arm64
• Codex Desktop: Electron/Chromium framework 149.0.7827.54 observed in process args
• Codex Chrome extension: 1.1.5
• Extension ID: hehggadaopoacecdllhhajmbjkdcmajg
• Native messaging host path: ~/.codex/plugins/cache/openai-bundled/chrome/latest/extension-host/macos/arm64/extension-host

Steps to reproduce

1. Open Codex Desktop on macOS.
2. Install or reinstall the Codex Chrome extension.
3. Confirm the native host is running, for example: extension-host chrome-extension://hehggadaopoacecdllhhajmbjkdcmajg/
4. Watch Activity Monitor, top, or powermetrics.

Actual behavior

After reinstalling the extension, the native host started and SystemPolicy CPU spiked:

• top: syspolicyd 120.6%, trustd 44.1%
• powermetrics --samplers tasks: syspolicyd 1595.84 CPU ms/s, trustd 668.39 CPU ms/s
• log show --last 2m --predicate process==syspolicyd-or-trustd | wc -l: 0

Earlier in the same session, removing the Codex Chrome extension/native host manifests and killing the extension host allowed syspolicyd/trustd to return to 0%. Reinstalling the extension brought the high CPU behavior back.

Expected behavior

Installing the Chrome extension/native messaging host should not cause sustained or repeated Gatekeeper/SystemPolicy validation work.

Notes

The issue appears related to the native messaging host and/or repeated validation of Codex-signed components. In prior local checks, the main Codex app was accepted by spctl, while the native host is a signed raw binary rather than an app bundle. Please let me know what additional diagnostics would help.