Potential macOS Security / File Visibility Issue after Codex Update

What version of the Codex App are you using (From “About Codex” dialog)?

Codex CLI v0.141.0

What subscription do you have?

ChatGPT Max

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

After updating to Codex CLI v0.141.0 on macOS (Apple Silicon), I experienced a sequence of events that caused significant concern regarding file safety and system behavior.

Timeline:

1. On startup, macOS displayed a warning indicating that Codex contained malicious software and had been blocked/removed.
2. After reinstalling Codex, the application started again.
3. During the session, macOS repeatedly requested new permissions for Terminal, including access to data from other applications and media libraries.
4. Several project folders on my Desktop appeared to have lost their contents when viewed through Finder.
5. Opening the same projects in VS Code showed that the source code was still present.
6. Terminal also confirmed that the files and directories still existed.
7. Multiple Markdown files appeared inside projects, including files such as:

• ADAPTACION_appTestCormo.md
• DOCUMENTACION_ACTUALIZADA.md
• MAPA_DOCUMENTACION.md

1. Finder behavior became confusing because opening some project folders appeared to display only these Markdown files, creating the impression that project contents had been removed.

Current status:

• No actual source code loss has been confirmed.
• Projects remain accessible from VS Code and Terminal.
• Git repositories are still present.
• However, the combination of:

• macOS malware warning,
• repeated Terminal permission requests,
• automatic Codex updates,
• and unusual Finder/project visibility behavior

created a serious concern about filesystem safety.

Request:

Please investigate whether Codex CLI v0.141.0 may be interacting with macOS security mechanisms (Gatekeeper/XProtect), requesting broader filesystem permissions than expected, or generating project documentation in a way that can create confusion regarding project contents and visibility.

I can provide screenshots and additional logs if required.

What steps can reproduce the bug?

1. macOS Apple Silicon.
2. Install and run Codex CLI v0.141.0.
3. Open an existing project directory containing source code.
4. Start a normal Codex session.
5. During startup, macOS may display a security warning indicating that Codex contains malicious software and has been blocked/removed.
6. Reinstall Codex and restart the session.
7. During subsequent use, macOS repeatedly requests additional permissions for Terminal (access to data from other applications, media libraries, files, etc.).
8. After the session, inspect project folders from Finder.

Observed results:

• Finder may appear to show only generated Markdown documentation files.
• Project contents may appear missing or replaced.
• The same projects remain accessible from VS Code and Terminal.
• Git repositories and source code still exist.
• The behavior creates the impression of file loss or filesystem modification.

Additional observation:

• Codex CLI repeatedly auto-updated from v0.140.0 back to v0.141.0.

What is the expected behavior?

Expected behavior:

• Codex should not trigger macOS malware warnings.
• Codex should clearly explain why Terminal permissions are required.
• Codex should not create confusion regarding project contents or visibility.
• Finder, VS Code, and Terminal should present a consistent view of project files.
• Documentation files generated by Codex should not give the impression that source code has been removed or replaced.
• Users should be confident that project files are not being deleted, hidden, or modified unexpectedly.

Additional information

<img width="296" height="226" alt="Image" src="https://github.com/user-attachments/assets/4ed89efb-8f3e-456d-b255-214903e9617d" />
<img width="289" height="227" alt="Image" src="https://github.com/user-attachments/assets/35cce023-edb7-4ff8-bea9-cc0e0c1464a9" />