Codex Desktop 26.616.81150 triggers syspolicyd EMFILE / global spctl "Too many open files" on macOS

What version of the Codex App are you using (From “About Codex” dialog)?

26.616.81150 (4306)

What subscription do you have?

Pro

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

Codex Desktop appears to trigger a macOS syspolicyd / Gatekeeper assessment failure.

After Codex Desktop has been running, /usr/libexec/syspolicyd stays at high CPU. In my latest sample it reached around 59%.

The Codex app bundle itself appears valid:

codesign --verify --deep --strict --verbose=2 /Applications/Codex.app

This succeeds, and /Applications/Codex.app has no com.apple.quarantine xattr.

However, Gatekeeper/SystemPolicy assessment fails globally:

spctl -a -vv -t execute /Applications/Codex.app
# /Applications/Codex.app: Too many open files

spctl -a -vv -t execute "/Applications/Visual Studio Code.app"
# /Applications/Visual Studio Code.app: Too many open files

Unified logs include:

UNIX error exception: 24
Failed to generate SecStaticCode ... error: 100024
Failed to open main executable ... Too many open files
AppleSystemPolicy ... would not allow ... /Applications/Codex.app/Contents/MacOS/Codex

This does not look like a corrupted Codex.app install. It looks like Codex Desktop activity is triggering repeated SystemPolicy/Gatekeeper assessment until syspolicyd hits EMFILE / file descriptor exhaustion.

What steps can reproduce the bug?

1. Start macOS normally.
2. Launch Codex Desktop.
3. Use Codex Desktop for a while.
4. Observe /usr/libexec/syspolicyd CPU usage in Activity Monitor or with:

ps -p 440 -o pid,ppid,%cpu,%mem,etime,time,command

1. Run:

spctl -a -vv -t execute /Applications/Codex.app
spctl -a -vv -t execute "/Applications/Visual Studio Code.app"

1. Observe that spctl returns Too many open files.
2. Check unified logs for:

UNIX error exception: 24
Failed to generate SecStaticCode ... error: 100024
Failed to open main executable ... Too many open files

The issue appears after Codex Desktop has been running, and the failure affects unrelated apps as well, such as Visual Studio Code.

What is the expected behavior?

Codex Desktop should not cause sustained syspolicyd / Gatekeeper assessment loops or file descriptor exhaustion.

spctl should continue to work for Codex.app and unrelated apps.

For example, these commands should not fail with Too many open files:

spctl -a -vv -t execute /Applications/Codex.app
spctl -a -vv -t execute "/Applications/Visual Studio Code.app"

Unrelated apps such as Visual Studio Code should not fail Gatekeeper/SystemPolicy assessment because Codex Desktop has been running.

Additional information

macOS version:

ProductName: macOS
ProductVersion: 26.5.1
BuildVersion: 25F80

Platform:

Darwin 25.5.0 arm64 arm

Codex app info:

CFBundleShortVersionString: 26.616.81150
CFBundleVersion: 4306
CFBundleIdentifier: com.openai.codex

Codex.app appears valid on disk:

codesign --verify --deep --strict --verbose=2 /Applications/Codex.app

Result:

/Applications/Codex.app: valid on disk
/Applications/Codex.app: satisfies its Designated Requirement

/Applications/Codex.app has no quarantine xattr:

xattr -p com.apple.quarantine /Applications/Codex.app

Result:

xattr: /Applications/Codex.app: No such xattr: com.apple.quarantine

Current syspolicyd sample:

PID 440 /usr/libexec/syspolicyd
CPU: around 59% in the latest sample

I did not find the previously suspected OpenClaw LaunchAgent on this machine during this reproduction.