Codex App remote control authorization fails on Intel Macs without Secure Enclave (OSStatus -25293)

What version of the Codex App are you using (From “About Codex” dialog)?

26.616.81150

What subscription do you have?

ChatGPT Plus / Pro

What platform is your computer?

Darwin 14.8.3 x86_64 (Intel Core i5-5257U, no T2/SE)

What issue are you seeing?

Summary

Remote control authorization in Settings → Connections → Control other devices consistently fails on Intel Macs without T2 chip / Secure Enclave.

Error

[remote-connections/settings] remote_control_authorize_failed
errorMessage="Secure Enclave key creation failed (hardware-backed device keys are not available on this platform); OS-protected fallback failed (The operation couldn't be completed. (OSStatus error -25293 - failed to generate asymmetric keypair))"

Root cause

Codex's fallback key generation uses kSecUseDataProtectionKeychain: true without providing kSecAttrAccessControl. This fails with errSecInternalComponent (-25293) on Intel Macs without Secure Enclave. The same bug manifests as -25300 on older macOS (see #28990).

Experimental verification

Tested via Swift SecKeyCreateRandomKey on the same machine:

| Test case | Result |
|-----------|--------|
| kSecAttrTokenID = kSecAttrTokenIDSecureEnclave | ❌ Fails (no SE hardware) |
| kSecUseDataProtectionKeychain: true, no kSecAttrAccessControl | ❌ Fails with -25293 |
| kSecUseDataProtectionKeychain: true, with kSecAttrAccessControl | ✅ SUCCESS |
| Default keychain, no Data Protection flag | ✅ SUCCESS |

The macOS Security framework can generate ECC P-256 keys on this hardware when called with proper parameters. This is a Codex API call bug, not a hardware limitation.

What steps can reproduce the bug?

1. Open Codex App on Intel Mac without T2 chip (e.g., 2015 MacBook with Core i5-5257U)
2. Go to Settings → Connections → Control other devices
3. Click "Authorize on chatgpt.com"
4. Observe error toast: "Failed to authorize remote control"

What is the expected behavior?

Remote control authorization should succeed. When Secure Enclave hardware is unavailable, Codex should fall back to standard keychain key generation with kSecAttrAccessControl set, or skip kSecUseDataProtectionKeychain entirely for non-SE hardware. The macOS Security framework is fully capable of generating ECC P-256 keys in the regular keychain.

Additional information

Suggested fix

In the remote control key generation fallback path:

1. Set kSecAttrAccessControl with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly and .privateKeyUsage flag when using kSecUseDataProtectionKeychain: true
2. Or fall back to a plain keychain key without kSecUseDataProtectionKeychain when Secure Enclave is unavailable

Related issues

• #28990 — Same symptom on macOS 12 (OSStatus -25300), likely same root cause
• #18431 — "app-server: add macOS device key provider"
• #23289 — Remote control pairing failure on Intel Mac