macOS malware/Gatekeeper warning appears after Codex app update; codesign verification fails

What happened

After updating the Codex macOS app and restarting it, macOS showed a malware/Gatekeeper-style warning for Codex again.

This warning had previously appeared repeatedly during normal use. A normal restart did not fix it. It seemed to stop after a macOS update and reinstall, but it reappeared after the latest Codex app update.

Environment

• macOS: 26.5.2 (25F84)
• SIP: Enabled
• Codex app: 26.623.101652
• Bundled CLI: codex-cli 0.142.5
• App path: /Applications/Codex.app
• Architecture reported by codesign: arm64

Diagnostics

Running:

codesign --verify --deep --strict --verbose=4 /Applications/Codex.app

returns:

/Applications/Codex.app: invalid signature (code or signature have been modified)
In architecture: arm64

Running:

spctl --assess --type execute -vv /Applications/Codex.app

returns:

/Applications/Codex.app: internal error in Code Signing subsystem

Running:

codesign -dv --verbose=4 /Applications/Codex.app

shows:

Executable=/Applications/Codex.app/Contents/MacOS/Codex
Identifier=com.openai.codex
Format=app bundle with Mach-O thin (arm64)
TeamIdentifier=2DC432GLL2
Notarization Ticket=stapled
Authority=(unavailable)
Runtime Version=26.0.0
Sealed Resources version=2 rules=13 files=8506

Expected behavior

Codex should update and relaunch without macOS showing malware/Gatekeeper warnings, and the installed app should pass normal macOS signature/Gatekeeper verification.

Actual behavior

After the Codex update, macOS showed the warning again and local verification reports an invalid signature.

Notes

I can provide screenshots and logs from ~/Library/Logs/com.openai.codex/ if helpful.