macOS detects Codex Computer Use.app as malware and deletes it!

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #30972
• #30608
• #30298
• #30524

Powered by Codex Action

The first three seem related enough that I'll close this I guess #30972 #30608 #30298

### What version of the Codex App are you using (From “About Codex” dialog)? Version 26.623.101652 • Released Jul 2, 2026 ### What subscription do you have? Plus ### What platform is your computer? Darwin 25.5.0 arm64 arm ### What issue are you seeing? Just opened Codex and I think it wanted to update and I let it and then immediately got this macOS malware dialog and it deleted Codex Computer User.app! I then asked Codex about this ("macOS detected your Codex Computer Use.app as malware and moved it to the trash!! is this a problem...?") giving it the screenshots and it replied below: Yes, it’s a problem in the sense that you should not restore or whitelist that app from Trash. What I found: Apple says this exact “moved to Trash” behavior is XProtect blocking detected malware or suspicious modified apps. Apple’s guidance: when XProtect detects known malware, it blocks it, moves it to Trash, and alerts you. Source: [Apple Platform Security](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web). The OpenAI Codex docs say Computer Use is a macOS helper/plugin used for Screen Recording and Accessibility control. Source: [Codex Computer Use](https://developers.openai.com/codex/app/computer-use). On your Mac, /Applications/Codex.app is still present, but signature verification reports: invalid signature (code or signature have been modified). The nested Codex Computer Use.app inside Codex also reports an invalid signature. So: your Mac probably protected you, and this does not mean your whole Mac is compromised. But your local Codex install should be treated as untrusted until replaced. Do this: 1. Leave the trashed Codex Computer Use.app in the Trash, or empty Trash. 2. Quit Codex. 3. Delete /Applications/Codex.app. 4. Reinstall Codex only from the official OpenAI/Codex source. 5. Open Codex, then reinstall Computer Use from Codex Settings if you need it. 6. Re-grant Screen Recording and Accessibility only after the fresh install. I would not try to manually move the helper back, bypass Gatekeeper, or run xattr fixes here. The invalid signature makes “clean reinstall” the sane path. <img alt="Image" width="244" height="253" src="https://private-user-images.githubusercontent.com/240811/617654390-ed196cb3-439f-47e0-91a2-a940ae41b717.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODM1NjU5MTMsIm5iZiI6MTc4MzU2NTYxMywicGF0aCI6Ii8yNDA4MTEvNjE3NjU0MzkwLWVkMTk2Y2IzLTQzOWYtNDdlMC05MWEyLWE5NDBhZTQxYjcxNy5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwNzA5JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDcwOVQwMjUzMzNaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT00OWRlMzQ0MmQ3YTg0Y2FhY2VhNmYzNDY5M2I3YWY1ZWFhYWY4OTE4MmUzMDI2ZjczYjc2ZDVlMzg2MzYxN2JlJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.74Be1U5tGV5UO_qR3Bln8SaqRW6f_AXDexeZpXrrRq0"> <img alt="Image" width="425" height="497" src="https://private-user-images.githubusercontent.com/240811/617654421-260dfa3b-df26-49d6-ac5f-3689ecba8236.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODM1NjU5MTMsIm5iZiI6MTc4MzU2NTYxMywicGF0aCI6Ii8yNDA4MTEvNjE3NjU0NDIxLTI2MGRmYTNiLWRmMjYtNDlkNi1hYzVmLTM2ODllY2JhODIzNi5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjYwNzA5JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI2MDcwOVQwMjUzMzNaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT0zYWUzYjE5ZmQ2YTIzZWYxODRmNTIzMzk4YmVmMWEyMDBlOTc5M2RmZDhjZDMzYzNjZmQ0NmU2OGFlODMyYjg5JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZyZXNwb25zZS1jb250ZW50LXR5cGU9aW1hZ2UlMkZwbmcifQ.QnPbJW-NNzO6XDEEWZT5pNodGkfTSx5JTIp_xm7c_kU"> ### What steps can reproduce the bug? open Codex and do auto-update ### What is the expected behavior? Codex Computer Use.app to not be detected as malware by macOS ### Additional information n/a

The reinstall isn't working for me. I got the malware error the first time. Every time after that I get a .background folder instead of the applications folder and i can't move codex into applications. What's going on?

The reinstall isn't working for me. I got the malware error the first time. Every time after that I get a .background folder instead of the applications folder and i can't move codex into applications. What's going on?