macOS detects Codex Computer Use.app as malware and deletes it!

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.623.101652 • Released Jul 2, 2026

What subscription do you have?

Plus

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

Just opened Codex and I think it wanted to update and I let it and then immediately got this macOS malware dialog and it deleted Codex Computer User.app!

I then asked Codex about this ("macOS detected your Codex Computer Use.app as malware and moved it to the trash!! is this a problem...?") giving it the screenshots and it replied below:

Yes, it’s a problem in the sense that you should not restore or whitelist that app from Trash.

What I found:

• Apple says this exact “moved to Trash” behavior is XProtect blocking detected malware or suspicious modified apps. Apple’s guidance: when XProtect detects known malware, it blocks it, moves it to Trash, and alerts you. Source: [Apple Platform Security](https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web).
• The OpenAI Codex docs say Computer Use is a macOS helper/plugin used for Screen Recording and Accessibility control. Source: [Codex Computer Use](https://developers.openai.com/codex/app/computer-use).
• On your Mac, /Applications/Codex.app is still present, but signature verification reports: invalid signature (code or signature have been modified).
• The nested Codex Computer Use.app inside Codex also reports an invalid signature.

So: your Mac probably protected you, and this does not mean your whole Mac is compromised. But your local Codex install should be treated as untrusted until replaced.

Do this:

1. Leave the trashed Codex Computer Use.app in the Trash, or empty Trash.
2. Quit Codex.
3. Delete /Applications/Codex.app.
4. Reinstall Codex only from the official OpenAI/Codex source.
5. Open Codex, then reinstall Computer Use from Codex Settings if you need it.
6. Re-grant Screen Recording and Accessibility only after the fresh install.

I would not try to manually move the helper back, bypass Gatekeeper, or run xattr fixes here. The invalid signature makes “clean reinstall” the sane path.

<img width="244" height="253" alt="Image" src="https://github.com/user-attachments/assets/ed196cb3-439f-47e0-91a2-a940ae41b717" />

<img width="425" height="497" alt="Image" src="https://github.com/user-attachments/assets/260dfa3b-df26-49d6-ac5f-3689ecba8236" />

What steps can reproduce the bug?

open Codex and do auto-update

What is the expected behavior?

Codex Computer Use.app to not be detected as malware by macOS

Additional information

n/a