Appshot window selection clicks through into System Settings and triggers admin authentication prompt

Summary

Capturing a macOS System Settings window with Codex Appshot appears to pass a selection click through to the underlying window. When System Settings is open to Privacy & Security, the click can activate a protected control such as Enable System Extensions…, causing a Touch ID/admin-password sheet to appear repeatedly.

The authentication sheet says:

Privacy & Security is trying to unlock system settings. Touch ID or enter your password to continue with Privacy & Security.

This is confusing because it looks as though another app is requesting system-level access.

Environment

• Codex desktop app: 26.707.51957 (build 5175)
• Bundle ID: com.openai.codex
• Codex Computer Use / Appshot service: 26.710.1000387
• macOS: 27.0
• macOS build: 26A5378j

Steps to reproduce

1. Open System Settings → Privacy & Security.
2. Scroll to the section containing Enable System Extensions….
3. From Codex, start an Appshot capture of the System Settings window.
4. Select/capture the System Settings window.
5. Repeat the Appshot flow if necessary.

Actual behavior

A click/gesture reaches the underlying Privacy & Security view and macOS opens an admin authentication sheet. Repeating the capture can make the prompt appear again.

Expected behavior

Clicks used to select or capture a window in Appshot should be consumed by the capture UI and must not activate controls in the target application.

Diagnostic evidence

Unified logging captured the sequence:

• 13:18:53.370: SkyComputerUseService launches from Codex Computer Use.
• 13:18:57.006: AppKit records a gesture and sendAction: inside SecurityPrivacyExtension.
• 13:18:57.123: Apple’s SecurityPrivacyExtension.appex requests system.preferences.security and related protected rights.
• 13:18:57.124: authorization cannot proceed without interaction.
• 13:18:57.136: System Settings displays the Touch ID/password sheet.

The requesting process is Apple’s:

/System/Library/ExtensionKit/Extensions/SecurityPrivacyExtension.appex

The Appshot helper active during the interaction is:

~/.codex/computer-use/Codex Computer Use.app/Contents/MacOS/SkyComputerUseService

systemextensionsctl list showed only the already-active Tailscale network extension, so this was not a pending unknown system extension.

Impact

This can unintentionally activate security-sensitive System Settings controls and repeatedly prompt for administrator authentication. Appshot should prevent input from reaching the captured application while its selection interaction is active.