›_ Codex Issues
Codex Issues / #37378

ChatGPT.app repeatedly requests access to other apps’ data although Computer Use is not enabled

Open 💬 1 comment Opened Aug 7, 2026 by Hubert1965

What version of the Codex App are you using (From “About Codex” dialog)?

26.730.61639

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

The unified ChatGPT/Codex macOS app repeatedly displays this macOS privacy prompt:

“ChatGPT.app” would like to access data from other apps. Keeping app data separate makes it easier to manage your privacy and security.

I have never installed or enabled general Computer Use (“Any App”).

Current permission state:

  • Full Disk Access for ChatGPT.app: disabled
  • Accessibility for Codex Computer Use.app: disabled
  • Screen and System Audio Recording for ChatGPT/Codex Computer Use: not granted
  • Automation access for ChatGPT: not present
  • Locked Use: disabled
  • Always Allowed Apps: none

I normally select “Don’t Allow”. The prompt returns regularly, approximately once per day, often during ordinary Codex file work.

This appears related to the previously closed issue #11027 and may be a regression:
https://github.com/openai/codex/issues/11027

Diagnostic evidence

I captured the macOS TCC log when the prompt appeared on 2026-08-07 at 06:20:02.

Immediately before the prompt, the following OpenAI Computer Use components were active:

  • com.openai.sky.CUAService
  • SkyComputerUseService
  • SkyComputerUseClient
  • ~/.codex/computer-use/Codex Computer Use.app

macOS attributed the activity to:

  • bundle identifier: com.openai.codex
  • executable: /Applications/ChatGPT.app/Contents/MacOS/ChatGPT

The relevant sequence was:

  1. kTCCServiceAppleEvents activity involving SkyComputerUseService
  2. kTCCServiceSystemPolicyAllFiles requested for com.openai.codex
  3. Full Disk Access returned denied (authValue=0)
  4. kTCCServiceSystemPolicyAppData was requested
  5. TCC logged AUTHREQ_PROMPTING
  6. macOS displayed the default App Data permission prompt

Redacted log excerpt:

AttributionChain:
responsible={identifier=com.openai.codex,
path=/Applications/ChatGPT.app/Contents/MacOS/ChatGPT},
accessing={identifier=com.openai.sky.CUAService.cli,
path=<HOME>/.codex/computer-use/Codex Computer Use.app/.../SkyComputerUseClient}

service=kTCCServiceSystemPolicyAllFiles

Handling access request to kTCCServiceSystemPolicyAllFiles,
from Sub:{com.openai.codex},
ReqResult(Auth Right: Denied)
authValue=0

service=kTCCServiceSystemPolicyAppData

Handling access request to kTCCServiceSystemPolicyAppData,
from Sub:{com.openai.codex},
ReqResult(Auth Right: Unknown)

AUTHREQ_PROMPTING:
service=kTCCServiceSystemPolicyAppData
subject=Sub:{com.openai.codex}

The log does not reveal the target application container because macOS displays the relevant path as <private>.

What steps can reproduce the bug?

The exact triggering operation is not yet deterministic:

  1. Launch ChatGPT.app.
  2. Use Codex normally for local file editing.
  3. Leave the app running.
  4. Eventually macOS displays the App Data permission prompt.

The event observed at 2026-08-07 06:20:02 coincided with the Computer Use helper activity described above.

What is the expected behavior?

ChatGPT should not request access to other applications’ protected data unless the user explicitly invokes and authorizes a feature that requires it.
Computer Use helper components should not cause an App Data permission request when general Computer Use is not installed or enabled.
If access is genuinely required, the app should identify the feature and explain which application data it needs and why.

Additional information

_No response_

View original on GitHub ↗

1 Comment

jyxjjj · 11 days ago

I can reproduce this intermittently, and the unified logs point to task-completion notification delivery rather than intentional Computer Use activity.

I did not invoke Computer Use, browser control, or interaction with another application. I only asked Codex to modify code inside the current workspace using workspace-write access.

The relevant sequence was:

  1. ChatGPT queried notification settings and delivered notifications.
  2. ChatGPT registered one notification category and added a notification request.
  3. In the same millisecond, sandboxd began the kTCCServiceSystemPolicyAllFiles / kTCCServiceSystemPolicyAppData authorization sequence.
  4. usernoted successfully processed the notification.
  5. Notification Center presented it as a banner and played codex-notification.wav.
  6. After I selected "Don't Allow", the kernel identified the protected target as the App Group 2DC432GLL2.com.openai.codex.notifications.

The issue is not reliably reproducible; other workspace tasks can complete and notify normally.

I also checked the following:

  • The ChatGPT app signature is valid on disk and satisfies its Designated Requirement.
  • The signing certificate is trusted by macOS.
  • The main ChatGPT executable and Codex (Alerts).app both declare 2DC432GLL2.com.openai.codex.notifications in com.apple.security.application-groups.
  • The notifications App Group container did not exist after the prompt.
  • Around the event, containermanagerd successfully approved and created/looked up 2DC432GLL2.com.openai.sky.CUAService for SkyComputerUseClient.
  • I found no equivalent containermanagerd lookup or creation request for 2DC432GLL2.com.openai.codex.notifications.
  • TCC logged No usage string found (key:NSAppDataUsageDescription) for client, so macOS used its generic App Data explanation.

Although SkyComputerUseClient appeared in the logs, it was started automatically by ChatGPT/Codex; I did not invoke a Computer Use feature. Its own App Group lookup succeeded, and the rejected target was the separate notifications App Group.

This suggests, but does not prove, that the task-completion notification path sometimes accesses the notifications App Group before that container has been initialized through containermanagerd. The intermittent behavior may indicate an initialization race or a notification code path used only under certain conditions.

Could the maintainers check:

  1. which component is responsible for initializing 2DC432GLL2.com.openai.codex.notifications;
  2. whether task-completion notification delivery can access it before initialization;
  3. why no container lookup/create request is visible for that group;
  4. why Computer Use helpers are started during an ordinary workspace-editing task; and
  5. whether NSAppDataUsageDescription should be provided if this access is intentional?