Summary
After updating the ChatGPT/Codex desktop app to the latest build, macOS now frequently displays the following system warning during normal use:
Malware Blocked
“codex” was not opened because it contains malware. This action did not harm your Mac.
Since installing build 26.928.20755, the dialog has appeared repeatedly and is seriously disrupting normal use.
Environment
- ChatGPT/Codex desktop version: 26.928.20755
- Release date shown in About dialog: Sep 29, 2026
- Subscription: ChatGPT Pro
- macOS: Golden Gate 27.0
- Device: 16-inch MacBook Pro
- Chip: Apple M5 Max
- Memory: 128 GB
Device serial number and unrelated account/project information are intentionally omitted.
Steps to reproduce
- Update the desktop app through the normal in-app updater to version 26.928.20755.
- Relaunch the app and use Codex normally.
- Continue working in the app.
- Observe macOS repeatedly showing the Malware Blocked dialog for the
codex executable.
- Dismiss the dialog; it later appears again.
Actual behavior
macOS repeatedly blocks a component named codex as malware. The warning interrupts active work and suggests that a bundled executable, helper, or updater-staged copy is being launched repeatedly and rejected by Gatekeeper/XProtect.
Expected behavior
The official desktop app and every bundled or updater-staged codex executable should be correctly signed and notarized, launch normally, and never trigger a macOS malware warning.
Impact
- The popup occurs frequently rather than only once.
- It interrupts active Codex sessions and significantly affects usability.
- It creates uncertainty about whether required Codex components are actually launching successfully.
- Repeated malware warnings from an official OpenAI update are also a serious trust and security concern.
Requested investigation
Please verify the signing certificate, notarization ticket, bundled CLI/helper packaging, and any temporary updater-staging copies used by build 26.928.20755. Please also confirm whether the latest build is affected by a revoked certificate, missing notarization, or an XProtect false positive, and publish a fixed build as soon as possible.
Screenshots are available showing the malware warning, the About dialog with the exact app version and release date, and the macOS/device information. No Gatekeeper or XProtect bypass has been attempted.
Summary
After updating the ChatGPT/Codex desktop app to the latest build, macOS now frequently displays the following system warning during normal use:
Since installing build 26.928.20755, the dialog has appeared repeatedly and is seriously disrupting normal use.
Environment
Device serial number and unrelated account/project information are intentionally omitted.
Steps to reproduce
codexexecutable.Actual behavior
macOS repeatedly blocks a component named
codexas malware. The warning interrupts active work and suggests that a bundled executable, helper, or updater-staged copy is being launched repeatedly and rejected by Gatekeeper/XProtect.Expected behavior
The official desktop app and every bundled or updater-staged
codexexecutable should be correctly signed and notarized, launch normally, and never trigger a macOS malware warning.Impact
Requested investigation
Please verify the signing certificate, notarization ticket, bundled CLI/helper packaging, and any temporary updater-staging copies used by build 26.928.20755. Please also confirm whether the latest build is affected by a revoked certificate, missing notarization, or an XProtect false positive, and publish a fixed build as soon as possible.
Screenshots are available showing the malware warning, the About dialog with the exact app version and release date, and the macOS/device information. No Gatekeeper or XProtect bypass has been attempted.