Security Report — ChatGPT/Codex Regains Files and Folders Access After Permissions Are Explicitly Revoked on macOS

Security Report — ChatGPT/Codex Automatically Regains Desktop Access on macOS

Executive summary

After filesystem access for ChatGPT is revoked under System Settings → Privacy & Security → Files and Folders, ChatGPT disappears entirely from the list. Merely launching the application causes its entry to reappear without a visible macOS consent prompt. A subsequent read-only test from Codex confirms that the Desktop can be enumerated and that regular files stored there can be read.

The locally installed application also fails macOS code-signature validation with invalid signature (code or signature have been modified). The available evidence therefore indicates a serious failure of the privacy boundary presented to the user. The current evidence does not establish whether the primary cause is ChatGPT/Codex, an application update or signing defect, a helper process, macOS TCC, or an interaction among these components.

Environment

• Operating system: macOS 26.6.1, build 25G76
• Displayed application name: ChatGPT
• Application path: /Applications/ChatGPT.app
• Bundle identifier: com.openai.codex
• Application version: 26.825.51511
• Application build: 7377
• Reported Team Identifier: 2DC432GLL2
• Main executable SHA-256: 228fb899e6a7c27ae43151857616f0ba2b926de67cfc119a370038fdd16f407e
• Main executable size: 69,984 bytes
• Main executable modification time: 2026-08-30 01:25:58 +0200
• Main executable metadata-change time: 2026-08-30 09:55:20 +0200

Reproduction steps

1. Fully quit ChatGPT.
2. Open System Settings → Privacy & Security → Files and Folders.
3. Remove or revoke ChatGPT filesystem access.
4. Confirm that ChatGPT is entirely absent from the Files and Folders application list.
5. Launch ChatGPT without manually granting any new filesystem permission.
6. Return immediately to System Settings → Privacy & Security → Files and Folders.
7. Observe that ChatGPT has reappeared, showing a “Full Disk Access” item, without a visible consent prompt.
8. From a Codex task, perform a read-only test against the Desktop directory.

Observed result

• The Desktop directory could be enumerated successfully.
• 66 top-level Desktop entries were visible.
• 46 top-level regular files were tested by attempting to read one byte from each file.
• All 46 files were readable; zero files returned a read denial.
• File names and contents were not displayed or retained during the test.
• No new macOS authorization prompt was observed before access returned.
• The behavior was reproduced after the application had been fully quit and its Files and Folders entry had disappeared.

Expected result

After a user explicitly revokes filesystem privacy access in macOS System Settings, the revocation should remain effective until the user explicitly grants access again. Launching ChatGPT should not silently recreate an effective authorization or restore access to the Desktop.

Code-signature findings

The following read-only commands were used:

codesign --verify --strict --verbose=6 /Applications/ChatGPT.app
codesign --verify --deep --verbose=6 /Applications/ChatGPT.app
spctl -a -vv --type execute /Applications/ChatGPT.app
codesign -d --entitlements :- /Applications/ChatGPT.app

The principal results were:

/Applications/ChatGPT.app: invalid signature (code or signature have been modified)
In architecture: arm64
/Applications/ChatGPT.app: internal error in Code Signing subsystem
warning: binary contains an invalid entitlements blob. The OS will ignore these entitlements.

The bundle nevertheless contains a stapled notarization ticket and reports the designated requirement:

identifier "com.openai.codex"
TeamIdentifier=2DC432GLL2
Notarization Ticket=stapled

The bundle contains multiple executable helpers, including computer-use and installer-related components. No conclusion has yet been reached as to which process causes the TCC entry to reappear.

Testing limitations

The Codex execution sandbox could not read the per-user TCC database or unified TCC logs, even after a narrowly scoped read permission was requested. The following operations remained blocked:

sqlite3 "$HOME/Library/Application Support/com.apple.TCC/TCC.db" ...
/usr/bin/log show ...

Consequently, this report does not identify the exact process or TCC authorization reason responsible for restoring access.

Screenshot evidence

The user attests the operational order described in the reproduction steps, independently of the timestamps embedded in the screenshot filenames.

• Capture d’écran 2026-08-30 à 11.43.16.png
  • SHA-256: 4efd3374be43e8844a2f47828522b99b98cc08c3eac3c821063ca0ead6aab31d
• Capture d’écran 2026-08-30 à 11.43.44.png
  • SHA-256: 858ade16e0bcd7d70647cb0f168776c980380d1b040789905fda0774359c821d
• Capture d’écran 2026-08-30 à 11.42.49.png
  • SHA-256: 508eed3c4944d98492556acad234de02268855ae676b5b2c93a8ef059334cbf1

Security impact

The macOS privacy interface appears to communicate that ChatGPT no longer has filesystem access, yet effective Desktop access returns after the application is launched, without a visible authorization decision by the user. If confirmed independently, this can undermine user control over protected files and may affect confidentiality expectations for any data stored in macOS privacy-controlled directories.

Requested investigation

Please determine:

1. Whether ChatGPT or one of its helpers registers or requests TCC access at launch.
2. Why the application reappears in Files and Folders without a visible consent prompt.
3. Whether an existing Full Disk Access authorization, security-scoped bookmark, inherited authorization, helper identity, or TCC defect explains the observed access.
4. Why the installed application fails strict and deep code-signature validation despite carrying a stapled notarization ticket.
5. Whether the application update process can leave the bundle in a modified or partially replaced state.
6. Whether revocation reliably prevents subsequent Desktop access on supported macOS versions.

Suggested severity

High pending confirmation and root-cause analysis. The issue is reproducible, concerns a user-visible privacy revocation, and results in verified read access to files outside the selected Codex workspace.

Start with the reproduction steps for /Applications/ChatGPT.app and verify the Files and Folders behavior after revocation. Run the listed codesign and spctl commands, then investigate which process or helper restores access; the TCC database and unified logs were blocked in the report. Done means identifying the authorization path and explaining both the restored access and signature failure.