Malware Alert

[kirocop]

Hi, I received this alert this morning by macOS. It is said that the Codex contains malware and was deleted by Apple.

[etraut-openai]

What Codex client did you have installed? Was it the CLI, desktop app, IDE extension, Xcode client, JetBrains client? And which version? If you had an older version installed, that would explain what you are seeing. We needed to rotate our signing cert about three weeks ago, and we revoked the old cert a few days ago. If you had a version of the Codex harness that was older than three weeks installed, it will be flagged as potential malware because of the revoked cert. If you upgrade to a more recent version, the problem should go away.

[kirocop]

was desktop app. The version maybe was 1.29

[mariomac]

Seeing the same message after opening IntelliJ IDEA:

Some ai-related plugins that I have installed:

• Jetbrains AI assistant.
• Claude Code
• MCP Server

If I open the Codex Desktop app, I don't see any message but codex asking me for 1Password authorization as described in #17655

[mariomac]

Fixed by running the "Clean up Codex Installation" Intellij Action, and then reinstalling the Codex agent in Jetbrains AI.

[commanderperkins]

Same here got the message after opening the app (version 26.313.41514)

[ThatLadyDev]

This command solved it for me.
codesign --force --deep --sign - ~/Library/Caches/<path-to-the-jetbrains-app>/aia/codex/bin/<buggy-codex-installation-name>

Context of my issue:

• My issue popped up when installing codex in my JetBrains app:
• The error I kept experiencing: “codex-aarch64-apple-darwin” will damage your computer. You should move it to the Bin"

[MissakaI]

For anyone encountering this error in IntelliJ first time use of AI Feature, you won't be proceed further after pressing the Let's Go button as the installation fails. Instead then go to Install the Codex via AI Assistant (Settings | Tools | AI Assistant | Agents). Then execute the command above. Then restart IntelliJ.

[christhomas]

So your plan is "allow the potentially dangerous software to run by signing for it" ?
Wouldn't a better plan be, they fix their bugs, or you downgrade to a version that doesn't have bugs?

I don't think we should be teaching others to sign binaries your mac is saying are potentially dangerous. This one might be harmless. But the next one might not be.