macOS: Codex Desktop triggers sustained syspolicyd/trustd CPU spikes tied to Computer Use #28545

High CPU State

On June 13, 2026, Codex Desktop triggered sustained high CPU usage on macOS 14.7.1 (23H222) on Apple Silicon. During the first capture, syspolicyd reached 136.3% CPU and trustd reached 62.4% CPU. After Codex was closed, the machine returned to normal. After Codex was reopened, the problem reproduced again within seconds, and the second capture showed syspolicyd at 180.7% CPU and trustd at 61.2% CPU.

Evidence

• In a 15-minute capture window, Codex logged 1031 TCCAccessRequest() IPC events.
• In the same window, trustd logged 671 warnings that the com.apple.security.application-groups entitlement for 2DC432GLL2.com.openai.sky.CUAService was ignored because of an invalid signature or incorrect provisioning profile.
• In the same window, syspolicyd logged 23 failed to call driver: 0x3 events, along with repeated SecTrustEvaluateIfNecessary.
• In the narrowed post-reopen window for the new Codex process, there were still 256 TCCAccessRequest() IPC events, 763 repeated trustd entitlement warnings, 97661 syspolicyd cache misses, and 40 trust evaluation events.

Correlation with Codex

• The issue stops when Codex is closed.
• The issue returns immediately after Codex is reopened.
• The second reproduction used a fresh Codex PID tree, which makes this unlikely to be only a stale leftover process from an earlier session.
• The active process chain during reproduction was Codex -> codex app-server -> SkyComputerUseService, followed by repeated trustd / syspolicyd security activity.
• The repeated system warnings specifically mention com.openai.sky.CUAService, which ties the high-CPU activity to Codex Computer Use rather than to an unrelated background process.

Qualification

This evidence shows a strong runtime correlation between Codex Desktop, SkyComputerUseService, and the trustd / syspolicyd CPU spike. It does not by itself prove the exact root cause inside Codex, but it does show that opening Codex is the direct trigger for the repeated security and entitlement evaluation loop on this machine.