Apple macOS security features face scrutiny after security researchers Talal Haj Bakry and Tommy Mysk identified a vulnerability in Gatekeeper allowing once-run web-downloaded applications to be silently replaced with malicious versions without requiring elevated privileges. According to the researchers, the flaw exposes widely used software such as Brave, Slack, Signal, and Visual Studio Code to silent executable swaps after initial validation is complete.
How the macOS Gatekeeper Executable Swap Flaw Works
The attack vector requires a target application to be downloaded from the web and executed at least once so that Gatekeeper completes its initial validation phase. According to the Mysk team, an attacker with user-scoped code execution capabilities can then archive the validated app bundle using the file archiving utility tar, delete the original, and replace it with a malicious doppelganger without macOS demanding reauthorization.
Did you know? Mac App Store applications are owned by root, which prevents standard user-level processes from overwriting them. However, software downloaded directly from the web lacks this root-level protection, making non-App Store binaries vulnerable to local tampering once initial trust is established by the operating system.
The Role of Cached Trust Values in Bypass Techniques
Tommy Mysk explained that the loophole likely stems from cached value retention within the macOS security architecture. When a user opens an internet-downloaded app for the first time, macOS marks the application as trusted and stores that validation data. When the executable is subsequently modified, the operating system appears to rely on the cached trust value rather than strictly enforcing a full integrity check on the altered bundle.
Attackers can gain the necessary user-level access through various entry points, including malicious command-line tools, copy-pasted terminal commands, prompt injection attacks on AI agents, or software supply chain compromises via package managers like npm and brew. Once deployed, the substitute application can present deceptive authentication prompts that users readily trust because they originate from a recognized software interface.
Apple’s Stance and Closure of the Security Issue
After the Mysk team reported their findings, Apple closed the issue. According to the researchers, Apple does not classify the technique as modifying a signed executable. Instead, the company stated that archiving and restoring the application bundle via proof-of-concept code effectively overwrites the entire directory, rendering it a locally built app bundle.
Locally built applications fall outside the standard scope of macOS guards, which is why actions requiring access to Keychain or TCC-protected directories trigger standard system authorization prompts. Apple considers the acceptance of these system prompts through social engineering attacks to be outside the threat model of Gatekeeper itself. Apple did not respond to requests for comment regarding the researchers’ findings.
Frequently Asked Questions
What is Apple Gatekeeper?
Apple Gatekeeper is a built-in macOS security mechanism designed to verify that software downloaded from outside the Mac App Store comes from an identified developer, is notarized by Apple, and has not been altered.
Are Mac App Store apps vulnerable to this swap attack?
What software is at risk from this vulnerability?
Any macOS application downloaded directly from the web that has already been executed at least once—such as web browsers, messaging apps, and development tools—is potentially exposed if an attacker achieves user-level code execution.