Syspolicyd (Gatekeeper) infinite loop scanning Cursor Helper (Plugin) — 50%+ CPU

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

syspolicyd (Gatekeeper) infinite loop scanning Cursor Helper (Plugin) — 50%+ CPU

Steps to Reproduce

Reproduction:

  • macOS Sequoia, Apple M1 Max
  • Cursor open with extensions
  • syspolicyd enters infinite loop scanning
    /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/
  • Two threads re-checking same binary in parallel (stat64, access, getattrlist loop)
  • Killing syspolicyd doesn’t help — loop restarts immediately
  • Closing Cursor instantly resolves the issue
  • fs_usage trace attached

Expected Behavior

syspolicyd (macOS Gatekeeper daemon) should verify Cursor’s code signature once after launch and cache the result. Instead, it enters an infinite loop re-checking the same binary, consuming 50%+ CPU indefinitely.

Operating System

MacOS

Version Information

Cursor IDE 2.4.31
macOS 26.2 (Sequoia, build 25C56)
Apple M1 Max, 32GB RAM

Additional Information

fs_usage trace shows syspolicyd stuck in an infinite loop scanning:
/Applications/Cursor.app/Contents/Frameworks/Cursor Helper
(Plugin).app/Contents/MacOS/Cursor Helper (Plugin)

Two threads (.577874 and .579272) perform identical operations in parallel:
stat64 → access → getattrlist → statfs64 → repeat

The loop persists across syspolicyd restarts (sudo killall syspolicyd).
Closing Cursor instantly resolves the issue — syspolicyd drops to 0% CPU.

Raw fs_usage trace (first 80 lines):

17:10:11.931307 stat64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000033 syspolicyd.579272
17:10:11.931478 access (R___) /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000146 syspolicyd.579272
17:10:11.931541 getattrlist /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000024 syspolicyd.579272
17:10:11.931571 stat64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000012 syspolicyd.579272
17:10:11.931689 stat64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000020 syspolicyd.577874
17:10:11.931690 getattrlist [ 20] /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)/Wrapper 0.000015 syspolicyd.579272
17:10:11.931757 stat64 [ 20] /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)/Wrapper 0.000011 syspolicyd.579272
17:10:11.931778 statfs64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000014 syspolicyd.579272
17:10:11.931814 stat64 /dev/disk3s5 0.000031 syspolicyd.579272
17:10:11.931826 access (R___) /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000123 syspolicyd.577874
17:10:11.931833 getattrlist /System/Volumes/Data 0.000018 syspolicyd.579272
17:10:11.931862 getattrlist /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000015 syspolicyd.577874
17:10:11.931872 getattrlist /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000018 syspolicyd.579272
17:10:11.931887 stat64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000013 syspolicyd.577874
17:10:11.931925 getattrlist /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000044 syspolicyd.579272
17:10:11.931968 getattrlist [ 20] /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)/Wrapper 0.000013 syspolicyd.577874
17:10:11.932020 stat64 [ 20] /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin)/Wrapper 0.000011 syspolicyd.577874
17:10:11.932037 statfs64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000010 syspolicyd.577874
17:10:11.932056 stat64 /dev/disk3s5 0.000015 syspolicyd.577874
17:10:11.932069 getattrlist /System/Volumes/Data 0.000012 syspolicyd.577874
17:10:11.932101 getattrlist /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000016 syspolicyd.577874
17:10:11.932116 fcntl F=14 <OFD_SETLK> 0.000010 syspolicyd.579272
17:10:11.932122 fcntl F=14 <OFD_SETLK> 0.000005 syspolicyd.579272
17:10:11.932125 fcntl F=14 <OFD_SETLK> 0.000002 syspolicyd.579272
17:10:11.932140 getattrlist /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000032 syspolicyd.577874
17:10:11.932204 fcntl F=14 <OFD_SETLK> 0.000007 syspolicyd.579272
17:10:11.932285 getattrlist /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000014 syspolicyd.579272
17:10:11.932307 stat64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000012 syspolicyd.579272
17:10:11.932328 statfs64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000009 syspolicyd.579272
17:10:11.932767 fcntl F=14 <OFD_SETLK> 0.000006 syspolicyd.577874
17:10:11.933279 stat64 /Applications/Cursor.app 0.000023 syspolicyd.579272
17:10:11.933316 fcntl F=14 <OFD_SETLK> 0.000007 syspolicyd.577874
17:10:11.933331 getattrlist /Applications/Cursor.app 0.000013 syspolicyd.579272
17:10:11.933346 stat64 /Applications/Cursor.app 0.000008 syspolicyd.579272
17:10:11.933384 getattrlist /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000017 syspolicyd.577874
17:10:11.933405 getattrlist [ 2] /Applications/Cursor.app/Wrapper 0.000006 syspolicyd.579272
17:10:11.933409 stat64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000014 syspolicyd.577874
17:10:11.933430 stat64 [ 2] /Applications/Cursor.app/Wrapper 0.000005 syspolicyd.579272
17:10:11.933434 statfs64 /Applications/Cursor.app/Contents/Frameworks/Cursor Helper (Plugin).app/Contents/MacOS/Cursor Helper (Plugin) 0.000012 syspolicyd.577874
17:10:11.933444 statfs64 /Applications/Cursor.app 0.000010 syspolicyd.579272
17:10:11.933472 stat64 /dev/disk3s5 0.000024 syspolicyd.579272
17:10:11.933489 getattrlist /System/Volumes/Data 0.000016 syspolicyd.579272
17:10:11.933516 getattrlist /Applications/Cursor.app 0.000011 syspolicyd.579272
17:10:11.933532 stat64 /Applications/Cursor.app 0.000011 syspolicyd.577874
17:10:11.933561 getattrlist /Applications/Cursor.app 0.000038 syspolicyd.579272
17:10:11.933568 getattrlist /Applications/Cursor.app 0.000010 syspolicyd.577874
17:10:11.933582 stat64 /Applications/Cursor.app 0.000009 syspolicyd.577874
17:10:11.933632 getattrlist [ 2] /Applications/Cursor.app/Wrapper 0.000006 syspolicyd.577874
17:10:11.933655 stat64 [ 2] /Applications/Cursor.app/Wrapper 0.000005 syspolicyd.577874
17:10:11.933665 statfs64 /Applications/Cursor.app 0.000007 syspolicyd.577874
17:10:11.933687 stat64 /dev/disk3s5 0.000018 syspolicyd.577874
17:10:11.933701 getattrlist /System/Volumes/Data 0.000012 syspolicyd.577874
17:10:11.933724 open F=16 (R_____N____X___) /Applications/Cursor.app 0.000137 syspolicyd.579272
17:10:11.933737 getattrlist /Applications/Cursor.app 0.000013 syspolicyd.577874
17:10:11.933771 getattrlist /Applications/Cursor.app 0.000027 syspolicyd.577874
17:10:11.933898 open F=17 (R_____N____X___) /Applications/Cursor.app 0.000108 syspolicyd.577874
17:10:11.933909 fstatfs64 F=17 0.000010 syspolicyd.577874
17:10:11.933965 fstatfs64 F=16 0.000004 syspolicyd.579272
17:10:11.933980 getdirentries64 F=17 B=0x68 0.000034 syspolicyd.577874
17:10:11.933992 close F=17 0.000005 syspolicyd.577874
17:10:11.933992 getdirentries64 F=16 B=0x68 0.000025 syspolicyd.579272
17:10:11.934009 close F=16 0.000005 syspolicyd.579272
17:10:11.934133 open F=16 (R_____N____X___) /Applications/Cursor.app/Contents 0.000112 syspolicyd.577874
17:10:11.934138 fstatfs64 F=16 0.000004 syspolicyd.577874
17:10:11.934147 open F=17 (R_____N____X___) /Applications/Cursor.app/Contents 0.000113 syspolicyd.579272
17:10:11.934152 fstatfs64 F=17 0.000004 syspolicyd.579272
17:10:11.934180 getdirentries64 F=16 B=0x148 0.000037 syspolicyd.577874
17:10:11.934192 getdirentries64 F=17 B=0x148 0.000038 syspolicyd.579272
17:10:11.934196 close F=16 0.000003 syspolicyd.577874
17:10:11.934211 close F=17 0.000004 syspolicyd.579272
17:10:11.934319 open F=16 (R_____N________) /Applications/Cursor.app/Contents/Info.plist 0.000109 syspolicyd.577874
17:10:11.934324 fstat64 F=16 0.000004 syspolicyd.577874
17:10:11.934332 open F=17 (R_____N________) /Applications/Cursor.app/Contents/Info.plist 0.000108 syspolicyd.579272
17:10:11.934336 fstat64 F=17 0.000003 syspolicyd.579272
17:10:11.934414 read F=17 B=0x9953 0.000076 syspolicyd.579272
17:10:11.934417 close F=17 0.000003 syspolicyd.579272
17:10:11.934436 read F=16 B=0x9953 0.000109 syspolicyd.577874
17:10:11.934442 close F=16 0.000006 syspolicyd.577874
17:10:11.936966 fcntl F=14 <OFD_SETLK> 0.000010 syspolicyd.577874
17:10:11.937038 fcntl F=14 <OFD_SETLK> 0.000005 syspolicyd.577874

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

3

Hey, thanks for the detailed report and the fs_usage trace.

A couple things you can try:

  1. Remove the quarantine flag (this is a common cause of Gatekeeper re-checking in a loop on Sequoia):

    sudo xattr -rd com.apple.quarantine /Applications/Cursor.app

  2. If that doesn’t help, check what the Gatekeeper assessment returns:

    spctl --assess -vvvv /Applications/Cursor.app/Contents/Frameworks/Cursor\ Helper\ \(Plugin\).app

By the way, does this happen on every launch, or only sometimes?

I’ve passed this along to the team. Let me know how it goes.

4

This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.