Copilot app blocked by macOS Gatekeeper under corporate security policy

[jdesulme]

Describe the bug

Everytime after upgrading copilot cli through HomeBrew the following message appears:
Apple could not verify “copilot” is free of malware that may harm your Mac or compromise your privacy.

Afterwards, to get it working correctly, I need to go to Privacy & Security to explicitly allow "copilot"

We have the Security option set:
Allow applications from: App Store & Known Developers

Affected version

0.0.381

Steps to reproduce the behavior

1. On a corporate‑managed Mac with Gatekeeper enforced to App Store & Known Developers by profile.
2. brew install copilot-cli
3. Attempt to trigger copilot from the terminal
4. A pop-up appears with the message ‘Copilot’ was blocked to protect your Mac…

Expected behavior

Copilot should launch normally on managed Macs when signed with a valid Apple Developer ID and notarized, satisfying the “App Store & Known Developers” requirement.

Additional context

Mac OS: Sequoia 15.7.3
Shell: Zsh
Terminal: Ghostty

[jdesulme]

This is a huge pain, so after every version update, I created a function that clears it each time the CLI is updated.

function removeCopilotQuarantine(){
for f in /opt/homebrew/Caskroom/copilot-cli/*/copilot; do
  [[ -e $f ]] || continue
  # Check if attribute present
  if xattr -p com.apple.quarantine "$f" >/dev/null 2>&1; then
    # Try removing without sudo first, fall back to sudo
    if xattr -d com.apple.quarantine "$f" 2>/dev/null; then
      echo "Removed quarantine from: $f (no sudo)"
    else
      echo "Permission denied; retrying with sudo for: $f"
      sudo xattr -d com.apple.quarantine -- "$f" && echo "Removed quarantine from: $f (with sudo)"
    fi
  else
    echo "No com.apple.quarantine on: $f"
  fi
done
}

[rxe2fe]

copilot does not open anymore since v1 on Mac OS :/

[justinmchase]

What is the method to cause it to provide the button "open anyway"?

I am getting stung by this and I didn't install it via homebrew but just gh copilot install and so I'm not sure where the copilot binary is 🤔

[msrutek-paylocity]

@justinmchase you need to go to Settings > Privacy and Security, scroll down where you should find the option to Allow Anyway. On the next run, you'll see the Open Anyway option.

Before	After

[justinmchase]

I figured out that gh copilot just wraps the copilot command so simply doing which copilot works for locating the binary and the above xattr script works to unblock it.