I've got a problem with some app on my Mac stealing the keyboard focus (the current window's title bar becomes inactive). However, it is not actually putting up any windows or menu bar of its own, and it does not respond identifiably to keyboard shortcuts.

Is there a way to determine what application has the keyboard focus even if it is one of those which has no menu bar or Dock icon? I know of one built-in feature that almost does this; the Force Quit dialog, if invoked from the keyboard, will open with the focused application selected. However, it only lists normal has-a-dock-icon applications, so it doesn't help in this case.

This started occurring around the time when I upgraded from 10.8 to 10.9; I suspect that one of the apps I already had installed, or upgraded along with the OS, is newly misbehaving.

I am open to solutions involving a small amount of programming (or AppleScript, say), use of developer tools, etc.; but not ones like “Uninstall things until it goes away” because that would be excessively disruptive at the moment. I'd like to definitively identify the application and file a bug report or fix its configuration.

My research has only turned up a couple of threads requesting the same on Apple Support Communities which did not contain an answer.

  • I'm seeing this too. 10.9.4. Perhaps sharing the main apps I have running might highlight a commonality? Chrome, Firefox, Safari, Wuala, Dropbox, Nitrous, 1Password, Google Hangouts, Evernote, Skitch, Google drive, Time Machine, Airport Base Station Agent, Android File Transfer Agent. Otherwise... no easy solution that I know. My suspicion is G Hangouts. – JezC Sep 7 '14 at 7:21

You can find the app that steals focus by saving the following code in a find_focus_stealer.py file and running it via python find_focus_stealer.py in a terminal.

Start running the script – it will print out the name of the active app every 3 seconds. Keep working as usual, wait for the problem to occur, and after a few seconds see the output in the terminal. You’ll have your culprit.

In my case it was a Symantec Antivirus background app (SymUIAgent.app).


from AppKit import NSWorkspace
import time
t = range(1,100)
for i in t:
    activeAppName = NSWorkspace.sharedWorkspace().activeApplication()['NSApplicationName']
    print activeAppName

Credits to iMichael_ in this Apple Discussions thread.

  • I tried this script. Strangely every time the event-stealing happens, the script stops running. The last log statement in the window is no different than the previous log statements, i.e. no obvious culprit. The script just exits, no error. – Diodeus - James MacFarlane Nov 25 '14 at 15:32
  • 2
    This python program worked great, but I had to use the Apple Installed Python. I had brew installed Python 2.7.8 and the AppKit module is not included. Also on my machine the offending app was: SymUIAgent.app Symantec Quick Menu. – Cameron Goodale Dec 17 '14 at 19:18
  • 2
    @Diodeus the reason why this exits is not because the app that stole focused ended it, but because this was written to only run for a period of 100 seconds. To make it run until I press Ctrl+c in that terminal window I changed for i in t: to be while 1: – CenterOrbit Jan 28 '15 at 19:29
  • 1
    Nice! For me, it was Google Drive.app. I did a slight update to your script which I'll post in a separate answer. Thanks! – medmunds Feb 6 '15 at 0:36
  • 1
    if you encounter no module named appkit, then run easy_install pip and pip install pyobjc. For me it was Google Drive stealing my focus – mihai Sep 19 '16 at 23:33

Here’s a slight update to @Ace’s script that runs until you kill it and only prints the app name when it changes. Again, save this code in a file find_focus_stealer.py and then try running it with python find_focus_stealer.py.


    from AppKit import NSWorkspace
except ImportError:
    print "Can't import AppKit -- maybe you're running python from brew?"
    print "Try running with Apple's /usr/bin/python instead."

from datetime import datetime
from time import sleep

last_active_name = None
while True:
    active_app = NSWorkspace.sharedWorkspace().activeApplication()
    if active_app['NSApplicationName'] != last_active_name:
        last_active_name = active_app['NSApplicationName']
        print '%s: %s [%s]' % (
            datetime.now().strftime('%Y-%m-%d %H:%M:%S'),

I was able to use this to track down “Google Drive” as the focus-stealing culprit on my Mac.


Perhaps checking Activity Monitor for active processes? Anything in App Nap state could easily be ruled out, and it might make the hunt a lot shorter.

  • Yes, that would be a way of informing a guess about what the problem is, but I'm looking for something that actually obtains the information directly. – Kevin Reid Mar 9 '14 at 20:43

Here is improved version of script mentioned in @Ace’s answer:

# Prints current window focus.
# See: https://apple.stackexchange.com/q/123730
from AppKit import NSWorkspace
import time
workspace = NSWorkspace.sharedWorkspace()
active_app = workspace.activeApplication()['NSApplicationName']
print('Active focus: ' + active_app)
while True:
    prev_app = active_app
    active_app = workspace.activeApplication()['NSApplicationName']
    if prev_app != active_app:
        print('Focus changed to: ' + active_app)

It will print the name of the active application that has the focus and will detect if it changed by checking every second.

Related script: Identify which app or process is stealing focus on OSX at Gist


  1. Save the above script into a file get_active_focus.py.
  2. Assign execution attributes with the chmod +x get_active_focus.py command.
  3. Run the file with ./get_active_focus.py.


$ ./get_active_focus.py
Active focus: Terminal
Focus changed to: Google Chrome

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .