I just updated to macOS 13.2.1 today. After doing so, I logged back in and a notification popped up, mentioning something called "open". Clicking on this notification took me to the settings. Specifically, it took me to the "Allow in the background" settings.

There, I can see the Unix script named "open". This file exists in the \usr\bin directory. Opening it in a text editor shows a jumbled mess of characters. It has permission to work in the background enabled. It also says that it is an "item from an unidentified developer".

Allow in the Background dialog

What is this "open" script? And is there a way for me to identify where it came from?

  • Click the circled "i" and it will open the containing folder, please add the path to the folder to your question. Also, as it is a script, try opening it with Textedit.app or other text editor of your choosing. Commented Feb 14, 2023 at 21:26
  • @SteveChambers the requested info has been added. Opening in COTeditor shows a jumbled mess of text, so I guess the format of it cannot be read by my text editor.
    – MoreFoam
    Commented Feb 14, 2023 at 21:43
  • That sounds like binary data. If you did not specifically install something that has that file as a payload, I would be tempted to deny it access or just plain remove it till you have figured out where it came from and what it does. If it is critical to an app you use turning off its security settings might show where it came from. Commented Feb 14, 2023 at 21:56

1 Answer 1


It's not a "UNIX script". It's a regular program, it comes with the standard macOS installation "from factory". Its purpose is simply to "open" up files and folders for you - i.e. from the command line (or a script or ordinary program), you can go open myfile.xyz and it will open up using a GUI application like had you double-clicked the file.

The fact that you get this permission prompt indicates that you have installed something that tries to run it in the background or at login time. Seeing that you have pgAdmin 4 installed, it sounds likely you might have other, developer-related stuff installed. So check those newly installed programs and you'll probably find the culprit.

To sum up, this program comes from Apple and it is completely non-problematic to have it on your system. If you want to verify that it is signed by Apple, run this command in Terminal.app:

codesign -dv --verbose=4 /usr/bin/open

At the end it should list the "Signed Time" as well as the "Authority", which would be "Apple Root CA" and "Apple Code Signing Certification Authority".

  • Thanks, this makes sense. It is odd that I was notified about it after running the macOS update.
    – MoreFoam
    Commented Feb 15, 2023 at 23:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .