Who Sudo'd Exposes Full Call Chains Behind macOS Sudo and Touch ID Prompts, a Growing Concern With AI Agents

SIGKITTEN · x · 2026-09-05

macOS has long shown only vague info about which app requests sudo/Touch ID, never the call chain—a problem that gets acute as background AI agents proliferate. The tool Who Sudo'd now displays a full callchain for any app calling LocalAuthentication and lets you approve sudo with a password once you know where the request came from. The thread explores whether this mechanism can even be used to unlock the computer.

Related event: who-sudod Reveals Which Process Is Asking for Your macOS Password(3 posts)→

Original post →

More from coding & agent

coding & agent channel →