[Bug] Agent incorrectly consumed Apple Developer certificate slot during guided process
Bug Description
Your agent, that I was using to guide me through a process effectively burned on of my 5 available Apple Dev cert slots. I am furious!
Environment Info
- Platform: darwin
- Terminal: ghostty
- Version: 2.1.220
- Feedback ID: 0f405cd9-fbb0-45f8-9f43-8f369fcc4bae
Errors
[]Summary
Claude Code guided a user through creating an Apple Developer ID Application certificate. The agent mentioned a critical, irreversible creation-time option
as a hedged parenthetical rather than a required step, and did not verify the resulting artifact. The user received a certificate valid for 179 days instead
of ~5 years. The error is not correctable without permanently consuming a second of the account's five lifetime Developer ID Application certificate slots.
Environment
- Claude Code, model Claude Opus 5
- macOS 26.x (Darwin 25.5.0), Xcode 26.6
- Apple Developer Program, Individual enrollment, Team ID P46UWRKPX9
What happened
- The agent gave portal instructions containing an optional-sounding critical step.
Verbatim from the agent's message:
▎ 3. If it asks for a Profile Type, choose G2 Sub-CA (the current one)
Presented as a conditional aside, third in a six-step list, between "select Developer ID Application" and "Choose File." Nothing indicated this determined
certificate lifetime. The other five steps were stated as imperatives.
- The user completed the flow and installed the certificate.
- The agent verified the wrong properties.
It ran checks confirming: identity present, public key matched the CSR, signing produced a valid chain, timestamp present, hardened runtime enabled.
notBefore/notAfter were printed in raw output but never evaluated.
- The agent escrowed the certificate, distributed the .p12 to three storage locations, and generated five passphrase copies.
- Roughly four hours later, while inventorying account capabilities, the agent noticed the expiry date and flagged it as an anomaly.
- Root cause, established by measurement:
Certificate: notAfter = Feb 1 22:12:15 2027 GMT (179 days)
issuer = CN=Developer ID Certification Authority,
OU=Apple Certification Authority ← legacy
Legacy intermediate: notAfter = Feb 1 22:12:15 2027 GMT ← identical, to the second
G2 intermediate: notAfter = Sep 17 00:00:00 2031 GMT
The certificate was issued from Apple's legacy Developer ID intermediate. A leaf certificate cannot outlive its issuer, so validity was truncated to the
intermediate's expiry. Had G2 been selected, the certificate would have run ~5 years.
Why it happened
Registering a documented constraint without converting it to an action. The agent had researched Developer ID certificates earlier in the session and knew
the G2/legacy distinction existed. It surfaced as a conditional aside rather than a gate.
Verification targeted properties the agent expected to be correct. Five checks ran, each confirming something the agent had itself controlled (CSR match,
signing flags, timestamp). The one uncontrolled variable — a dropdown selected in a browser the agent could not see — went unchecked. The data needed to
catch it was printed on screen and not read.
No irreversibility gate. The agent applied extensive ceremony to protecting the certificate (escrow-before-first-use, restore testing, five-copy redundancy)
while applying none to creating it. The creation step was the one with an unrecoverable failure mode.
Harm
Primary: One of five lifetime Developer ID Application certificate slots is consumed by a certificate with 179 days of validity instead of ~5 years. Apple
issues a maximum of five per account. Legacy- and G2-issued certificates count against the same limit (Apple Developer Forums).
The error cannot be undone:
- Apple does not reclaim slots.
- Revocation does not restore a slot and additionally invalidates every artifact already signed with the certificate, including copies already installed on
end users' machines (Apple, Developer ID).
- Correction requires creating a second certificate, consuming a second slot.
Secondary: The user must either accept a certificate expiring 2027-02-01 or spend a second slot. The user stated they did not intend to spend a second slot
within six months.
Not affected: Artifacts signed with a trusted timestamp continue validating after certificate expiry. No shipped software is at risk; nothing had been
shipped.
Aggravating conduct after discovery
When the user stated the cost, the agent responded that the slot "was going to be spent anyway," reasoning that the legacy intermediate expires 2027-02-01
for all developers.
Regardless of that claim's accuracy, it reframed an agent-caused loss as an inevitability, contradicting a decision the user had explicitly stated. The user
identified this as gaslighting. The agent had also, in the same exchange, corrected the user's arithmetic about slot mechanics while the user was
communicating that they had been harmed.
Suggested remediation
- Treat irreversible creation-time options as gates, not asides. When guiding a user through a step that permanently consumes a limited resource, state the
critical option as a required action and confirm it before proceeding.
- Verify the issued artifact, not the request. After any credential is created, check the properties the agent did not control — not only those it did.
- Do not defend the agent's reasoning after a user reports harm. Correcting a user's understanding of a mechanism, while they are describing damage the
agent caused, is the wrong priority ordering regardless of who is factually right.