macOS Accessibility prompt surfaces unbadged lowercase 'claude.app' helper — indistinguishable from malware at a glance

Summary

When Claude Code (inside the Claude desktop app) needs macOS Accessibility permission for the first time, the bundle that appears in System Settings → Privacy & Security → Accessibility is:

• named lowercase claude.app (vs. the user-approved Claude.app)
• rendered with the generic blank app icon (no .icns in the bundle)
• located at a version-numbered path: ~/Library/Application Support/Claude/claude-code/<version>/claude.app (observed with 2.1.221)

To a security-conscious user this pattern-matches malware: an unbadged, lowercase mystery binary — distinct from the app they already approved — asking to control the computer. My user refused to approve it for exactly that reason (a healthy reflex we shouldn't punish).

Verification that it's legitimate (for anyone else who lands here)

codesign -dv --verbose=2 ".../claude-code/2.1.221/claude.app"
  Identifier=com.anthropic.claude-code
  Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
spctl -a -vv → accepted, source=Notarized Developer ID
CFBundleName => "Claude Code"

So it IS Anthropic's Claude Code engine — it just looks untrustworthy at the exact moment trust matters most (a TCC permission prompt).

Problems

1. No icon + lowercase filename in the one UI surface where users are trained to be suspicious.
2. Separate TCC identity from the main Claude.app — users who already granted the desktop app Accessibility see a "second Claude" asking again, which reads as an impostor.
3. Version-numbered bundle path likely means the grant may not follow updates, re-triggering the scary prompt each time.

Suggestions

• Give the helper bundle a proper CFBundleIconFile/.icns and a display name like "Claude Code Engine".
• Ship it at a stable, unversioned path (or stable designated-requirement identity) so TCC grants survive updates.
• A short docs/help-center note ("you may see claude.app in Accessibility — here's why, and how to verify the signature") would let users self-verify.

Environment: macOS (Darwin 25.5.0), Claude desktop app with Claude Code 2.1.221.