macOS 27 beta (26A5406e): XProtect kills desktop-app-hosted sessions as "scripted malware execution"; pasting into app then blocked

Environment: macOS 27.0 beta 26A5406e (arm64, Mac17,9), Claude Code 2.1.229, desktop app 1.28929.0.

Symptom: Desktop-app-hosted Claude Code sessions die ~30s–3min after start with the macOS "Malicious Script Blocked" dialog. Unified log shows:

xprotectd: Killing container due to rules engine deny
xprotectd: Prompting user about blocked scripted malware execution

Correlating pids that exit at the exact kill timestamp, the killed process is the Claude Code CLI itself (proc name reports as the version string, "2.1.229"). At kill time it held live connections to secd (Keychain — reading its OAuth credential via SecItemCopyMatching) and pboard (pasteboard), and was spawning shell snapshots — this combination appears to match a stealer behavioral rule in the beta's new real-time script scanner.

After a kill, pasting into the desktop app is also denied:

xprotectd [Monitor] paste denied (cached block)
xprotectd: Prompting user about blocked paste event

The paste block targets the flagged app's container (not clipboard content), re-seeds on every new kill, and survives reboot.

Repro: resume any conversation in the desktop app on this beta; the session is killed within minutes. Reproduced 3x on 2026-08-13 (16:22, 16:47, 16:57 EDT).

Workaround: the same session resumed via claude --resume <id> from Terminal runs indefinitely without being flagged (hours of heavy Bash use, same version, same Keychain login). Only desktop-app-hosted sessions are killed.

Also noteworthy: xprotectd blew past its own CPU limit scanning developer shell activity (xprotectd ... cpu_resource.diag, 56% CPU avg over 161s, heaviest stack in Regex.firstMatch via an EndpointSecurity client) — the scanner appears to struggle with heavy dev-tool shell workloads generally.

Ask: coordinate with Apple on the signing/entitlement context for the desktop-hosted CLI so its normal startup (Keychain OAuth read + pasteboard access + shell-snapshot spawn) doesn't match stealer heuristics on macOS 26/27. A corresponding Feedback Assistant report is being filed from this machine.