What's happening

Apple shipped macOS Tahoe 26.6 on July 27, 2026. It's a security-heavy release — over 150 CVE fixes — and, notably, Apple's own release notes mention it addresses bugs and security issues and also optimizes the Spotlight index in preparation for macOS 27

Almost immediately after release, Mac admins started reporting that SentinelOne is misidentifying core, totally benign macOS system processes as malicious on machines running 26.6. The processes getting caught in the crossfire include:

• loginwindow — the process behind the login screen
• SystemUIServer — your menu bar
• mds / mdworker — the Spotlight indexing services

Some reports also mention the App Store getting flagged. The practical impact ranges from noisy false-positive alerts in your S1 console to genuinely disruptive behavior — degraded system stability, menu bar issues, and login screen problems — if S1 acts on the "detection" rather than just alerting on it.

The timing lines up with that Spotlight indexing change in 26.6. The working theory in the MacAdmins community is that Apple's re-optimized Spotlight index is tripping SentinelOne's ExclusionOptimizationMode, causing the agent to misclassify system-level processes it would normally leave alone.

To be clear: this is a community-reported, evolving issue, not (yet) a formal joint advisory from Apple or SentinelOne. Treat the details below as the current best understanding from the field, and keep an eye on your official SentinelOne support portal for their own guidance as it develops.

Configure Proximos to Skip Enforcement of macOS 26.6

Proximos can be configured via command-line and your MDM solution to skip enforcement of macOS 26.6 with the command:

sudo /Applications/Utilities/Proximos.app/Contents/MacOS/Proximos --skip-macosversion 26.6

The SentinelOne interim Hot Fix: a Policy Override

A fix has been circulating in the Mac Admins Slack community, credited to Kevin W, who shared how to apply it as a Policy Override in the SentinelOne management console. It disables ExclusionOptimizationMode, which appears to resolve the false positives without requiring an agent reinstall.

Steps:

1. Log into your SentinelOne console.
2. Go to Settings > Policy Overrides.
3. Click New Configuration (some console versions label this Add Override).

• Fill in the fields:Name: something identifiable — e.g. Tahoe 26.6 - Disable Exclusion Optimization
• Description: reference the support case/advisory, e.g. "PO to prevent false positives from ExclusionOptimizationMode on macOS Tahoe 26.6+"
• Version: All Versions (this refers to the SentinelOne agent version, not macOS)
• OS: macOS
• Choose a site or account

1. Set the scope (Account, Site, or Group) to match where you want this applied. Since this is tied to a specific OS rollout, consider scoping it to a Smart Group of Tahoe 26.6 machines specifically — rather than account-wide — so it's easy to pull back once SentinelOne ships a permanent fix.
2. Paste the following JSON exactly into the configuration/content field:

{"General": { "ExclusionOptimizationMode": 0 }}

1. Save to apply the rule.

A few practical notes before you roll this out

• Consider setting Apple DDM to a maximum of 26.5.2, or disabling DDM updates temporarily
• Consider disabling Apple Automatic Updates for macOS 26 devices temporarily.
• Consider setting a forced delayed updates MDM profile to macOS 26 devices to 30 or 60 days.
• SentinelOne Support has told us that a uninstall / reinstall of the SeintielOne Agent / App may be needed to accept the new policy override or exclusions.
• Pilot it first. Test on a small group of Tahoe 26.6 machines before pushing account- or site-wide. If you're managing 26.6 rollout through Jamf, you likely already have a Smart Group carved out for Tahoe/Golden Gate targeting — start there and confirm the override actually clears the false-positive behavior before going wider.
• Don't disable SentinelOne itself. This override addresses a specific detection logic setting — it's not a reason to turn off endpoint protection while you wait.
• Consider your rollout timing. If you haven't pushed 26.6 broadly yet to Macs running SentinelOne, it's worth applying the override to your target Smart Group before the update lands, rather than reacting to alerts after the fact.
• Consider setting Proximos via command line to skip macOS 26.6 with command /path/to/Proximos.app --skip-macosversion 26.6

Bottom line

macOS Tahoe 26.6 is an important security update — 150+ CVE fixes is not something to sit on for long. But if SentinelOne is part of your Mac security stack, don't roll it out fleet-wide without first applying the ExclusionOptimizationMode override above (or waiting for an official fix) and confirming your pilot group is clean.

We'll keep monitoring both Apple's and SentinelOne's official channels for a permanent resolution and update our guidance as it lands. If you manage a mixed macOS fleet and want help getting a pilot rollout and policy scoping set up correctly, that's exactly the kind of thing Enlazo can take off your plate.