“Unknown” pops up wanting to find devices every time computer starts

I traced this to Xcode and having intelligence turned on

To fix it launch Xcode

then settings-> intelligence -> set Allow External Agents to Use Xcode Tools to Never

The "Allow 'unknown' to find 'devices' on local networks" prompt is a macOS privacy security feature asking for permission for an unnamed app, background service, or newly connected peripheral to scan your Wi-Fi network for other gadgets.

What is this prompt?

• Local Network Privacy: Introduced in recent macOS versions, Apple requires apps or background processes to get your explicit permission before they can see or interact with other devices on your home Wi-Fi network (like printers, speakers, or phones).
• Why it says "Unknown": This usually happens when an unverified background daemon, a freshly updated third-party utility, a command-line tool, or a misidentified app tries to access the network before macOS fully resolves its proper display name or code signature. It can also trigger due to a temporary preference glitch after a major OS update.

How to Fix It

You can manage and clear these prompts by adjusting your Mac's privacy settings:

• Check Network Permissions:

1. 1. Open System Settings on your Mac.
   2. Click Privacy & Security in the sidebar.
   3. Click Local Network on the right side.
   4. Look through the list of apps and services. Turn off any unrecognized, suspicious, or "unknown" entries that are toggled on.

• Reset Network Preferences: If the ghost prompt keeps looping at startup, resetting your Mac's network plist files or restarting your system router often clears out lingering authorization caches.
• Update Software: Ensure both your Mac and iPhone are completely up to date, as Apple frequently patches minor authorization bugs in subsequent point releases.

More info: Change Privacy & Security settings on Mac - Apple Support

Post the free EtreCheck report using the Additional Text option when posting. The report contains no personal information. We can then suggest which apps to remove along with the launch process to test if that prompt goes away.

How to use the Add Text Feature When Post… - Apple Community

or

If you do see an unknown process at  > System Settings > Privacy & Security > Local Network, you can Control-Click it and choose Show in Finder. That may help to identify which app it is linked to. In any case, if that app has installed a Launch Process, the EtreCheck report is still useful to tell you exactly where it is for removal of that too, which may not be removed by simply dragging the app to the trash.

Mike Naylor wrote:

Some people say EtreCheck is malware, so I'm not prepared to download it.

Are you, Mac Jim ID, an Apple employee?

No, none of us here are Apple employees. If you want to talk to an Apple employee you would have to use this link:

Contact Apple Support - Apple Support

No, EtreCheck is not malware. With the moderation of this website, you would not see links posted here to download malware, and specifically a User Tip that was created by a respected Level 10 user for the instructions to post the report which contains no personal information.

You either have a process in your Launch Folders that is Not Signed or an app that contains an incomplete plist file where the Developer did not provide a name for the app to allow access to the Local Network. This could be from a much older install of software that was either migrated when another computer was set up, or an update of that software that did not remove the older unsigned process.

The EtreCheck report would identify Unsigned processes you have installed and which Launch folder it resides in, but you can manually uninstall each package one at a time and verify that the associated Launch process is also removed. You would need to continue and do this until you have successfully found the one that when removed from the Launch folder no longer displays the message on logout. Open a Finder window, choose the Go option in the menu bar and then select Go to Folder. In the text box copy/paste each of these locations to view the processes. Don't forget the "~" character in the last one. The problematic process may be in 1 or more of the 3 different Launch folders.

/Library/LaunchDaemons

/Library/LaunchAgents

~/Library/LaunchAgents

Mike Naylor wrote:

I didn't intend to insult anyone

You literally called me a malware developer. Is that not an insult?

only wished to know who I was talking to.

But the way you said it immediately made me think that you might be a certain malicious stalker. He's primarily the one who's been telling anyone he can find on the internet that I'm a malware developer for the past 10 years.

However, your posting history suggests that you aren't said stalker.

I'm always security conscious

You are not.

and not one of those who downloads everything they can find.

Clearly not true.

So what next could I try? Is there a free malware scanner I could run?

I don't know if you have malware installed or not. The only way Mac users get malware is by installing it on purpose. Usually they are installing a pirate version of some expensive app. Or perhaps they installed their malware trying to watch some paid video stream or sporting event. But in all these cases, they will have to purposefully bypass multiple layers of Apple malware protection. If you didn't do this, then you don't have any malware.

This thread was started by someone reporting a well-known problem with local networks. You said you also experienced this problem, but attributed it to your attempts to access a malicious website. Most likely, the operating system kept you well-protected and the worst you experienced was a fake pop-up message trying to get you install, ahem... some "clean up" app.

If you're still interested in solving the "local network" issue, the cause is one or more of those apps you've downloaded. Certain popular apps are neither built, nor updated, correctly. This problem has been reported to the developers of those apps, but they've dismissed those reports, choosing to simply blame Apple instead. So here we are.

Certainly Google Chrome or any variation is the top offender here. But because everyone wants to be like Google, their incorrect build practices are being copied by other apps. So if you have Chrome or some variant installed, it could be that. Or it could be some other app. If you look in System Settings > Privacy & Security > Local network, anything you see that is, or has been, duplicated will be the cause.

Every user has those 3 Launch Folders, but instead of using the Finder to view them with the clear steps to follow, you resorted to Terminal where that resulted in the last one not being found. I do suspect you have User Launch Agents running on your computer, but it is now unknown.

The EtreCheck report is the best approach to see what is running on your computer, but you have chosen not to use that which then becomes a much longer back and forth of screenshots and further steps to take. You seem to be concerned about being banned with your post, but don't you think a user that created software that is recommended here would be banned if that software was Malware, and also the user who created the User Tip for the steps to take to post that report on this website.

BitDefender is useless. Expect to find many files it flags and false positives. They really want you to subscribe to their service and claim that doing that will solve your problems. It won't.

If you don't want to follow any of the recommendations here, then contact Apple directly or schedule an appointment at the Apple Store.

Contact Apple Support - Apple Support

Mac Jim ID wrote:

Every user has those 3 Launch Folders

The one in the user's home folder only exists if there are launchd config files there.

All of these folders are obsolete. The modern way to implement launch agents and launch daemons is inside an app bundle. So just because there aren't any files there, doesn't mean there aren't any launch agents.

The EtreCheck report is the best approach to see what is running on your computer

But it's not going to help in this case.

This is a well-known bug with certain 3rd party apps. There's no way to fix it except for uninstalling those apps. Apple support can't help either.

The malware concerns are just standard internet-fuelled paranoia. There's nothing that anyone can do about any of this.

To się wyświetla tylko na kontach zalogowanych w iCloud, po reinstalacji systemu błąd nie znika, w moim przypadku cofnięcie do poprzedniego systemu Tahoe pomogło. Męczyłem temat ze wszystkimi AI ale nic nie pomogło, więc proponuję cofnąć się do 26 Tahoe

This is happening to me, but only when I log out. I first noticed this after updating from Tahoe to 27.0.0, but have since updated to 27.0.1. One possible cause is when I followed a google link to a website with an insecure warning. I declined, but the speaker bleeped and a very brief notification message appeared. The only word I was able to catch was "malware". I've been unable to isolate the cause.

Mike Naylor wrote:

This is happening to me, but only when I log out. I first noticed this after updating from Tahoe to 27.0.0, but have since updated to 27.0.1. One possible cause is when I followed a google link to a website with an insecure warning. I declined, but the speaker bleeped and a very brief notification message appeared. The only word I was able to catch was "malware". I've been unable to isolate the cause.

Please follow the steps that have been provided and either let us know what you see at your Local Networks settings if your message is the same as the OP you replied to or post the EtreCheck report using the instructions in the proved link.

The message box says:

Allow "<unknown>" to find devices on local networks?

The message box appears after logging out.

Privacy & Security -> Local Network:

Visual Studio Code.app

Visual Studio Code.app

Arduino IDE.app

BambooStudio.app

It seems odd that Visual Studio Code.app appears twice. Both point to the same app location and clicking either toggles the other.

Some people say EtreCheck is malware, so I'm not prepared to download it.

Are you, Mac Jim ID, an Apple employee?

Mike Naylor wrote:

Some people say EtreCheck is malware, so I'm not prepared to download it.

Some people? Friends of yours?

No need to worry. EtreCheck won't help with this problem. Let's just say that you've been downloading too much as it is. 😄

Thank you for responding. I didn't intend to insult anyone, but only wished to know who I was talking to. I'm always security conscious and not one of those who downloads everything they can find.

/Library/LaunchDaemons contains:

-rw-r--r--  1 root  wheel  599 May 20 14:05 com.nektony.ACUpdaterHelper.plist

/Library/LaunchAgents is empty

~/Library/LaunchAgents is not a file or directory

nektony: refers to my paid copy of App Cleaner & Uninstaller.app, so I uninstalled it using their recommended "remove" method. It also removed the plist file. Restarted and logged out - with the same "Unknown" message as before. Next I reinstalling App Cleaner & Uninstaller - this time the plist has not reappeared.

So what next could I try? Is there a free malware scanner I could run?

So what next could I try? Is there a free malware scanner I could run?

You already have a free one running.

So, who are the "some people?" I'm beginning to think they are just the security voices in your head.

I had no idea who the developer of EtreCheck was and neither had I heard of it until it was recommended here. My first computer was a Commodore PET, one of the first imported to the UK, and I've been writing software ever since. I've never used pirated software, music, videos or images - even when I used Windows for a number of years. Furthermore, I've always used the official browsers and email clients, so when you say "You are not" and "Clearly not true", you are completely wrong. Oh, and my "somebody" comment came from a Google search using the "EtreCheck" and "malware" keywords - try it for yourself. So now you know, I'm security conscious and suspicious of anything recommended by someone I don't know and think your attitude is agressive and arrogant.

That said, and getting back to the topic, I'm currently running a Bitdefender Deep System Scan. It's taking a very long time, because its also scanning the Time Machine. This isn't because I'm blaming Apple, but because the hackers are always one step ahead. My only ground for suspecting malware is for what happened when I clicked on one of links Google came up with when I was searching for a better photo catalog than what I currently have - something like Apple had back in the day.

The link took me to a black screen with the standard Apple alert waring the webpage would not be secure. Simultaneously, a small white text box with black text flashed up in or near the top right of the tab bar, accompanied by a loud tone of about 3kHz. Both vanished after a few hundred milliseconds. During some of the black text contained the word "Malware". Naturally, I chose not to open the page and closed Safari.

Then followed panic and prayer. Shutdown, reboot, search for reported incidents, etc. and blah, blah blah. But during this phase I logged out (something I rarely do) and was presented with the "Allow "<unknown>" to find devices on local networks?" message box.

One other thing I haven't mentioned is the occasional display flickering, which may or may not be relevant.

The apps listed in System Settings->Privacy & Security->Local Network

Visual Studio Code.app

Visual Studio Code.app

Arduino IDE.app

BambuStudio.app

I suspect this page is not behaving correctly. When first entered I have all the switches set to the right, but the colour is grey. Clicking any switch changes the colour to blue, but they revert to grey after about one second. Also, the 2 Visual Studio switches (why 2?) operate together. However, I have tried setting all the swipes to the left, but this hasn't affected the log out message happening.

Regarding the recommendation to post screenshots. There is no point, because both folders are empty - in the finder and from the command line.

I'll report back here when Bitdefender is done - if I haven't been banned by then.