Malware detection on a Mac depends on rules that arrive silently, and on one branch of the operating system that delivery has stopped working. A persistent failure is preventing Macs running current Sequoia builds from pulling new XProtect definitions into the authoritative location.
Two copies of the same defence
Gatekeeper runs XProtect over every app it launches, comparing what it finds against thousands of signatures. Since Sequoia arrived in 2024, the rules live in /var/protected/xprotect and are refreshed over iCloud. The older copy under /Library/Apple still gets updated the old way, through Software Update.
A tool called xprotect exists to reconcile the two, with options to read the installed version, query iCloud for a newer one, and pull it down. Apple has never documented how often it will do that.
Where the check breaks
On Sequoia 15.8 through 15.8.2, only the version query behaves. Asking whether an update exists returns a cache error, and forcing one reports nothing available even when Apple has published a fresh build. The same commands run cleanly on Tahoe, Golden Gate and even the older 15.6.1 release, which points at the servers rather than the Mac.
Logs show CloudKit rejecting the request with an error and a “zone does not exist” reply for the audience tagged macOS 15.8. Apple’s backend was pointed at a dataset the client cannot resolve.
What owners can do
SilentKnight still flags new signatures, and users can install the secondary copy through software update. The daemon that reconciles the two locations often completes the job a day or more later, but cannot be prodded.
The practical cost is window: between release and delivery, a Sequoia machine is running rules older than Apple intended.
