The xprotect check command errors out on macOS, hiding XProtect updates (August 20, 2026)
Chapters
TL;DR
The xprotect command line tool, the documented way to ask a Mac whether a newer XProtect is available from iCloud, returns an error instead of an answer, consistently on the macOS 27 Golden Gate betas and intermittently on shipping macOS releases, according to The Eclectic Light Company on August 20, 2026. XProtect itself still updates while the check reports failure, so this is a diagnostic defect rather than a security hole. Apple has acknowledged nothing and no fix has shipped.
- xprotect check can return an error, and does so consistently on the macOS 27 Golden Gate betas.
- The effect is that you cannot confirm whether an XProtect update is pending from the command line.
- Since macOS Sequoia there are two XProtect copies in different locations, updated by different mechanisms.
- The two copies can end up on different versions, with only the older location updatable for a period.
- The workaround costs you scripted and fleet-wide checking and pushes you onto a graphical pane or a third-party tool.
What the command is supposed to do
XProtect is the malware detection data macOS ships and updates on its own, and the xprotect command, introduced in macOS Sequoia, is how you are supposed to interrogate it. Running sudo xprotect check asks whether a newer version is available from iCloud.
The Eclectic Light Company reports that this command "can sometimes return an error, and has consistently done so in Golden Gate betas, making it impossible to check whether an update is available from iCloud". So the one question the tool exists to answer is the question it will not answer.
The companion command has drifted as well. sudo xprotect update "has at times used any update already installed in the original location to install that to the new location, but doesn't appear to do so currently, at least in some versions of macOS".
Two copies of XProtect, two update mechanisms
The reason this is confusing rather than merely broken is the split introduced in macOS Sequoia. From Sequoia onwards a Mac carries two separate XProtect copies, in different locations, updated by different mechanisms.
That creates a window where, in the author's words, "there may be a period in which the only XProtect that can be updated is in the old location. That can leave a Mac with the two copies using different versions." So asking "is my XProtect current" is not even a single question, and the command that was meant to settle it errors out.
| Command | Expected result | Observed on August 20, 2026 |
|---|---|---|
| sudo xprotect check | Says whether an update is available from iCloud | Can return an error, consistently on macOS 27 Golden Gate betas |
| sudo xprotect update | Downloads and installs a pending update | Works, but no longer reuses an update already installed in the original location |
| softwareupdate | Updates the copy in the old location | Recommended route, alongside the SilentKnight utility |
What this breaks and what it does not
Be clear about the severity. Malware detection data still reaches the Mac, and the update mechanism itself works. What you lose is the ability to verify, which matters most to the people who have to answer for a lot of Macs: no reliable scripted check means no reliable fleet-wide report.
There is a record-keeping problem inside that. If the command cannot tell you whether an update is pending, then a clean answer proves nothing and an error proves nothing either, and you are back to comparing installed version numbers by hand across every Mac you look after.
As of August 20, 2026 there is no Apple support note, no acknowledgement and no fix. The behaviour is documented by one independent author on this day, which is the whole published state of it.
August 20 was otherwise quiet on macOS
I will say plainly that this was a thin day and that this pick is a diagnostic defect rather than a crash or a data-loss bug. The 9to5Mac items for August 20, 2026 were a MacBook Ultra feature piece and a ChatGPT update adding Apple Messages integration on the Mac, with no article on macOS bugs, security flaws or system updates. No Apple release landed that day either.
I would rather report a small real defect that has a named source and a date than inflate a rumour piece into a bug report. If you administer Macs, this one is worth knowing about precisely because it is quiet: the command does not fail loudly, it just stops being evidence.
What to do today
This is the sequence the August 20, 2026 write-up recommends, in order.
1. Use the SilentKnight utility or the softwareupdate command tool to detect, download and install updates to the copy in the old location.
2. With that done, run sudo xprotect check in Terminal.
3. If it reports that a new version is available from iCloud, run sudo xprotect update to download and install it.
4. If the check returns an error, ignore the error and run sudo xprotect update anyway. That is the documented advice, and on the Golden Gate betas the error is what you should expect.
5. Verify the installed XProtect version in System Information, under Installations, rather than trusting the check, and accept the cost: no scripted verification, and a third-party tool or a manual look in place of one command. For a managed Mac estate, that is the awkward part.
Frequently asked questions
Does the error mean my Mac is missing malware definitions?
Not by itself. The update mechanism still works, and the error is about the check. Confirm the installed version another way rather than concluding either way from the command.