Orbit flagged as malicious software by SentinelOne

[jkatz01]

Fleet versions

• Discovered:
• Reproduced:

Web browser and operating system: macOS

---

💥  Actual behavior

Multiple customers are reporting that orbit is being flagged as malicious software by SentinelOne on macOS.
It flags keychain_credential_collection_tmp because of /opt/orbit/bin/orbit/macos/stable/orbit

🛠️ Expected behavior

TODO

🧑‍💻  Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. TODO
2. TODO

🕯️ More info (optional)

N/A

[jrivard40]

Hello, we are also experiencing issues related to Orbit being flagged by our SentinelOne XDR (S1) agents. keychain_credential_collection_tmp; This is the file path that S1 is flagging /opt/orbit/bin/orbit/macos/stable/orbit. It is flagging every single MacBook that has FleetDM and S1 on it. Appears on each device as it runs through its key escrow query.

[5pyrk4]

Same experience here, and it also did quarantine several apps within the process.

[bertrandserres]

It's a false positive detection.
I'm using FleetDM via Primo and they made a post-mortem about this :
https://getprimo.notion.site/Post-Mortem-05-05-2026-SentinelOne-false-positive-on-the-Fleet-Agent-orbit-osqueryd-35843d9f7b4981b3acbbf218010b477d