Mac Says a Plugin Is Damaged and Can't Be Opened: What It Means

What does "is damaged and can't be opened" mean for a plugin?

It means macOS refused to load the plugin because its security checks failed. Apple says this alert appears when macOS detects that software has been modified or damaged, and that the app "might be broken or corrupted, or it might have been tampered with"^[1].

The word "damaged" is misleading in a lot of real cases. Plugin developers who document this error explain that the file is often intact, and that the usual trigger is a downloaded plugin carrying the quarantine flag without a valid signature and notarization^[2]. But "often" is not "always". The same message covers a truncated download and a plugin someone has patched to remove copy protection. Your job is to work out which of those you are looking at before you change anything.

How do Gatekeeper and notarization check plugins?

Gatekeeper checks every downloaded app, plugin and installer package for an identified developer signature, Apple notarization, and signs of tampering. Apple's Platform Security guide states that when a user opens software from outside the App Store, including a plug-in, Gatekeeper verifies it "is from an identified developer, is notarized by Apple to be free of known malicious content, and hasn't been altered"^[3].

Notarization is Apple's automated malware scan of a developer's signed software. Apple's support article says macOS Catalina and later require notarization by default, and that a notarized app is one Apple checked for malicious software without finding any^[1]. Files you download get a quarantine flag stored as an extended attribute called com.apple.quarantine^[4], and that flag is what prompts Gatekeeper to run its checks.

What changed in macOS Sequoia

Older guides tell you to Control-click and choose Open. That no longer works. Apple announced that in macOS Sequoia users can't Control-click to override Gatekeeper for software that isn't signed correctly or notarized; they have to go to System Settings > Privacy & Security to review it^[5]. Plugins complicate this further, because a .component or .vst3 is loaded by your DAW rather than opened by you, so an Open Anyway button often never appears for it^[2].

First question: where did this plugin come from?

The source of the file decides everything else. A plugin downloaded from its developer's own website is worth troubleshooting; a "free" copy of a paid plugin from a forum, torrent or file locker should be deleted, not fixed.

Cracked plugins trigger this exact error because patching the binary breaks its signature, and a broken signature is precisely what Gatekeeper is designed to catch. Apple also notes that Gatekeeper protects against malicious plug-ins distributed alongside benign apps^[3]. Removing the quarantine flag from a tampered plugin tells your Mac to trust code nobody can vouch for, running inside a DAW that has access to your whole project folder.

• Official download from the developer Worth fixing. Work through the safe checks below, then contact the developer if they fail.
• Free plugin from a known developer's own site Worth fixing. Small developers sometimes skip notarization, which is the most common cause of the error.
• Paid plugin from anywhere other than the developer or an authorized store Delete it. There is no safe way to trust a modified binary, and no fix in this guide applies.
• macOS says it will damage your computer Leave it in the Trash. That alert is reserved for known malware or revoked signatures.

Safe checks to run before you override anything

Rule out a bad download and confirm who signed the plugin before touching security settings. These steps change nothing on your system, and they often solve the problem outright.

1. Delete and re-download
   Remove the plugin, empty the Trash, and download a fresh copy from the developer's official page. A corrupted transfer produces the same message, and a clean copy fixes it.
2. Check for a newer, notarized build
   Read the developer's download page or changelog for your macOS version. If you are on Apple Silicon, also confirm the plugin runs natively; the Apple Silicon plugin compatibility guide shows how to check.
3. Read the signature
   Run codesign -d -vvv on the plugin; Authority lines show the certificate chain^[6]. Look for Developer ID Application and the right company. "Code object is not signed at all" means you rely on trust alone.
4. Verify it hasn't been altered
   Run codesign --verify --deep --strict --verbose=2: a correctly signed bundle reports "valid on disk" and "satisfies its Designated Requirement"^[6]. A signed plugin that fails was modified after signing, a red flag.
5. Assess the installer
   If the plugin came as a .pkg, run spctl --assess --type install on the package. An exit status of 0 means Gatekeeper accepts it^[6].

Use Apple's Open Anyway button and your DAW's rescan first

For an installer or standalone app from a source you trust, Apple's supported path is System Settings > Privacy & Security > Open Anyway. Apple's steps are to try opening the software, click Open Anyway, then confirm with Open, after which macOS saves it as an exception^[1]. Apple frames this as an option only when you are "certain" the software is from a trustworthy source and hasn't been tampered with.

In Logic Pro, open Settings > Plug-in Manager. If the Compatibility column says "failed validation", select the plugin and click Reset & Rescan Selection. If it fails again, Apple's advice is to check with the manufacturer about compatibility with your macOS version and possible updates^[7]. If the plugin simply isn't listed, the problem may be the folder rather than security; the VST plugin not showing in your DAW checklist covers paths and rescans.

How to clear quarantine on a trusted developer's plugin

If a plugin from a developer you know passes the signature checks, or the developer's own support page tells you to do this, you can remove the quarantine flag from that one plugin. This is a last step for legitimate software, not a general fix.

Security warning: removing com.apple.quarantine stops Gatekeeper from reviewing that file. Only do it for software you downloaded yourself from the developer's official site. Never do it for cracked, "unlocked" or repackaged plugins, and never for anything macOS has flagged as malware. The ss64 reference for xattr makes the same point: remove the quarantine bit only for files from a known, trusted source^[8].

1. Find the plugin file
   Shared Audio Units live in /Library/Audio/Plug-Ins/Components and VST3s in /Library/Audio/Plug-Ins/VST3. The plugin folder paths guide lists every location.
2. Check that quarantine is actually set
   Run xattr followed by the plugin path. If com.apple.quarantine isn't in the list, quarantine is not your problem and removing it does nothing.
3. Remove only the quarantine attribute
   Run sudo xattr -dr com.apple.quarantine on the plugin. Here -d deletes the attribute and -r recurses through the bundle^[8]. Only shared /Library plugins need sudo^[2].
4. Rescan in your DAW
   Quit and reopen the DAW. In Logic, use Reset & Rescan Selection in the Plug-in Manager.

Why -dr instead of -cr

Some vendor support pages give xattr -cr instead; ADSR's instructions for its Dark Kalimba instrument are one example^[9]. The -c flag clears every extended attribute on the files, while -d com.apple.quarantine removes just the one Gatekeeper reads^[8]. Follow the developer's instructions when they give them; otherwise use the narrower command. Neither turns off Gatekeeper for anything else, and you should never run either one on an entire Plug-Ins folder.

What to do if the plugin still won't open

Contact the developer. Apple's own advice for software it can't check is to contact the app developer and look for an updated version or an alternative^[1]. Send your macOS version, your Mac's chip, the DAW version, the exact alert text, and the output of the codesign commands above. That gives a developer enough to tell whether their build or your install is at fault.

While you wait, a free plugin that is already signed and notarized is often the quicker route; the free VST and AU plugins for Logic Pro roundup is a good place to look. If you are installing a fresh batch, follow the step-by-step plugin install guide so each file lands in the right folder the first time.