The active window on my machine occasionally loses focus. The active app remains the same -- if I was in Chrome before, I'm still in Chrome now -- but the active window is no longer active. No window is active. This is frustrating; it happened while typing this question, and my keystrokes suddenly stopped registering.

I believe that some other app is stealing focus, but that it itself has no UI to display, so the active window becomes not active, but the active app remains active.

The question is: How do I track down the offending app, so that I can angrily delete it? Normally in cases of focus theft, the culprit is obvious, because it has focus. In this case, I'm stumped.

  • You could try the Apple > Force Quit... menu to see if there is anything running that shouldn't be. Mar 26, 2014 at 21:18
  • 1
    @MichaelFrank It won't show applications that have no menu bar (e.g. those with LSUIElement set to true in Info.plist). Those are perfectly capable of that behavior.
    – Daniel Beck
    Mar 27, 2014 at 0:08
  • @DanielBeck Ahh, gotcha. That's handy to know. Mar 27, 2014 at 0:09
  • 1
    FYI, I asked basically this same question on Apple SE: Is there a way to detect what program is stealing focus on my Mac?
    – Kevin Reid
    Mar 27, 2014 at 0:12
  • tell application "System Events" to display alert ((name of first application process whose frontmost is true) as string) unfortunately does not consider processes without menu bar.
    – Daniel Beck
    Mar 27, 2014 at 0:15

2 Answers 2


Here's a script that will tell you which app is activating without telling you. I adapted it from an answer to @KevinReid's question over on Apple SE.

Leave it running in a terminal, wait for the rogue app to steal focus, and see which app is listed last. (For me: Google Drive. Others have reported Symantec AV stuff.)


    from AppKit import NSWorkspace
except ImportError:
    print("Can't import AppKit -- maybe you're running python from brew?")
    print("Try running with Apple's /usr/bin/python instead.")

from datetime import datetime
from time import sleep

last_active_name = None
while True:
    active_app = NSWorkspace.sharedWorkspace().activeApplication()
    if active_app['NSApplicationName'] != last_active_name:
        last_active_name = active_app['NSApplicationName']
        print('%s: %s [%s]' % (
            datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
  • This script tells me my culprit is Google Drive [/Applications/Google Drive.app]
    – MarkHu
    Apr 6, 2015 at 19:58
  • The culprit for me ended up being Symantec. Jun 19, 2015 at 21:29
  • 1
    In my case it is SecurityAgent [/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle]
    – Ed Randall
    Mar 9, 2018 at 12:53
  • 2
    My culprit was JetBrains Toolbox [/Applications/JetBrains Toolbox.app/Contents/jetbrains-toolbox-cef.app], was trying to update itself and crashing in the process. Thank you sooooooo much!! It was also consuming a huge amount of resources.
    – Gabriel
    Mar 22, 2019 at 11:00
  • 2
    Thank you so much for the script. In my case it was Corel's updater (CUH.app). More on this.
    – Dae
    Mar 26, 2021 at 13:17

This will sound silly and absurdly simple... I had the same problem with my laptop when I used the trackpad or built in keyboard. Had two separate laptops give similar experiences after being exposed to a bit of moisture (yes, I spilled on the keyboard).

Adding peripheral mouse and keyboard resolved it for me.

  • 1
    Interesting. I use an external mouse and keyboard, but hopefully this helps someone else. Thanks. Sep 17, 2014 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.