In my case the automator started on its own after I shared some audio files via Airdrop to another account of my own, on another iPhone.
I got really scared as such things never ever happened on my macbook, then the Safari started behaving strangely so I concluded the Apple AI or Siri is doing something I didn't ask for.
In my case I have a share to kindle automatisation, maybe the Airdrop feature triggered the process.
The process was asking for access to my Documents and I chose don't allow, it started right after sharing via Airdrop. It behaved like something had its own instructions regarding the access to files. I investigated the rogue process and nothing seemed to have launch it. So the conclusion was there is something in the system running in the background without me being able to find it, like a virus.
2026-11-02 18:31:33.661 Df com.apple.automator.runner[61397:446a01] [com.apple.launchservices:open] LAUNCH: Asking CSUI to launch 0 items
2026-11-02 18:31:33.742 Df com.apple.automator.runner[61397:4469fd] [com.apple.xpc:connection] [0x7974dab700] activating connection: mach=true listener=false peer=false name=com.apple.ProgressReporting
2026-11-02 18:31:43.508 Df WorkflowServiceRunner[61394:446ca2] [com.apple.launchservices:db] NotifyToken::RegisterDispatch(user.uid.501.com.apple.LaunchServices.database) fired for session key <private>
2026-11-02 18:31:43.508 Df com.apple.automator.runner[61397:4469fe] [com.apple.launchservices:db] NotifyToken::RegisterDispatch(user.uid.501.com.apple.LaunchServices.database) fired for session key <private>
2026-11-02 18:36:32.532 Df WorkflowServiceRunner[61394:446984] [com.apple.AppKit:AutomaticTermination] void _NSEnableAutomaticTerminationAndLog(NSString *) No windows open yet
2026-11-02 18:36:33.123 Df com.apple.automator.runner[61397:4469fd] [com.apple.AppKit:AutomaticTermination] void _NSEnableAutomaticTerminationAndLog(NSString *) No windows open yet
macbook@___ ~ % log show --last 30m --style compact \
--predicate 'subsystem == "com.apple.TCC"' \
2>/dev/null | grep -Ei 'WorkflowServiceRunner|automator|Documents|SystemPolicyDocumentsFolder' | tail -30