Popups from "searchuploadworker." Legitimate or not?

Download and run EtreCheck. Then post the results here. The reports are usually pretty long and won't fit in a single response box. Use the Additional text icon on the bar below (between the chain link and landscape image icons when typing a response) to paste the output into.

EtreCheck is written and maintained by fellow forum user, etresoft. The app automatically removes all personal information from the report. It's also free to use. You'll see buttons to purchase, but that's only if you want the extra features in the paid version.

From the report, we may be able to spot what's installed that's causing the message to appear.

The evidence in your EtreCheck report points strongly toward searchuploadworker being a legitimate component of macOS 27.0, not malware. Gemini’s conclusion that the pop-up itself means malware is not supported by the evidence.

The important clue is that current macOS 27 system files include both:

SearchUploadWorker.appex

SafariSearchUploadWorker.appex

inside /System/Library/ExtensionKit/Extensions/. Independent inspection of the macOS 27 filesystem identifies both as Apple system components. (GitHub)

That also fits the rest of your EtreCheck report unusually well. You installed macOS 27.0 on September 15, 2026, and shortly afterward EtreCheck recorded substantial activity involving Apple's search infrastructure: hybridsearchd, spotlightknowledged, spotlightknowledged.updater, knowledge-agent, and knowledgeconstructiond.

The name SearchUploadWorker is therefore quite consistent with the new search/Spotlight-related components introduced with macOS 27. In fact, the filesystem evidence specifically places it alongside Apple's other search extensions. (GitHub)

What the Keychain message means

The wording:

“searchuploadworker wants to export key ‘xxxx’ from your keychain”

does not, by itself, mean that the process is stealing your key.

macOS Keychain Access deliberately asks for authorization when a process attempts to use a protected cryptographic key. Similar legitimate macOS prompts occur with browsers, networking software, device-management software and other Apple/system services. For example, Apple Community reports show legitimate system processes such as nsurlsessiondproducing the same type of “wants to export key” prompt. (Apple Communities)

Likewise, the wording:

“wants to sign in using key ‘xxxx’”

means that the process is requesting use of a private key for authentication/signing. That is a normal type of Keychain operation; the security question is which process is asking and which key it is asking to use, not simply whether the word “key” appears in the dialog.

Your EtreCheck report gives another important clue

Your report does not identify searchuploadworker as an unsigned third-party launch agent, daemon, application, kernel extension, or login item.

Instead, the report's relevant Apple search processes include:

/usr/libexec/hybridsearchd

/usr/libexec/spotlightknowledged

/usr/libexec/spotlightknowledged.updater

/usr/libexec/knowledge-agent

/System/Library/PrivateFrameworks/IntelligencePlatformCore.framework/.../knowledgeconstructiond

and all are identified as Apple components.

That matters because your report does identify numerous old or unsigned third-party components elsewhere.

For example, EtreCheck flags old AVG components, TechTool components, Livestation, MacUpdate, Citrix/GoToMeeting, old Java components, SIMBL, and various old kernel extensions.

So EtreCheck is clearly capable of finding things that deserve scrutiny. It simply doesn't associate searchuploadworkerwith those third-party items.

Conclusion which much like that of @MrHoffman

Once these types  of softwares are installed and embedded into the computer 

Start Over from Scratch 

Heavy Handed ?  - Yes 

Effective  ? - Yes 

For Apple Silicon computer >> Use Disk Utility to erase a Mac with Apple silicon.

Use the Erase All Content and Settings feature to quickly and securely erase all settings, data, and apps, while maintaining the operating system currently installed.

Always make a Time Machine Backup  before  proceeding 

Emphasis on User Account Only

If going this route - I suggest Not using Startup Assist to migrate everything back.

This will probably Re-Introduce ( any questionable Third Party Software ) back into the Operating System . 

No. My only point was that AI (once again), lies.

searchuploadworker is a valid macOS installed process. But that doesn't prove that's what's producing the message.

On the technical side, the process is a system extension component tied to Apple's unified logging or system search settings bundles in modern versions of macOS. So in general, it should never produce a message you see.

I would much more lean to having malware installed, and it is throwing out this message.

Good catch, Owl-53. Just because the message says searchuploadworker, that doesn't mean it isn't malware using an OS process name to make the user think it's legitimate.

Per the OP, I did look up that full message, and the AI response insists it's malware and is not a legitimate component of macOS. Well, that's AI showing it's making things up again, as yes, searchuploadworker is very much a component of macOS. The app itself and all of its support files are right in the System folder.

Hello!, this kind of keychain can be related with any saved data or password from your mac and this is not related with macOS or its features. ( it can be from digital certificates, passkeys, and secure credentials, or possible malware , malicious file)

It is a good idea to delete it (if the option appears) or check in the Keychain Access app to remove it, it is safe to stop or remove it

Three add-on anti-malware apps isn’t an auspicious configuration; beyond the built-in, three installed, including seemingly one mostly removed, and another partially corrupt. And an old cleaner app, and a couple of VPN apps.

This install is also most of twenty years old, too.

Given all that, I’d probably back up, back up a second time elsewhere just to be sure, reset and re-install macOS, and migrate files and documents and not apps.

searchuploadworker is a process installed by the OS. Why it's appearing is the real question.

Sorry 😩

Windows-like viruses that self-replicate and affect macOS don’t exist because of the underlying UNIX Foundation and permission limitations.

The macOS operating system resides in a sealed and read-only volume that can’t be opened by users or third-party applications.

Mac app security enhancements are sufficient to protect computers from malware.

Effective defenses against malware and other threats

Adware and Malware can affect computers and are often downloaded from “shady” websites or developers who inject them into downloads.

Source: User tip from @Kurt Lang

What is malware? - Apple Community

From a similar quest that Pre Dates the release of macOS 27 Golden Gate

I can neither verify if this process is legit in Golden Gate or Not Legit

'SearchUploadWorker' keychain password window keep appearing on my iMac

Kurt Lang wrote:

Good catch, Owl-53. Just because the message says searchuploadworker, that doesn't mean it isn't malware using an OS process name to make the user think it's legitimate.

Per the OP, I did look up that full message, and the AI response insists it's malware and is not a legitimate component of macOS. Well, that's AI showing it's making things up again, as yes, searchuploadworker is very much a component of macOS. The app itself and all of its support files are right in the System folder.

https://discussions.apple.com/content/attachment/4f8cdb7d-62af-4830-a9b6-229a0fc0cdd8

Doubly good catch my friend

🦉-53

Thanks Kurt Lang and Owl-53. I did run a virus checker and it didn't find anything. However I will continue to deny these popups. I have already restarted the machine and I'll do it again. Sometimes these things go away of their own accord. We'll see...

Don’t bring over (x’d) apps. Do open the (circled) disclosure triangle and bring over settings and files and documents and such, but not any apps that might show there.

General process during setup: Transfer to a new Mac with Migration Assistant - Apple Support

Eric Taub1 wrote:

Owl-53, thanks so much for taking the time to write this extensive analysis. I will follow your suggestions. Before I do, do you think I should accept the popups that are asking for keychain access?

Sorry but we are getting a Mixed Message

If your intent is to continue using the computer as is - then NO

If your intent is to do a Start from Scratch, the current issue may or may not exist there after

Hello. I went in Keychain access, did a search, and found nothing by the name of "searchuploadworker." Any other ideas? Thanks.

Kurt--your point is that it's therefore safe to click "always allow" when I keep on getting the popups that say "searchuploadworker wants to export key "xxxxx" from your keychain"?

Thanks very much. Here's the EtreCheck report.

Owl-53, thanks so much for taking the time to write this extensive analysis. I will follow your suggestions. Before I do, do you think I should accept the popups that are asking for keychain access?

Got it. Thanks.