I am getting this too when clearing the search field for a table in a macOS app built with SwiftUI. My code is very similar to the OP's code. I have a MainActor class that is an @ObservableObject (I create a singleton of it) holding a Deque of data that is @Published. I have a computed property that returns a filtered Deque (from the published Deque), and that what is used to populate the table. The table has a .searchable(text:) modifier. I get the alert when I clear the search field.

Adding a note in case someone (or the future version of me) runs across this in the future. Apple binaries (at least as of macOS 13.2.1) have an empty team_id.

I just got it working but for logging only. I'm not trying to stop any flows at the moment. It took a while to get all the names right (e.g., NEMachServiceName, AppGroups, etc.). I have no filter rules, so my extension gets every flow. My extension does not send messages to the user app. I set up startFilter to look like this: override func startFilter(completionHandler: @escaping (Error?) -> Void) { completionHandler(nil) } and then handleFlow to look like this override func handleNewFlow(_ flow: NEFilterFlow) -> NEFilterNewFlowVerdict { if let socketFlow = flow as? NEFilterSocketFlow, let remoteEndpoint = socketFlow.remoteEndpoint, let localEndpoint = socketFlow.localEndpoint { os_log("Flow local endpoint %{public}@, remote endpoint %{public}@", localEndpoint, remoteEndpoint) } else { os_log("Flow (unknown)") } return .allow() } Then I use the Console app to watch all the log messages. I also set a filter string, SimpleFirewall, in the console app to keep an eye on just my stuff. Side note: in the os_log() call, use %{public}@, not just %@. My next step will be to send messages to the user app.

Follow up: I've found two additional ways to allow the third app to connect to the endpoint system extension over XPC: Add the "System Extension" capability/entitlement to the app (even though this doesn't install a System Extension, it just received data from it); note, this changes the Signing Certificate from "Development" to "Apple Development: (my development identity info)" Change Signing Certificate to "Sign to Run Locally" If I do either of those, I can remove the temporary entitlement com.apple.security.temporary-exception.mach-lookup.global-name entitlement (I look forward to getting the endpoint security entitlement to see what issues go away and which ones remain (and to enable security on my laptop again)) Thanks