If itās a genuine bug, which it probably is, then it surely must be server-side?
And if that is the case, it raises some serious concerns in my mind. Namely that a Mac can be forced to update its OS against the userās will via a network request.
Assuming all these things are true then thatās only a cigarette paper away from malware behaviour. Hopefully Iām wrong on all counts. Watching with interest š
My thoughts exactly in regards to this issue being probably a server side bug and it raised the same concerns in my mind as to what control over my own Mac (including all my data) do I really have? And yes, this is happening.
On Friday I received the same upgrade to Sonoma notification first on my MBP and then on my iMac (both Intel) and both running the latest Ventura 13.6.3.
I x-ed the notification on MBP thinking it was strange to be receiving it in the first place and immediately went into my Software Update > Automatic updates settings to check if anything has been changed. My usual settings (that I've been using since at least Mojave if not even as far as Sierra on all my Macs) have been checked - 1. Check for updates and 5. Install Security Responses and system files. I turned off Check for updates, authenticated with Touch ID, noticed that Install Security Responses and system files got turned off as well and then enabled both again (as usual) not thinking much about it.
I continued using my MBP through out the day and around 8PM I closed all the software I was using and restarted the computer to do a TM backup. The battery level was at 18%. I usually do a restart before doing TM backups and connect MBP to a charger at the same time.
As I switched over to iMac I did not immediately notice how long the MBP was taking to restart. Once I did notice the slow progress bar, I first assumed that it was going into Safe Mode as my iMac sometimes does on cold boot, but it restarted a couple of times more and the progress bar moved to the bottom of the screen. At that point I thought maybe a security update was being applied and then after a third restart I saw "9 minutes to finish installation..." message under the progress bar and realized that the OS was being updated. Remembering that battery was low (at 18%) before the restart I quickly connected the MBP to a charger and let it be.
Sure enough after the installation finished my MBP booted in Sonoma. Needless to say I was royally pissed off.
Upon logging in, Coconutbattery and Firefox launched which was strange as I shut down all the software before the reboot and a notification to agree to the new iCloud T&Cs popped up. I x-ed the iCloud notification as I do not use it, and as I did that System Settings launched with the iCloud T&C pop up window. I tried to close System Settings but I was not able to do so. I then scrolled all the way down the T&C page to agree and accept it. Immediatelly I checked my iCloud settings which have not been changed.
I then went back to Software Update settings and before I could click on Automatic updates settings a pop up window came up with the following message, " Updates for this Mac are managed by "swscan.apple.com". Do you want to restore default update settings? Any previous updates will be removed." and gave me two options - Restore Defaults or Cancel. Not thinking fast enough I looked for my phone to take a picture (instead of doing a screen capture!) and by the time i grabbed my phone the message dissapearred without any input from me. The Automatic updates settings were the same - both 1. Check for updates and 5. Install Security Responses and system files were checked which I promptly unchecked and did the same on my iMac. In my 25 years using macs I have never ever seen that message before.
So, to recap:
1. Download new updates when available, Install macOS updates and Install application updates from the Software Update > Automatic updates were all unchecked
2. Sonoma was downloaded nonetheless
3. Upon the restart (initiated by me) the macOS upgrade started
4. Installation proceeded even though my MBP was running on battery at low 18% (I believe that no software upgrades/installations are allowed if battery is below 50% and MBP is not plugged in)
5. Frankly I felt like I was being hacked.
Since unchecking everything on the iMac in Software Update > Automatic updates and turning it off and on twice since Friday no Sonoma upgrade was performed - good to know.
I called Apple Support yesterday and after telling the whole story to a customer representative was told that this is impossible and that I probably made a mistake. I asked to escalate the issue and talk to a Senior Adviser who was nice, told me that he personally never heard of this and could not comment on what is discussed on public forums including Apple Support Community - I brought up all the links I could find here and on Google. I gave him all the details and he said that the notes are recorded under my Apple ID and will be passed on to an appropriate department. I asked would anyone be in touch with me and he said no. He offered to help me wipe and downgrade the MBP back to Ventura and restore my data which I declined saying I do not have five hours to waste and after checking everything it seems that all my data and software is intact and working.
Apologies for a long post but I thought this should be documented here and hopefully my experience can help others.