I use both of them. and I found one more. transparent proxy also not working too. third party applications is adgurad, jiran. If either of the two is turned on, it will not work.

I use third-party application. one is adguard(tranpraent proxy) the other is TobeyNE(Contents filter). If either of the two is turned on, it will not work.

Thank you very much

fflag: 1074790400(0x4010000) Previously (macOS 15 and earlier), when performing operation copy files, the es_event_open_t events were only triggered for the source file and target file, with fflag values such as FWRITE or FREAD. However, on macOS 26 beta 4, before the file events occur, additional AUTH_OPEN events are triggered for the source and target directories, and in those cases, the fflag field contains O_SEARCH (e.g., 0x4010000) instead of the expected FREAD/FWRITE.

yes, u r clear right. I referenced sourceAppAuditToken in ur answer. https://developer.apple.com/forums/thread/126820