Flagged by the Machine: How Google Ads Suspended an Open-Source macOS Term as Malicious

Google Ads unexpectedly suspended an open-source macOS terminal multiplexer developer's account, labeling it as malicious. Przemyslaw Alexander Kaminski, the creator of RACE, an open-source native macOS terminal multiplexer written in Rust, launched an ad campaign for his product. Despite passing native operating system notarization and independent antimalware inspections, Kaminski's ad distribution account was flagged under compromised site and malicious binary designations.

This incident sheds light on the disconnect between advanced security heuristics and developer tools using sophisticated POSIX process orchestration. Kaminski's RACE differs from traditional grid-based terminal multiplexers like tmux by implementing an infinite canvas architecture for shell positioning and resizing. Security scanners evaluate binary safety by analyzing file signatures, static strings, and dynamic process execution patterns.

Conventional desktop applications wouldn't exhibit such behavior, as they typically fork orphaned background workers that receive arbitrary command-line input. However, when Kaminski set up campaigns pointing to product documentation and binary downloads, the campaign platform flagged the destination infrastructure for malicious software violations.

Despite third-party malware analyzers and Google's own diagnostics tools reporting clean results, Google's security policy crawlers still flagged the developer account. Attempts to rectify the suspension revealed circular dependencies in the platform's automated enforcement loop, with no clear explanation provided for the suspension.

The case highlights the growing challenge developers face when building legitimate native utilities under increasingly reliant platform operators using black-box behavioural models for software inspection.